Security+ SY0-701 & SY0-801 (V8) · Updated 2026
Free CompTIA Security+ Practice Exam (2026)
Full-length mock exams with the same number of questions and time as the real Security+ exam. Built on the objectives shared by SY0-701 and the new SY0-801 (V8), including AI-related risks. Answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
90 questions · 1 hour 30 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 9
🏆
Question 1Security Operations
A coffee shop chain wants its guest Wi-Fi passphrase to resist offline dictionary attacks, even if an attacker captures the authentication exchange. Which option BEST meets this need?
Correct answer: C. WPA3-Personal with SAE
WPA3-Personal replaces the WPA2 pre-shared key handshake with Simultaneous Authentication of Equals (SAE), so a captured exchange cannot be cracked offline. WPA2-PSK with AES still encrypts traffic well, but an attacker who captures its four-way handshake can brute-force the passphrase offline.
WPA3-Personal replaces the WPA2 pre-shared key handshake with Simultaneous Authentication of Equals (SAE), so a captured exchange cannot be cracked offline. WPA2-PSK with AES still encrypts traffic well, but an attacker who captures its four-way handshake can brute-force the passphrase offline.
Question 2Threats, Vulnerabilities & Attacks
Responders at a defense contractor find custom malware that stayed hidden for 14 months and sent design files out in small encrypted batches during business hours. No ransom was demanded. Which threat actor is MOST likely responsible?
Correct answer: B. Nation-state
Long dwell time, custom tooling and quiet theft of defense data point to a well-funded nation-state pursuing espionage. Organized crime is usually after money and would more likely encrypt or extort than stay silent for over a year.
Long dwell time, custom tooling and quiet theft of defense data point to a well-funded nation-state pursuing espionage. Organized crime is usually after money and would more likely encrypt or extort than stay silent for over a year.
Question 3Security Architecture
A company migrates a line-of-business application to IaaS virtual machines in a public cloud. A vulnerability scan shows the guest operating systems are missing several months of security patches. Under the shared responsibility model, who must fix this?
Correct answer: D. The customer, because it manages the guest OS in an IaaS model
In IaaS the provider secures the facility, physical hosts, and hypervisor, while the customer manages the guest OS and everything above it, including patching. Provider-managed OS patching is typical of PaaS and SaaS, not customer-built IaaS virtual machines.
In IaaS the provider secures the facility, physical hosts, and hypervisor, while the customer manages the guest OS and everything above it, including patching. Provider-managed OS patching is typical of PaaS and SaaS, not customer-built IaaS virtual machines.
Question 4General Security Concepts
A manufacturing company runs a legacy controller that the vendor no longer patches. Until it can be replaced, the security team moves it to an isolated VLAN with strict ACLs. Which control category and type BEST describe this measure?
Correct answer: A. Technical and compensating
VLAN segmentation and ACLs are enforced by systems, so the control is technical, and it stands in for the missing patch, which makes it compensating. It is not operational, because operational controls are carried out mainly by people, such as guards or procedures.
VLAN segmentation and ACLs are enforced by systems, so the control is technical, and it stands in for the missing patch, which makes it compensating. It is not operational, because operational controls are carried out mainly by people, such as guards or procedures.
Question 5Program Management & Oversight
A company's file server is valued at $80,000. A flood is estimated to destroy 25% of the server's value, and floods are expected once every four years. What is the annual loss expectancy (ALE)?
Correct answer: B. $5,000
SLE = $80,000 x 0.25 = $20,000. One flood every four years gives an ARO of 0.25, so ALE = $20,000 x 0.25 = $5,000. $20,000 is the SLE, the loss from a single flood, not the expected loss per year.
SLE = $80,000 x 0.25 = $20,000. One flood every four years gives an ARO of 0.25, so ALE = $20,000 x 0.25 = $5,000. $20,000 is the SLE, the loss from a single flood, not the expected loss per year.
Question 6Security Operations
After moving into a new office, employees report Wi-Fi drops in certain rooms. The network team wants a visual map of signal strength across the floor plan to guide access point placement. What should the team produce?
Correct answer: A. A wireless heat map
A heat map, built during a wireless site survey, shows signal coverage across a floor plan so weak spots and poor AP placement are easy to see. A rogue AP scan finds unauthorized access points but does not show how strong the coverage is.
A heat map, built during a wireless site survey, shows signal coverage across a floor plan so weak spots and poor AP placement are easy to see. A rogue AP scan finds unauthorized access points but does not show how strong the coverage is.
Question 7Threats, Vulnerabilities & Attacks
The marketing team signs up for an unapproved cloud file-sharing service using a company credit card and starts storing customer lists there. IT has no visibility into the service. Which term BEST describes this?
Correct answer: D. Shadow IT
Shadow IT is technology adopted without IT approval or oversight, usually by staff trying to get work done faster. Insider sabotage requires intent to cause harm, which is not present here.
Shadow IT is technology adopted without IT approval or oversight, usually by staff trying to get work done faster. Insider sabotage requires intent to cause harm, which is not present here.
Question 8Security Architecture
A development team moves an image-processing workload from a self-managed virtual machine to a serverless function platform. Which security responsibility does the team MOST likely still keep?
Correct answer: A. Securing the function code and the permissions assigned to it
With serverless, the provider runs the servers, OS, and runtime, so the customer's remaining duties center on the code it deploys and the access permissions that code is granted. OS patching moves to the provider, which is one of the main security benefits of going serverless.
With serverless, the provider runs the servers, OS, and runtime, so the customer's remaining duties center on the code it deploys and the access permissions that code is granted. OS patching moves to the provider, which is one of the main security benefits of going serverless.
Question 9General Security Concepts
After a merger, a CISO orders a formal risk assessment of the acquired company's systems and updates the security policy based on the findings. Which control category do these activities represent?
Correct answer: C. Managerial
Risk assessments and security policies are managerial controls because they direct and oversee how security is planned and governed. Operational controls are carried out by people day to day, such as guards or awareness programs, rather than setting direction.
Risk assessments and security policies are managerial controls because they direct and oversee how security is planned and governed. Operational controls are carried out by people day to day, such as guards or awareness programs, rather than setting direction.
Question 10Security Operations
A company buys the same smartphone model for every employee, manages the phones with MDM, and allows staff to install personal apps and use them outside work. Which deployment model is this?
Correct answer: A. COPE
COPE (corporate-owned, personally enabled) means the company owns and manages the device but permits personal use. CYOD is close, but it lets employees choose from a list of approved models, while here everyone receives the same phone.
COPE (corporate-owned, personally enabled) means the company owns and manages the device but permits personal use. CYOD is close, but it lets employees choose from a list of approved models, while here everyone receives the same phone.
