Security+ / practice questions
CompTIA Security+ Practice Questions, With the Reasoning Explained
Security+ questions usually give you four options that are all real security concepts, and only one that fits the scenario as written. The skill is reading the scenario for what it is actually asking rather than pattern matching on keywords.
Six questions below, with the answer and the reasoning after each.
Pick an option to lock it in and see the reasoning straight away. Nothing is timed and nothing is recorded, so answer the way you would on the day rather than the way that looks good.
Question 1
An administrator compares a downloaded file's SHA-256 hash against the value published by the vendor. Which property of the CIA triad is being verified?
Pick an option above, or show the answer +Hide the answer −
B. Integrity
A hash comparison detects whether the contents changed, which is integrity. Confidentiality would call for encryption, availability for redundancy or capacity, and non-repudiation for a digital signature that also proves who produced the file. Note the distinction in the last one: a bare hash proves the file is unmodified, not who it came from.
Question 2
An employee receives a phone call from someone claiming to be IT support who asks them to read back a verification code. What kind of attack is this?
Pick an option above, or show the answer +Hide the answer −
C. Vishing
Voice-based social engineering is vishing. Phishing is the email form, smishing is SMS, and whaling describes targeting a senior executive regardless of channel. The exam distinguishes these by delivery channel and by target, so read for both. The defense is the same across all of them: verify through a channel the caller did not choose.
Question 3
A system requires a password and a PIN to sign in. Does this satisfy multifactor authentication?
Pick an option above, or show the answer +Hide the answer −
C. No, because both are something you know
Multifactor means credentials from different categories: something you know, something you have, something you are. A password and a PIN are both knowledge factors, so an attacker who phished one is well positioned to get the other. Adding a hardware token or a biometric is what makes it multifactor.
Question 4
Your team has isolated the affected hosts during an incident. In the standard incident response process, what comes next?
Pick an option above, or show the answer +Hide the answer −
B. Eradication
The sequence runs preparation, detection and analysis, containment, eradication, recovery, then lessons learned. Containment stops the spread; eradication removes the cause, whether that is malware, a compromised account or the unpatched hole that let it in. Restoring service before eradication is how organizations end up handling the same incident twice.
Question 5
A contractor needs to read reports from one application for a three month engagement. Which principle should drive the access you grant?
Pick an option above, or show the answer +Hide the answer −
B. Least privilege
Least privilege means the minimum access needed for the task, for no longer than needed, so read-only on that one application with an expiry on the account. Separation of duties splits a sensitive process across people, defense in depth layers controls, and implicit deny is the default-deny posture a firewall or ACL takes. All are real, but only one answers the question asked.
Question 6
An application must encrypt large volumes of data at rest with minimal performance overhead. Which approach fits best?
Pick an option above, or show the answer +Hide the answer −
B. Symmetric encryption with AES
Symmetric algorithms such as AES are far faster on bulk data, which is why real systems use asymmetric cryptography to exchange a symmetric key and then encrypt the data symmetrically. Hashing is one way and cannot be reversed, so it is not encryption at all. Base64 is encoding, offers zero protection, and appearing in an options list is a gift when you recognize it.
Six questions is a sample, not a study plan
Any fixed list of questions has the same problem: work it twice and you are remembering the list rather than learning the material. Techunique generates every scenario fresh against the CompTIA Security+ (SY0-701) blueprint, ladders the difficulty to how you are answering, and explains each miss the moment you make it. One full session is free every day.
Practice for the CompTIA Security+ exam. Techunique is not affiliated with CompTIA.
How to get value out of practice questions
- When four options are all real concepts, re-read the scenario for the specific ask. The distractors are usually correct definitions of the wrong thing.
- Learn the incident response and risk management processes in order. Sequence questions are common and cheap to get right.
- Know which cryptographic tool provides which property: confidentiality, integrity, authentication, non-repudiation.
- Security+ assumes Network+ level networking. If subnetting and ports are shaky, shore those up first.
Keep reading
Network+ or Security+ First? How to Choose
An honest comparison of CompTIA Network+ and Security+: what each one proves, who should take which first, and when to skip straight to Security+.
How to Pass Security+ When the Acronyms Start Blurring
A working study approach for CompTIA Security+: what the exam really tests, why memorizing acronyms fails, and how to train scenario thinking.