CompTIA Security+ practice questions

Question 1

An engineer is rolling out full-disk encryption to laptop fleets. Which combination matches the MITRE M1041 implementation examples for data-at-rest encryption?

Accepted Answer

Implement BitLocker for Windows systems and FileVault for macOS devices to encrypt hard drives at the operating system level.

Answer

Implement BitLocker on macOS only because MITRE M1041 explicitly forbids using FileVault for any data-at-rest encryption rollout.

Answer

Implement FileVault on Windows only because MITRE M1041 explicitly forbids using BitLocker for any data-at-rest encryption rollout in production.

Answer

Implement self-rolled symmetric XOR encryption on every workstation, because vendor-supplied disk encryption is explicitly forbidden under MITRE M1041.

Question 2

A developer is designing an input-validation strategy for a multi-tier system that ingests data from suppliers and customer-facing forms. Where in the data flow should validation be applied?

Accepted Answer

As early as possible — preferably as soon as the data is received from the external party, including supplier and partner feeds, not just web inputs.

Answer

Only at the database boundary, because letting potentially malformed data through application layers preserves the original payload for forensic review.

Answer

Only at the rendering layer, because reflecting validated content to the user is sufficient to prevent malformed data from corrupting business logic flows.

Answer

Only after batch jobs have aggregated daily data, because validating per-request introduces latency that is unacceptable for real-time interactive workloads.

Question 3

A risk lead is being designed around how SP 800-39 relates to detailed assessment, response, and monitoring guidelines. Which framing best supports the integration of these activities?

Accepted Answer

SP 800-39 is broad-based, with the specific details of assessing, responding to, and monitoring risk on an ongoing basis provided by other supporting NIST guidelines.

Answer

SP 800-39 is positioned as the only guideline an organization needs and explicitly excludes the integration of any supporting NIST publications for assessment or monitoring.

Answer

SP 800-39 is positioned as a detailed step-by-step assessment cookbook that explicitly excludes any role for SP 800-30 or any other supporting NIST guideline.

Answer

SP 800-39 is positioned as exclusively a vendor-procurement complement to FedRAMP and explicitly excludes any role in organization-wide risk management activities.

Question 4

An architect is designing a microservices-based application and must address authentication and authorization at design time. Which framing best aligns with the OWASP microservices security cheat sheet?

Accepted Answer

Authentication and authorization are fundamental security requirements that must be addressed during the design phase using existing architecture patterns.

Answer

Authentication and authorization are runtime-only concerns and the OWASP cheat sheet explicitly excludes them from the design phase deliverables.

Answer

Authentication and authorization should be deferred until production scale is reached, since microservices are usually deployed to internal networks first.

Answer

Authentication and authorization should rely entirely on north-south API gateway controls and never be addressed inside individual microservice boundaries.

Question 5

A startup is documenting why information security matters to the business. Which statement most accurately captures the foundational purpose of an information security program for a modern organization?

Accepted Answer

Protect the confidentiality, integrity, and availability of the systems and services the organization relies on to operate.

Answer

Ensure that every IT product purchased ships with a current FedRAMP authorization before it can be used for any business workflow.

Answer

Document each known software vulnerability in a public bulletin so that customers can decide whether or not to engage.

Answer

Replace traditional perimeter networking with a single managed security service provider for centralized monitoring.

Question 6

A platform team has decided to roll out multi-factor authentication. Which set of factor categories matches the MITRE M1032 mitigation description?

Accepted Answer

Something you know (passwords or PINs); something you have (physical tokens or smartphone authenticator apps); something you are (biometrics).

Answer

Something you wear; something you forget; something you write down — three categories that MITRE M1032 explicitly recommends for federal MFA deployments.

Answer

Username; password; password complexity score — three layers that MITRE M1032 explicitly recommends as multi-factor authentication categories for SOCs.

Answer

Source IP; source country; source ISP — three context factors that MITRE M1032 explicitly recommends as multi-factor authentication categories.

Question 7

A production team is investigating an incident where backup file shares and several SQL volumes were rewritten with random data overnight. Which MITRE technique most precisely classifies the impact?

Accepted Answer

T1486 Data Encrypted for Impact, because the adversary encrypted files on local and remote drives to interrupt availability of system resources.

Answer

T1078 Valid Accounts, because backup volume modification is exclusively performed through the abuse of already-compromised cloud admin tokens.

Answer

T1110 Brute Force, because rewriting backup volumes requires the attacker to first guess every backup encryption key in iterative fashion.

Answer

T1190 Exploit Public-Facing Application, because backup volume corruption is always the result of unauthenticated SMB exposure on the internet.

Question 8

A security director is briefing leadership on what an information security program is overall responsible for delivering. Which framing best matches the SP 800-100 description?

Accepted Answer

Overall responsibility to ensure the selection and implementation of appropriate security controls and to demonstrate effectiveness in satisfying stated security requirements.

Answer

Overall responsibility limited to vendor procurement, with no provision for selecting, implementing, or demonstrating the effectiveness of any security controls.