Question 11Threats, Vulnerabilities & Attacks
A database administrator is told he will be demoted. Two days later, nightly backups are deleted using his credentials shortly before he resigns. Which motivation BEST fits this activity?
Correct answer: D. Revenge
Destroying data right after a negative job event points to revenge by a disgruntled insider. Financial gain is unlikely because nothing was sold, ransomed or stolen.
Destroying data right after a negative job event points to revenge by a disgruntled insider. Financial gain is unlikely because nothing was sold, ransomed or stolen.
Question 12Program Management & Oversight
A fast-growing startup's board tells the security team it is willing to accept higher levels of risk in exchange for entering new markets quickly. Which risk appetite does this describe?
Correct answer: B. Expansionary
An expansionary risk appetite accepts more risk to pursue growth and new opportunities. A conservative appetite is the opposite, favoring lower risk even when it slows growth.
An expansionary risk appetite accepts more risk to pursue growth and new opportunities. A conservative appetite is the opposite, favoring lower risk even when it slows growth.
Question 13Security Operations
A penetration tester notices that a web application's session cookie is sent when users follow an old http:// link to the site. Which cookie attribute would stop the browser from sending it over unencrypted connections?
Correct answer: C. Secure
The Secure attribute tells the browser to send the cookie only over HTTPS, so it never travels in cleartext. HttpOnly is tempting, but it only blocks client-side scripts from reading the cookie and does nothing about unencrypted transport.
The Secure attribute tells the browser to send the cookie only over HTTPS, so it never travels in cleartext. HttpOnly is tempting, but it only blocks client-side scripts from reading the cookie and does nothing about unencrypted transport.
Question 14Security Architecture
Production cloud servers keep drifting from approved settings because engineers make manual changes. A security architect proposes defining all infrastructure in version-controlled templates deployed through a pipeline. Which security benefit does this provide MOST directly?
Correct answer: B. It yields consistent, reviewable builds that can be redeployed to a known state
Infrastructure as code makes builds repeatable and version-controlled, so changes are reviewed and drifted systems can be rebuilt from the approved template. It does not replace scanning, and a flawed template can actually copy one misconfiguration into every deployment.
Infrastructure as code makes builds repeatable and version-controlled, so changes are reviewed and drifted systems can be rebuilt from the approved template. It does not replace scanning, and a flawed template can actually copy one misconfiguration into every deployment.
Question 15Threats, Vulnerabilities & Attacks
Several engineers at a chemical manufacturer are infected after visiting the website of an industry trade association. Investigators find the association's site was altered to serve malware only to visitors from the manufacturer's IP range. Which attack BEST describes this?
Correct answer: D. Watering hole
A watering hole attack compromises a trusted site that the target group already visits. Typosquatting relies on users mistyping a domain, but here the engineers went to the real association site.
A watering hole attack compromises a trusted site that the target group already visits. Typosquatting relies on users mistyping a domain, but here the engineers went to the real association site.
Question 16General Security Concepts
A bank requires that a manager who approves a high-value wire transfer cannot later credibly claim that someone else approved it. Which security concept does this requirement address?
Correct answer: B. Non-repudiation
Non-repudiation provides proof of who performed an action, so the manager cannot credibly deny approving the transfer. Authorization only decides whether the manager was allowed to approve it, not whether there is proof that they did.
Non-repudiation provides proof of who performed an action, so the manager cannot credibly deny approving the transfer. Authorization only decides whether the manager was allowed to approve it, not whether there is proof that they did.
Question 17Security Operations
A development team wants to find hard-coded credentials and unsafe function calls in its source code before the application is compiled or deployed. Which technique BEST fits?
Correct answer: C. Static code analysis
Static code analysis reviews source code without running it, so it can flag hard-coded secrets and risky functions early in development. Dynamic testing needs a running application and can miss issues in code paths it never exercises.
Static code analysis reviews source code without running it, so it can flag hard-coded secrets and risky functions early in development. Dynamic testing needs a running application and can miss issues in code paths it never exercises.
Question 18Program Management & Oversight
Two nonprofit organizations want a document that records their shared intent to collaborate on a regional security awareness program, without creating legally binding obligations. Which agreement BEST fits?
Correct answer: A. Memorandum of understanding
An MOU states mutual goals and intent between parties and is generally not legally binding. A business partnership agreement is a binding contract that defines how partners share profits, losses, and responsibilities.
An MOU states mutual goals and intent between parties and is generally not legally binding. A business partnership agreement is a binding contract that defines how partners share profits, losses, and responsibilities.
Question 19Threats, Vulnerabilities & Attacks
Finance receives an email from the CFO's real mailbox asking to update a supplier's bank details before the next payment run. Headers show it came from inside the company's tenant, and the CFO later says she never sent it. Which attack BEST describes this?
Correct answer: D. Business email compromise
Business email compromise uses a real, taken-over business mailbox to trick staff into fraudulent payments. Brand impersonation copies a company's look from outside, but this message came from the CFO's actual account.
Business email compromise uses a real, taken-over business mailbox to trick staff into fraudulent payments. Brand impersonation copies a company's look from outside, but this message came from the CFO's actual account.
Question 20Security Architecture
A water utility keeps its SCADA control network physically disconnected from all other networks. Which threat vector remains the MOST significant concern for this air-gapped environment?
Correct answer: A. Malware introduced through removable media carried in by technicians
An air gap blocks network-based attacks, so the main way in becomes physical, such as infected USB drives or maintenance laptops. Exposed remote desktop services are not reachable if the network truly has no outside connections.
An air gap blocks network-based attacks, so the main way in becomes physical, such as infected USB drives or maintenance laptops. Exposed remote desktop services are not reachable if the network truly has no outside connections.
Question 21Security Operations
A security team wants suspicious email attachments to be opened automatically in an isolated environment so their behavior can be observed before the messages reach users. Which technique is this?
Correct answer: C. Sandboxing
Sandboxing runs untrusted code in an isolated environment where its actions, such as file changes or network callbacks, can be watched without risking production systems. Application allow listing only permits approved programs to run and does not observe what an unknown file actually does.
Sandboxing runs untrusted code in an isolated environment where its actions, such as file changes or network callbacks, can be watched without risking production systems. Application allow listing only permits approved programs to run and does not observe what an unknown file actually does.
Question 22General Security Concepts
In a zero trust architecture, which component evaluates an access request against policy and threat intelligence and makes the final decision to grant or deny access to a resource?
Correct answer: D. Policy engine
The policy engine is the control plane component that makes the actual grant or deny decision. The policy administrator acts on that decision by setting up or closing the session path and telling the enforcement point what to do.
The policy engine is the control plane component that makes the actual grant or deny decision. The policy administrator acts on that decision by setting up or closing the session path and telling the enforcement point what to do.
Question 23Threats, Vulnerabilities & Attacks
A user receives an email with no links or attachments, only an embedded picture of a QR code telling them to re-enroll in MFA. The email gateway's URL scanning did not flag it. Which threat vector does this BEST represent?
Correct answer: D. Image-based
The lure is carried inside an image, so URL filters that inspect text links never see the destination. A file-based vector would rely on an attachment such as a document or archive, and this email has none.
The lure is carried inside an image, so URL filters that inspect text links never see the destination. A file-based vector would rely on an attachment such as a document or archive, and this email has none.
Question 24Security Architecture
A firewall protects a network segment that stores payment card data. Policy states that if the firewall fails, confidentiality must take priority over availability. How should the firewall's failure mode be configured?
Correct answer: B. Fail-closed, so all traffic is blocked until the device is restored
A fail-closed device blocks traffic when it fails, protecting confidentiality at the cost of availability. Fail-open keeps the business running but lets uninspected traffic reach the sensitive segment.
A fail-closed device blocks traffic when it fails, protecting confidentiality at the cost of availability. Fail-open keeps the business running but lets uninspected traffic reach the sensitive segment.
Question 25Security Operations
A company is returning leased laptops with self-encrypting SSDs to the lessor, and the drives must remain usable. Which method BEST ensures the data cannot be recovered?
Correct answer: C. Using cryptographic erase
Cryptographic erase destroys the encryption key on a self-encrypting drive, which makes all stored data unreadable while leaving the drive usable. Degaussing does not work on flash storage, and on a magnetic drive it would ruin the disk, so it fails the reuse requirement either way.
Cryptographic erase destroys the encryption key on a self-encrypting drive, which makes all stored data unreadable while leaving the drive usable. Degaussing does not work on flash storage, and on a magnetic drive it would ruin the disk, so it fails the reuse requirement either way.
Question 26Program Management & Oversight
A company is signing a contract with a cloud storage provider and wants the ability to inspect the provider's security controls, either directly or through an auditor it chooses. Which contract element provides this?
Correct answer: D. Right-to-audit clause
A right-to-audit clause gives the customer contractual permission to assess the vendor's controls itself or through a third party. A service-level agreement defines performance targets such as uptime, not the right to inspect security controls.
A right-to-audit clause gives the customer contractual permission to assess the vendor's controls itself or through a third party. A service-level agreement defines performance targets such as uptime, not the right to inspect security controls.
Question 27Threats, Vulnerabilities & Attacks
Ransomware hits a dozen small businesses on the same night. All of them use the same managed service provider, and the payload was pushed through the provider's remote management tool. Which attack surface was MOST likely exploited?
Correct answer: C. Supply chain through the MSP
The common link is the MSP, so the attacker abused a trusted third party in the supply chain to reach every client at once. Open ports could explain one victim, but not a simultaneous push through a shared management tool.
The common link is the MSP, so the attacker abused a trusted third party in the supply chain to reach every client at once. Open ports could explain one victim, but not a simultaneous push through a shared management tool.
Question 28Security Operations
A hospital hires a third-party vendor to shred decommissioned hard drives off-site. Which document should the hospital obtain to prove the drives were properly destroyed?
Correct answer: B. A certificate of destruction
A certificate of destruction is the vendor's formal record that specific media were destroyed, which supports audits and compliance. An SLA defines service expectations such as turnaround time, but it does not prove that any particular drive was destroyed.
A certificate of destruction is the vendor's formal record that specific media were destroyed, which supports audits and compliance. An SLA defines service expectations such as turnaround time, but it does not prove that any particular drive was destroyed.
Question 29General Security Concepts
A company plans to adopt a new security framework. The security team documents the difference between the controls it has today and the controls the framework requires, then uses the results to plan remediation. What is this process called?
Correct answer: C. Gap analysis
A gap analysis compares the current security posture with a target state, such as a framework's requirements, and shows what must be added or improved. Impact analysis looks at the effect of a change or disruption, not at missing controls against a standard.
A gap analysis compares the current security posture with a target state, such as a framework's requirements, and shows what must be added or improved. Impact analysis looks at the effect of a change or disruption, not at missing controls against a standard.
Question 30Security Architecture
A security team wants a sensor that can automatically drop malicious packets before they reach internal servers. How must the sensor be deployed?
Correct answer: A. Placed inline in the traffic path as an intrusion prevention system
Only an inline device can stop packets, because traffic must pass through it before reaching its destination. A tap or SPAN port only receives a copy of the traffic, so a sensor there can alert but cannot block the original packets.
Only an inline device can stop packets, because traffic must pass through it before reaching its destination. A tap or SPAN port only receives a copy of the traffic, so a sensor there can alert but cannot block the original packets.
Question 31Threats, Vulnerabilities & Attacks
A user's VPN session from Chicago ends at 09:00. At 09:25 the same account successfully authenticates from Singapore, and the user has not travelled. Which indicator does this BEST represent?
Correct answer: B. Impossible travel
No one can travel from Chicago to Singapore in 25 minutes, so this is impossible travel and suggests stolen credentials. It is not concurrent session usage because the first session had already ended.
No one can travel from Chicago to Singapore in 25 minutes, so this is impossible travel and suggests stolen credentials. It is not concurrent session usage because the first session had already ended.
Question 32Program Management & Oversight
An online retailer backs up its order database every six hours. After a business review, leadership states that no more than one hour of order data can be lost after an outage. Which metric does the current backup schedule fail to meet?
Correct answer: A. Recovery point objective
RPO is the maximum acceptable data loss measured in time, so a six-hour backup interval cannot meet a one-hour RPO. RTO is about how quickly the system must be restored, not how much data can be lost.
RPO is the maximum acceptable data loss measured in time, so a six-hour backup interval cannot meet a one-hour RPO. RTO is about how quickly the system must be restored, not how much data can be lost.
Question 33Security Operations
A vulnerability manager needs a standardized way to rate the severity of newly disclosed flaws on a 0.0 to 10.0 scale so teams can rank remediation work. Which should be used?
Correct answer: C. CVSS
The Common Vulnerability Scoring System produces a 0.0 to 10.0 severity score based on factors such as attack vector and impact. CVE is the tempting choice, but it only assigns a unique identifier to each vulnerability and does not rate its severity.
The Common Vulnerability Scoring System produces a 0.0 to 10.0 severity score based on factors such as attack vector and impact. CVE is the tempting choice, but it only assigns a unique identifier to each vulnerability and does not rate its severity.
Question 34Security Architecture
Administrators need to manage servers in a restricted management zone. The security architect wants every administrative session to pass through one hardened, monitored system instead of allowing direct connections from workstations. Which solution BEST meets this requirement?