Answer

Overall responsibility limited to once-per-year audit activities, with no provision for ongoing selection, implementation, or effectiveness demonstration of controls.

Answer

Overall responsibility limited to executive briefings, with no provision for actual control selection, implementation, or demonstrated effectiveness across the organization.

Question 9

A platform team is being designed and the OWASP microservices cheat sheet has been adopted as a baseline. Which class of decisions does the cheat sheet say must be made during design?

Accepted Answer

Authentication and authorization patterns must be selected during design, since they are fundamental security requirements that must be properly used by architects.

Answer

OWASP recommends that authentication and authorization decisions be hard-coded at the database tier and never be revisited at the architecture level.

Answer

All microservice security decisions are deferred to runtime configuration, since OWASP recommends only post-deployment hardening for cloud-native systems.

Answer

Microservice security decisions are entirely the responsibility of the cloud provider's managed service, with no architectural patterns chosen at design time.

Question 10

A compliance lead is rolling out a new control framework and must choose between writing controls in-house and adopting a federally maintained catalog. Which is the strongest reason to adopt NIST SP 800-53 instead?

Accepted Answer

It catalogs flexible, customizable controls that address security and privacy requirements derived from laws, policies, and standards.

Answer

It exempts the organization from internal audit obligations because the controls have already been validated by the federal government.

Answer

It guarantees full regulatory compliance with HIPAA, PCI DSS, and GDPR simultaneously without any additional mapping work.

Answer

It provides a fixed, non-tailorable baseline that every organization must apply identically regardless of mission or risk tolerance.

Question 11

A SOC analyst is being onboarded to forensic techniques and asks what SP 800-86 is and isn't intended to be. Which framing matches the publication's stated purpose most accurately?

Accepted Answer

The publication is intended to inform readers of various technologies and potential ways of using them in incident response or troubleshooting activities.

Answer

The publication is positioned by NIST as an all-inclusive step-by-step forensic investigation cookbook with prescriptive courtroom-ready procedures.

Answer

The publication is positioned by NIST as legal advice that supersedes any prosecutorial guidance on chain-of-custody for digital forensics evidence.

Answer

The publication is positioned by NIST as a non-technical management-only briefing that excludes any operational forensic methods or data sources from scope.

Question 12

An incident responder is reviewing a Windows host where the adversary executed encoded PowerShell payloads to enumerate the domain. Which MITRE technique best classifies this hands-on-keyboard activity?

Accepted Answer

T1059 Command and Scripting Interpreter, since the adversary abused a built-in command interpreter to execute commands and scripts.

Answer

T1190 Exploit Public-Facing Application, because PowerShell enumeration is most often a downstream behavior of exploiting a public web boundary.

Answer

T1486 Data Encrypted for Impact, because hands-on-keyboard PowerShell is always associated with the eventual deployment of ransomware payloads.

Answer

T1110 Brute Force, since PowerShell-based enumeration of domain accounts is classified as a credential-guessing technique under MITRE ATT&CK.

Question 13

A program manager is rolling out a learning program that needs to address differing audiences across employee groups. Which SP 800-50 framing best supports a customizable, audience-aware program design?

Accepted Answer

The recommendations are customizable and may be implemented as part of an organization-wide process that manages awareness, training, and education programs for diverse audiences.

Answer

The recommendations are non-customizable and explicitly require every federal agency to use a single uniform curriculum for all employees regardless of role.

Answer

The recommendations are limited to a single executive briefing per fiscal year and explicitly forbid any organization-wide awareness, training, or education program activity.

Answer

The recommendations are limited exclusively to vendor onboarding modules and explicitly forbid any internal employee awareness, training, or education program activity.

Question 14

A compliance team needs to scope the HIPAA Security Rule for a new system handling clinical data. Which framing of the rule's data scope is most accurate per SP 800-66 Rev. 2?

Accepted Answer

The HIPAA Security Rule focuses on safeguarding electronic protected health information held or maintained by regulated entities against reasonably anticipated threats.

Answer

The HIPAA Security Rule applies only to paper records and explicitly excludes any electronic records from its scope per SP 800-66 implementation guidance.

Answer

The HIPAA Security Rule applies only to publicly disclosed health data and excludes any privately held electronic protected health information from its scope.

Answer

The HIPAA Security Rule excludes data in transit and applies only to data at rest in a primary database, per the SP 800-66 implementation guidance for ePHI.

Question 15

An organization is migrating from a flat, perimeter-trusted network to a zero trust model. Which two design changes most directly reflect SP 800-207 principles? (Choose two.)

Accepted Answer

Authenticate and authorize each subject and device discretely before establishing a session to an enterprise resource.

Accepted Answer

Refuse to grant trust based solely on physical or network location and avoid implicit trust based on asset ownership alone.

Answer

Treat all devices on the internal subnet as trusted whenever they have completed initial domain join during onboarding from any location.

Answer

Allow long-lived TCP sessions to remain open indefinitely after the initial handshake to reduce the operational cost of reauthentication.

CompTIA Security+

Sample questions

Sources

Similar exams