Correct answer: D. A jump server that brokers access into the restricted management zone
A jump server is a hardened host that admins connect to first and then use to reach protected systems, creating one controlled and logged path. A reverse proxy brokers inbound application traffic, not interactive admin sessions into a secure zone.
A jump server is a hardened host that admins connect to first and then use to reach protected systems, creating one controlled and logged path. A reverse proxy brokers inbound application traffic, not interactive admin sessions into a secure zone.
Question 35Threats, Vulnerabilities & Attacks
Authentication logs show one failed login each for 600 different accounts within ten minutes, all using the same seasonal password, and no accounts were locked out. Which attack is MOST likely?
Correct answer: D. Password spraying
Password spraying tries one common password across many accounts to stay below lockout thresholds. Brute force hammers a single account with many guesses and would usually trigger lockouts.
Password spraying tries one common password across many accounts to stay below lockout thresholds. Brute force hammers a single account with many guesses and would usually trigger lockouts.
Question 36General Security Concepts
A company wants to stop vehicles from being driven into the glass lobby of its headquarters while still letting pedestrians walk freely up to the entrance. Which control BEST meets this need?
Correct answer: A. Bollards
Bollards are short, sturdy posts that block vehicles while leaving gaps for people on foot. Fencing could also stop vehicles, but it would block pedestrian access to the entrance as well.
Bollards are short, sturdy posts that block vehicles while leaving gaps for people on foot. Fencing could also stop vehicles, but it would block pedestrian access to the entrance as well.
Question 37Security Operations
A scan of a Linux web server running Nginx reports a critical vulnerability that only affects Microsoft IIS. How should the analyst classify this finding?
Correct answer: B. False positive
A false positive is a reported vulnerability that does not actually exist on the system, such as an IIS flaw flagged on an Nginx host. A false negative is the opposite: a real vulnerability that the scanner fails to report.
A false positive is a reported vulnerability that does not actually exist on the system, such as an IIS flaw flagged on an Nginx host. A false negative is the opposite: a real vulnerability that the scanner fails to report.
Question 38Program Management & Oversight
A retailer decides which employee data is collected and why, then hires a payroll company to calculate salaries using that data. Under privacy regulations, what role does the payroll company hold?
Correct answer: D. Data processor
A processor handles personal data on behalf of the controller and follows the controller's instructions. The retailer is the controller because it decides the purpose and means of the processing.
A processor handles personal data on behalf of the controller and follows the controller's instructions. The retailer is the controller because it decides the purpose and means of the processing.
Question 39Threats, Vulnerabilities & Attacks
An EDR agent reports a server as clean, but a scan from trusted boot media finds hidden files and a modified kernel driver that conceals certain processes from the operating system. Which malware type is MOST likely present?
Correct answer: C. Rootkit
Rootkits hide at the kernel or firmware level and conceal their activity from tools running on the infected OS, which is why only an offline scan found them. Spyware focuses on collecting information and does not usually modify kernel drivers to hide itself.
Rootkits hide at the kernel or firmware level and conceal their activity from tools running on the infected OS, which is why only an offline scan found them. Spyware focuses on collecting information and does not usually modify kernel drivers to hide itself.
Question 40Security Operations
After a breach is resolved, the team learns attackers entered through a contractor's VPN account. The team keeps asking why until it finds that the offboarding process never disabled contractor accounts. Which activity is this?
Correct answer: B. Root cause analysis
Root cause analysis keeps digging past the immediate cause, the misused VPN account, to the underlying failure that allowed it, the broken offboarding process. A business impact analysis estimates how disruptions affect critical business functions and does not investigate why an incident happened.
Root cause analysis keeps digging past the immediate cause, the misused VPN account, to the underlying failure that allowed it, the broken offboarding process. A business impact analysis estimates how disruptions affect critical business functions and does not investigate why an incident happened.
Question 41Security Architecture
A company deploys 802.1X on its wired network so that only authenticated devices can use switch ports. In this design, which component acts as the authenticator?
Correct answer: C. The switch that controls the port the device connects to
In 802.1X the supplicant is the client, the authenticator is the switch or access point that controls the port, and the authentication server is usually RADIUS. The RADIUS server makes the decision, but the switch enforces it, which is why the switch is the authenticator.
In 802.1X the supplicant is the client, the authenticator is the switch or access point that controls the port, and the authentication server is usually RADIUS. The RADIUS server makes the decision, but the switch enforces it, which is why the switch is the authenticator.
Question 42General Security Concepts
A security team places a fake cloud API key in a code repository. The key grants no access, but any attempt to use it triggers an alert. What type of deception is this?
Correct answer: A. Honeytoken
A honeytoken is a fake credential or data item with no real use, so any attempt to use it signals an intrusion. A honeyfile is a decoy document that alerts when opened, but here the bait is a credential, not a file.
A honeytoken is a fake credential or data item with no real use, so any attempt to use it signals an intrusion. A honeyfile is a decoy document that alerts when opened, but here the bait is a credential, not a file.
Question 43Threats, Vulnerabilities & Attacks
A code review of the payroll system finds a routine added by a former contractor that deletes salary records if his account is ever removed from the HR directory. Which malware type does this describe?
Correct answer: B. Logic bomb
A logic bomb sits dormant until a specific condition is met, such as an account being removed. A trojan disguises itself as useful software to get installed, which does not match code planted inside an existing system by an insider.
A logic bomb sits dormant until a specific condition is met, such as an account being removed. A trojan disguises itself as useful software to get installed, which does not match code planted inside an existing system by an insider.
Question 44Security Operations
An administrator has deployed a patch for a critical vulnerability across all affected servers. What is the BEST way to validate that the remediation worked?
Correct answer: A. Rescan the servers for the vulnerability
Rescanning confirms the vulnerability is actually gone, catching cases where a patch failed, needed a reboot, or missed a host. A success message from the patch tool only shows that the deployment ran, not that the exposure was removed.
Rescanning confirms the vulnerability is actually gone, catching cases where a patch failed, needed a reboot, or missed a host. A success message from the patch tool only shows that the deployment ran, not that the exposure was removed.
Question 45Security Architecture
An online store sees repeated SQL injection and cross-site scripting attempts against its web application. The existing stateful firewall allows this traffic because it arrives on permitted port 443. Which control would BEST address the problem?
Correct answer: C. A web application firewall that inspects HTTP requests at layer 7
A WAF understands HTTP and can detect and block application-layer attacks such as SQL injection and XSS. A layer 4 firewall sees only addresses, ports, and connection state, so it cannot judge the content of an allowed HTTPS request.
A WAF understands HTTP and can detect and block application-layer attacks such as SQL injection and XSS. A layer 4 firewall sees only addresses, ports, and connection state, so it cannot judge the content of an allowed HTTPS request.
Question 46Program Management & Oversight
A penetration tester receives network diagrams and a list of in-scope IP ranges, but no credentials, source code, or details about the security tools in use. Which type of test environment is this?
Correct answer: B. Partially known environment
A partially known environment gives the tester some information, such as diagrams and IP ranges, but not full internal details. A known environment would include complete details like credentials, source code, and configurations.
A partially known environment gives the tester some information, such as diagrams and IP ranges, but not full internal details. A known environment would include complete details like credentials, source code, and configurations.
Question 47Security Operations
A security team wants configuration-checking and vulnerability tools from different vendors to use common formats for checklists, platform names, and severity scores so results can be compared automatically. Which framework BEST meets this need?
Correct answer: D. SCAP
The Security Content Automation Protocol defines standard formats such as XCCDF, OVAL, CPE, and CVSS, so different tools can run the same checks and report comparable results. STIX/TAXII standardizes the sharing of threat intelligence, not configuration and vulnerability checking.
The Security Content Automation Protocol defines standard formats such as XCCDF, OVAL, CPE, and CVSS, so different tools can run the same checks and report comparable results. STIX/TAXII standardizes the sharing of threat intelligence, not configuration and vulnerability checking.
Question 48Threats, Vulnerabilities & Attacks
Within an hour, malware spreads to 300 unpatched hosts across several subnets by exploiting a vulnerable file-sharing service. No users opened files or clicked links. Which malware type is MOST likely?
Correct answer: A. Worm
Worms replicate on their own by exploiting network services, with no user action needed. A virus needs a host file and usually a user to run it, so it would not spread this fast without interaction.
Worms replicate on their own by exploiting network services, with no user action needed. A virus needs a host file and usually a user to run it, so it would not spread this fast without interaction.
Question 49General Security Concepts
During a scheduled firewall firmware upgrade, the new version causes all remote VPN connections to fail. Which change management element should the team rely on to restore service quickly?
Correct answer: B. Backout plan
A backout plan documents how to roll a change back to the last known good state if something goes wrong. Impact analysis happens before the change to predict its effects; it does not tell the team how to undo it.
A backout plan documents how to roll a change back to the last known good state if something goes wrong. Impact analysis happens before the change to predict its effects; it does not tell the team how to undo it.
Question 50Security Architecture
A financial firm wants to protect sensitive records while they are being processed in a server's memory, not only while stored or transmitted. Which protection BEST addresses this data state?
Correct answer: D. A secure enclave that isolates data during processing
Data in use is data loaded in memory or the CPU, and a secure enclave or trusted execution environment protects it during processing. TLS protects data in transit and disk or backup encryption protects data at rest, so neither covers memory.
Data in use is data loaded in memory or the CPU, and a secure enclave or trusted execution environment protects it during processing. TLS protects data in transit and disk or backup encryption protects data at rest, so neither covers memory.
Question 51Security Operations
A network team wants core switches to notify the management station immediately when a power supply fails, instead of waiting for the next polling cycle. Which feature should be configured?
Correct answer: D. SNMP traps
An SNMP trap is an unsolicited message the device sends to the manager as soon as a defined event occurs. SNMP GET polling is the opposite approach: the manager asks for status at set intervals and may not learn of the failure until the next poll.
An SNMP trap is an unsolicited message the device sends to the manager as soon as a defined event occurs. SNMP GET polling is the opposite approach: the manager asks for status at set intervals and may not learn of the failure until the next poll.
Question 52Threats, Vulnerabilities & Attacks
An IDS shows that a client and server that both support current TLS versions negotiated an old protocol version with weak ciphers after a device in the path altered the handshake messages. Which attack does this indicate?
Correct answer: A. Downgrade
A downgrade attack tampers with negotiation so both sides fall back to a weaker protocol or cipher that is easier to break. A replay attack resends captured traffic and does not change which protocol the parties agree on.
A downgrade attack tampers with negotiation so both sides fall back to a weaker protocol or cipher that is easier to break. A replay attack resends captured traffic and does not change which protocol the parties agree on.
Question 53Program Management & Oversight
During the reconnaissance phase of an authorized penetration test, which activity is an example of passive reconnaissance?
Correct answer: C. Reviewing public job postings and WHOIS records
Passive reconnaissance gathers information without sending traffic to the target, such as reading job postings and WHOIS data. Banner grabbing seems low-key, but it connects directly to the target's servers, so it is active reconnaissance.
Passive reconnaissance gathers information without sending traffic to the target, such as reading job postings and WHOIS data. Banner grabbing seems low-key, but it connects directly to the target's servers, so it is active reconnaissance.
Question 54General Security Concepts
A change request to restart a database service is approved and performed during a maintenance window. Right after the restart, the company's web application and reporting tools also go offline. Which change management factor was MOST likely overlooked?
Correct answer: A. Service dependencies
Other applications relied on the database, so restarting it took them down too. Mapping dependencies before the change would have shown which services to stop, sequence, or monitor. Stakeholder approval was already given and would not prevent this technical knock-on effect.
Other applications relied on the database, so restarting it took them down too. Mapping dependencies before the change would have shown which services to stop, sequence, or monitor. Stakeholder approval was already given and would not prevent this technical knock-on effect.
Question 55Security Operations
A SOC analyst suspects a workstation is sending large amounts of data to an unfamiliar external IP address. The analyst needs to see who talked to whom, how much, and when, without storing full packet contents. Which data source BEST fits?
Correct answer: B. NetFlow records
NetFlow records summarize conversations by source, destination, ports, byte counts, and timestamps, which makes them ideal for spotting unusual transfers. Full packet capture would also show this, but it stores entire payloads, which the analyst wants to avoid.
NetFlow records summarize conversations by source, destination, ports, byte counts, and timestamps, which makes them ideal for spotting unusual transfers. Full packet capture would also show this, but it stores entire payloads, which the analyst wants to avoid.
Question 56Threats, Vulnerabilities & Attacks
An attacker captures a valid authentication message on the network and resends it later to log in as the user without knowing the password. Which control BEST mitigates this attack?
Correct answer: B. Unique nonces with timestamps
Nonces and timestamps make each authentication message valid only once and only for a short time, so a resent copy is rejected. Stronger passwords do not help because the attacker never needs to learn the password.
Nonces and timestamps make each authentication message valid only once and only for a short time, so a resent copy is rejected. Stronger passwords do not help because the attacker never needs to learn the password.
Question 57Security Architecture
Sales staff keep signed customer contracts on their laptops. Management is worried about what happens if a laptop is stolen from a car while it is powered off. Which control BEST protects the contracts in this situation?
Correct answer: C. Full-disk encryption on each laptop
A powered-off stolen laptop is a data-at-rest risk, and full-disk encryption makes the drive unreadable without the key. TLS only protects data in transit, and hashing proves integrity but does not hide the contents.
A powered-off stolen laptop is a data-at-rest risk, and full-disk encryption makes the drive unreadable without the key. TLS only protects data in transit, and hashing proves integrity but does not hide the contents.
Question 58Security Operations
Employees sign in once with corporate credentials to reach a third-party SaaS HR platform. The identity provider sends XML-based assertions to the service provider to vouch for each user. Which standard is in use?
Correct answer: B. SAML
SAML exchanges XML assertions between an identity provider and a service provider to deliver web-based SSO and federation. OAuth 2.0 is often confused with it, but OAuth handles delegated authorization with tokens and does not use XML assertions.
SAML exchanges XML assertions between an identity provider and a service provider to deliver web-based SSO and federation. OAuth 2.0 is often confused with it, but OAuth handles delegated authorization with tokens and does not use XML assertions.
Question 59Program Management & Oversight
A legacy manufacturing controller cannot support the company's new encryption standard. Management formally approves keeping it in service unchanged, records an exception in the risk register, and schedules a review every six months. Which risk strategy is this?
Correct answer: D. Acceptance
Approving the system to keep running without meeting the standard, and documenting an exception, is risk acceptance. Mitigation would require adding controls to reduce the risk, and nothing was added here.
Approving the system to keep running without meeting the standard, and documenting an exception, is risk acceptance. Mitigation would require adding controls to reduce the risk, and nothing was added here.
Question 60Threats, Vulnerabilities & Attacks
A security architect retires a legacy 64-bit hash used for document signing because an attacker could find two different inputs with the same digest in roughly 2^32 attempts. Which attack is the architect MOST concerned about?
Correct answer: A. Birthday attack
A birthday attack uses probability to find hash collisions in about the square root of the output space, so a 64-bit hash falls in around 2^32 tries. Pass-the-hash reuses a stolen password hash to log in and has nothing to do with finding collisions.
A birthday attack uses probability to find hash collisions in about the square root of the output space, so a 64-bit hash falls in around 2^32 tries. Pass-the-hash reuses a stolen password hash to log in and has nothing to do with finding collisions.
Question 61Security Architecture
A European company plans to store customer records with a cloud provider whose nearest data center is in another country. Legal counsel warns that the records would then become subject to that country's laws. Which concept does this concern describe?
Correct answer: C. Data sovereignty
Data sovereignty means data is subject to the laws of the country where it is physically stored or processed. Geographic dispersion is a resilience strategy for spreading sites apart, not a legal concept.
Data sovereignty means data is subject to the laws of the country where it is physically stored or processed. Geographic dispersion is a resilience strategy for spreading sites apart, not a legal concept.
Question 62General Security Concepts
An attacker steals a password database and notices that users who chose the same password have exactly the same stored hash. Which measure would have prevented identical passwords from producing identical hashes?
Correct answer: A. Adding a unique salt
A salt is a random value added to each password before hashing, so identical passwords produce different hashes and precomputed rainbow tables stop working. Key stretching makes each guess slower, but without a unique salt the same password still gives the same result.
A salt is a random value added to each password before hashing, so identical passwords produce different hashes and precomputed rainbow tables stop working. Key stretching makes each guess slower, but without a unique salt the same password still gives the same result.
Question 63Security Operations
A company wants to allow access to its finance application only when the user is in the finance department, is on a managed device, and is connecting from the home country. Which access control model BEST supports this?
Correct answer: D. ABAC
Attribute-based access control evaluates several attributes, such as department, device status, and location, in a single policy decision. Role-based access control is the tempting answer, but it grants access based on role alone and cannot easily factor in device or location conditions.
Attribute-based access control evaluates several attributes, such as department, device status, and location, in a single policy decision. Role-based access control is the tempting answer, but it grants access based on role alone and cannot easily factor in device or location conditions.
Question 64Threats, Vulnerabilities & Attacks
An analyst finds malicious code running inside the address space of a signed, trusted system process. No malicious executable was written to disk, and a short script launched the code before exiting. Which technique BEST describes this?
Correct answer: A. Memory injection
Memory injection places code into another process's memory so it runs under a trusted name and avoids leaving files on disk. A buffer overflow overwrites memory past a buffer's boundary in the vulnerable program itself, which is not what the script did here.
Memory injection places code into another process's memory so it runs under a trusted name and avoids leaving files on disk. A buffer overflow overwrites memory past a buffer's boundary in the vulnerable program itself, which is not what the script did here.
Question 65Program Management & Oversight
A multinational company lets each regional business unit write and enforce its own security policies, with headquarters providing only minimal oversight. Which governance structure is this?
Correct answer: C. Decentralized
In decentralized governance, individual units make their own security decisions instead of following one central authority. Centralized governance is the opposite, where a single group sets policy for the whole organization.
In decentralized governance, individual units make their own security decisions instead of following one central authority. Centralized governance is the opposite, where a single group sets policy for the whole organization.
Question 66Security Operations
A password policy remembers the last 10 passwords, but auditors find users changing their password 11 times within a few minutes to get back to their original one. Which setting would BEST stop this?
Correct answer: D. Minimum password age
A minimum password age forces users to keep a new password for a set time, such as one day, so they cannot cycle quickly through the history list. A maximum password age controls how often a change is required, which does nothing to stop rapid repeated changes.
A minimum password age forces users to keep a new password for a set time, such as one day, so they cannot cycle quickly through the history list. A maximum password age controls how often a change is required, which does nothing to stop rapid repeated changes.
Question 67Security Architecture
A payment processor must restore critical operations within 30 minutes of a primary data center outage. Cost is a secondary concern. Which recovery site BEST meets this requirement?
Correct answer: D. A hot site with running systems and current data
A hot site is fully equipped and kept in sync with current data, so it can take over within minutes, which fits a very short RTO. A warm site has hardware in place but still needs data restored and systems configured, which usually takes hours or more.
A hot site is fully equipped and kept in sync with current data, so it can take over within minutes, which fits a very short RTO. A warm site has hardware in place but still needs data restored and systems configured, which usually takes hours or more.
Question 68Threats, Vulnerabilities & Attacks
A privileged utility checks that a user may write to a temporary file and then opens it a moment later. An attacker swaps the file for a link to a system file between those two steps. Which vulnerability is this?
Correct answer: B. TOCTOU race condition
A time-of-check to time-of-use (TOCTOU) race condition occurs when a resource changes between the moment it is checked and the moment it is used. Directory traversal manipulates file paths in input, but here the path stayed the same and the file itself was swapped.
A time-of-check to time-of-use (TOCTOU) race condition occurs when a resource changes between the moment it is checked and the moment it is used. Directory traversal manipulates file paths in input, but here the path stayed the same and the file itself was swapped.
Question 69General Security Concepts
A developer digitally signs a software update before publishing it. Which key does the developer use to create the signature, and which key do users use to verify it?
Correct answer: C. Developer's private key; developer's public key
The developer signs a hash of the update with their private key, and anyone can verify it with the developer's matching public key. Reversing the keys would let anyone holding the public key create a signature, which defeats the point of proving who published the update.
The developer signs a hash of the update with their private key, and anyone can verify it with the developer's matching public key. Reversing the keys would let anyone holding the public key create a signature, which defeats the point of proving who published the update.
Question 70Security Operations
A company wants administrators to have no standing privileged access. Elevated rights should be granted only after approval and removed automatically after a short window. Which PAM capability does this describe?
Correct answer: B. Just-in-time permissions
Just-in-time permissions grant elevated rights only when needed and remove them automatically when the window ends, which eliminates standing admin access. Password vaulting protects and checks out privileged credentials, but by itself it does not remove standing privileges from accounts.
Just-in-time permissions grant elevated rights only when needed and remove them automatically when the window ends, which eliminates standing admin access. Password vaulting protects and checks out privileged credentials, but by itself it does not remove standing privileges from accounts.
Question 71Security Architecture
After a business impact analysis, management states the company can tolerate losing no more than 15 minutes of transaction data. Which metric does this define, and what does it MOST directly drive?
Correct answer: C. RPO, which drives how often data must be backed up or replicated
The recovery point objective is the maximum acceptable data loss measured in time, so a 15-minute RPO requires backups, replication, or journaling at least that often. RTO is about how long restoration may take, not how much data may be lost.
The recovery point objective is the maximum acceptable data loss measured in time, so a 15-minute RPO requires backups, replication, or journaling at least that often. RTO is about how long restoration may take, not how much data may be lost.
Question 72Threats, Vulnerabilities & Attacks
A cloud provider issues an emergency hypervisor patch for a flaw that let code running in one customer's virtual machine execute commands on the underlying host. Which vulnerability does this describe?
Correct answer: B. VM escape
VM escape breaks out of a guest and reaches the hypervisor or host, which could expose every other tenant on that machine. Resource reuse is about leftover data in memory or storage being reassigned without wiping, not about running commands on the host.
VM escape breaks out of a guest and reaches the hypervisor or host, which could expose every other tenant on that machine. Resource reuse is about leftover data in memory or storage being reassigned without wiping, not about running commands on the host.
Question 73Program Management & Oversight
An employee receives several unexpected MFA push prompts on her phone at 3 a.m. while she is not trying to log in. Based on security awareness training, what should she do FIRST?
Correct answer: C. Deny the prompts and report them to security
Unexpected MFA prompts are anomalous behavior that suggests someone has her password and is attempting MFA fatigue, so she should deny them and report it. Approving one prompt to stop the noise would give the attacker access to her account.
Unexpected MFA prompts are anomalous behavior that suggests someone has her password and is attempting MFA fatigue, so she should deny them and report it. Approving one prompt to stop the noise would give the attacker access to her account.
Question 74Security Operations
A company routes every phishing report through one SOAR platform that quarantines emails and blocks senders automatically. When the platform was offline for a day, no phishing reports were handled at all. Which automation consideration does this BEST illustrate?
Correct answer: A. Single point of failure
A single point of failure exists when one component's outage stops an entire process, as happened when the only SOAR platform went offline. Technical debt refers to automation shortcuts that create future maintenance work, not an outage that halts operations.
A single point of failure exists when one component's outage stops an entire process, as happened when the only SOAR platform went offline. Technical debt refers to automation shortcuts that create future maintenance work, not an outage that halts operations.
Question 75General Security Concepts
A certificate authority needs to protect its root signing keys in tamper-resistant hardware that can also perform a high volume of cryptographic operations for many servers. Which solution BEST meets this need?
Correct answer: D. Hardware security module
An HSM is a dedicated, tamper-resistant device built to protect high-value keys and handle many cryptographic operations for multiple systems. A TPM is built into a single computer and protects that device's keys, so it does not scale to serve a whole CA.
An HSM is a dedicated, tamper-resistant device built to protect high-value keys and handle many cryptographic operations for multiple systems. A TPM is built into a single computer and protects that device's keys, so it does not scale to serve a whole CA.
Question 76Threats, Vulnerabilities & Attacks
A researcher downloads thousands of customer records from a company's cloud object storage without any credentials. No software flaw in the provider's platform was exploited. Which vulnerability MOST likely caused the exposure?
Correct answer: A. Cloud misconfiguration
Access without credentials and without any exploit points to a storage container left publicly readable, which is a cloud misconfiguration. A zero-day requires an unknown software flaw, and the scenario rules that out.
Access without credentials and without any exploit points to a storage container left publicly readable, which is a cloud misconfiguration. A zero-day requires an unknown software flaw, and the scenario rules that out.
Question 77Security Architecture
Department leads meet in a conference room to walk through a ransomware scenario, discussing their roles and decisions step by step without touching any production or test systems. Which type of recovery test is this?
Correct answer: C. Tabletop exercise
A tabletop exercise is a discussion-based walkthrough where participants talk through a scenario and their responses with no impact on systems. A simulation is more hands-on, with teams reacting to staged events as if they were real.
A tabletop exercise is a discussion-based walkthrough where participants talk through a scenario and their responses with no impact on systems. A simulation is more hands-on, with teams reacting to staged events as if they were real.
Question 78Security Operations
A SOC team has isolated an infected server from the network to stop malware from spreading. According to the incident response process, what should happen NEXT?
Correct answer: D. Eradication
After containment, the eradication phase removes the malware and any persistence mechanisms from affected systems. Recovery comes later, because restoring the server to production before the threat is removed could bring the infection back.
After containment, the eradication phase removes the malware and any persistence mechanisms from affected systems. Recovery comes later, because restoring the server to production before the threat is removed could bring the infection back.
Question 79Program Management & Oversight
A regional pharmacy chain repeatedly fails required regulatory inspections, and the state board revokes its authorization to dispense medications. Which consequence of non-compliance does this BEST represent?
Correct answer: D. Loss of license
Revoking the authorization to operate is a loss of license, which stops the business from performing its core function. Reputational damage may follow, but the direct consequence here is the regulator removing the license.
Revoking the authorization to operate is a loss of license, which stops the business from performing its core function. Reputational damage may follow, but the direct consequence here is the regulator removing the license.
Question 80Threats, Vulnerabilities & Attacks
A company's AI email assistant summarizes incoming messages. One external email contains hidden text telling the assistant to forward the user's recent invoices to an outside address, and the assistant tries to do it. Which AI risk does this BEST describe?
Correct answer: B. Prompt injection
Prompt injection hides instructions in content the model processes so it follows the attacker instead of the user. Data poisoning corrupts training data before the model is built, while this attack happened at run time through a single email.
Prompt injection hides instructions in content the model processes so it follows the attacker instead of the user. Data poisoning corrupts training data before the model is built, while this attack happened at run time through a single email.
Question 81General Security Concepts
A web team wants browsers to confirm that the site's certificate has not been revoked without each browser contacting the CA, which adds delay and exposes users' browsing activity. Which solution BEST meets this need?
Correct answer: B. OCSP stapling
With OCSP stapling, the web server fetches a signed, time-stamped OCSP response from the CA and attaches it to the TLS handshake. A CRL still requires the client to download a list from the CA, which can be large and out of date.
With OCSP stapling, the web server fetches a signed, time-stamped OCSP response from the CA and attaches it to the TLS handshake. A CRL still requires the client to download a list from the CA, which can be large and out of date.
Question 82Security Operations
A company's legal department expects a lawsuit over a former employee's dismissal and instructs IT to stop the automatic deletion of that employee's email and files. Which concept does this describe?
Correct answer: D. Legal hold
A legal hold suspends normal retention and deletion so potentially relevant data is preserved for litigation. E-discovery is the later process of finding, reviewing, and producing that electronic data, not the act of preserving it.
A legal hold suspends normal retention and deletion so potentially relevant data is preserved for litigation. E-discovery is the later process of finding, reviewing, and producing that electronic data, not the act of preserving it.
Question 83Security Architecture
A data center's diesel generators take about 45 seconds to start and stabilize after utility power fails. Which component keeps the servers running during that gap?
Correct answer: C. An uninterruptible power supply on the critical load
A UPS uses batteries to provide immediate short-term power, bridging the gap until the generators take over. Redundant power supplies protect against a failed PSU, but both supplies still go dark when the utility feed drops.
A UPS uses batteries to provide immediate short-term power, bridging the gap until the generators take over. Redundant power supplies protect against a failed PSU, but both supplies still go dark when the utility feed drops.
Question 84Threats, Vulnerabilities & Attacks
Attackers submit thousands of mislabeled samples to a public feedback channel that a vendor uses to retrain its spam filter. After the next retraining, emails from the attackers' domain are marked as safe. Which AI risk is this?
Correct answer: B. Data poisoning
Data poisoning corrupts training data so the retrained model learns the attacker's desired behavior. Prompt injection manipulates a model's input at run time and would not permanently change how the filter classifies a domain.
Data poisoning corrupts training data so the retrained model learns the attacker's desired behavior. Prompt injection manipulates a model's input at run time and would not permanently change how the filter classifies a domain.
Question 85Security Operations
Without any alert being triggered, a security analyst forms a hypothesis that attackers are using scheduled tasks for persistence and searches endpoint data across the environment for evidence. Which activity is this?
Correct answer: C. Threat hunting
Threat hunting is a proactive, hypothesis-driven search for threats that have slipped past existing detections. Alert triage is reactive and starts from an alert that a tool has already generated.
Threat hunting is a proactive, hypothesis-driven search for threats that have slipped past existing detections. Alert triage is reactive and starts from an alert that a tool has already generated.
Question 86Program Management & Oversight
Before acquiring a smaller competitor, a company's security team reviews the target's breach history, audit reports, and security policies to understand the risks it would inherit. Which concept does this BEST describe?
Correct answer: A. Due diligence
Due diligence is the research and investigation done to understand risks before making a decision. Due care is the ongoing action of implementing and maintaining reasonable safeguards once the risks are known.
Due diligence is the research and investigation done to understand risks before making a decision. Due care is the ongoing action of implementing and maintaining reasonable safeguards once the risks are known.
Question 87General Security Concepts
An online retailer wants to reduce its PCI DSS scope by replacing stored credit card numbers with random values that have no mathematical relationship to the original numbers. Which technique BEST fits?
Correct answer: B. Tokenization
Tokenization swaps the card number for a random token and keeps the real value in a separate, secured token vault. Encryption produces ciphertext that is mathematically derived from the data and can be reversed with the key, so the data itself is still being stored.
Tokenization swaps the card number for a random token and keeps the real value in a separate, secured token vault. Encryption produces ciphertext that is mathematically derived from the data and can be reversed with the key, so the data itself is still being stored.
Question 88Security Architecture
A company replicates its file server in real time to a second data center. An administrator argues that separate backups are no longer needed. What is the MOST important reason to keep point-in-time backups?
Correct answer: A. Replication also copies accidental deletions and ransomware damage
Replication mirrors changes almost immediately, so deletions, corruption, or ransomware encryption reach the replica as well. Point-in-time backups or snapshots let the company restore data from before the damage happened.
Replication mirrors changes almost immediately, so deletions, corruption, or ransomware encryption reach the replica as well. Point-in-time backups or snapshots let the company restore data from before the damage happened.
Question 89Threats, Vulnerabilities & Attacks
Developers are pasting proprietary source code into a free public AI chatbot to debug faster. Management wants to keep the productivity benefit while stopping code leaks. Which action is BEST?
Correct answer: C. Offer an approved enterprise AI tool with DLP
An approved enterprise AI tool with data loss prevention keeps code under company terms and blocks sensitive pastes, while still letting developers use AI. Blocking all outbound HTTPS would stop the leak but also break normal work, so it fails the business requirement.
An approved enterprise AI tool with data loss prevention keeps code under company terms and blocks sensitive pastes, while still letting developers use AI. Blocking all outbound HTTPS would stop the leak but also break normal work, so it fails the business requirement.
Question 90Security Operations
An analyst suspects a brute-force attack against a Windows file server and wants to review failed logon attempts for local and domain accounts. Which log source should the analyst check FIRST?
Correct answer: D. OS security logs
The Windows Security event log records logon successes and failures, such as Event ID 4625, which directly shows brute-force attempts. Firewall logs would show connections to the server, but not whether each authentication attempt succeeded or failed.
The Windows Security event log records logon successes and failures, such as Event ID 4625, which directly shows brute-force attempts. Firewall logs would show connections to the server, but not whether each authentication attempt succeeded or failed.
The real CompTIA Security+ exam at a glance
90questions
1h 30mtime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Cyber Security practice tests
CEH v13 Practice Test125 questions · 312-50CISSP Practice Test150 questions · 2024 outlineCompTIA CySA+ Practice Test85 questions · CS0-004CompTIA SecurityX Practice Test90 questions · CAS-005CHFI v11 Practice Test150 questions · 312-49CCISO Practice Test150 questions · Blueprint v3
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the CompTIA Security+ exam. They are not real exam questions. CompTIA Security+ and CompTIA are trademarks of their owners. Real exam format: up to 90 questions · 90 minutes · passing score 750 on a 100-900 scale · the real exam also includes performance-based questions.