Practice test

CompTIA Security+ Practice 2

Practice 2 for CompTIA Security+ Exam: 25 questions, explained answers, and a review routine.

These questions are for study practice only and are not official exam questions.

Question 1

1

Before sharing sensitive information with a provider, a team reviews its security controls, subcontractors, incident process, and data-handling terms. What is the primary purpose?

Question 2

2

A team detects a new indicator associated with one incident. Why should it validate context before blocking every matching item globally?

Question 3

3

A download service should allow access only to files inside an approved directory. Which design principle is most relevant?

Question 4

4

A sender signs a message using their private signing key. A recipient verifies it using the corresponding trusted public key. What does successful verification primarily support?

Question 5

5

An organization has an approved retention schedule and no applicable hold for a dataset that has reached its disposal date. What should happen?

Question 6

6

An organization runs a tabletop exercise in which teams discuss decisions during a simulated outage without actually switching production systems. What is the main purpose?

Question 7

7

An attack exploits a software vulnerability that was previously unknown to the vendor and defenders at the time of the attack. Which term best describes this scenario?

Question 8

8

A team uses infrastructure as code and wants to detect unauthorized configuration changes over time. Which comparison is useful?

Question 9

9

A legacy system cannot immediately support a required control. The organization approves an alternative that addresses the same risk until replacement. What is that alternative commonly called?

Question 10

10

An incident plan authorizes isolating a confirmed compromised endpoint while preserving evidence. What is the main purpose of isolation at that stage?

Question 11

11

A trusted software vendor distributes an update after its build pipeline is compromised. Customers install the signed update through their normal process. Which exposure is central to this scenario?

Question 12

12

A system denies access when an authorization service is unavailable because its documented requirement favors confidentiality over immediate access. What behavior is this?

Question 13

13

A supplied quantitative model defines single loss expectancy as asset value multiplied by exposure factor. Asset value is $200,000 and exposure factor is 0.25. What is single loss expectancy?

Question 14

14

An application log currently records full authentication tokens. What logging change best reduces unnecessary secret exposure while retaining useful investigation context?

Question 15

15

A finance employee receives an email tailored to a real project and impersonating the project director. It asks for a password through an unfamiliar link. Which description best fits the targeting?

Question 16

16

A design encrypts confidential records, detects unauthorized modification, and maintains service access during one component failure. Which three goals are being addressed?

Question 17

17

An exercise defines annualized loss expectancy as single loss expectancy times annual rate of occurrence. SLE is $40,000 and annual rate is 0.20. What is ALE?

Question 18

18

A backup job reports success, but a scheduled restore test fails because an application dependency is missing. What does the test demonstrate?

Question 19

19

A user account should read reports but a flaw lets it modify administrator settings. Which boundary has been crossed?

Question 20

20

An application uses a certificate whose chain is valid, but the requested server name does not match the identity in the certificate. Why is this significant?

Question 21

21

An incident team has confirmed technical facts but has not approved a public statement. Who should communicate externally under a defined communications plan?

Question 22

22

An evidence record lists who collected a device, each transfer, timestamps, and the person currently responsible for it. What is the record maintaining?

Question 23

23

An application must reject a forged state-changing request that a user did not intend, even when the browser has a valid session cookie. Which control is especially relevant?

Question 24

24

An organization needs a specialized managed device to protect sensitive signing keys and perform approved cryptographic operations under controlled access. Which technology category best fits?

Question 25

25

A server containing sensitive records is retired. The asset record is updated, storage is sanitized through the approved method, and required evidence is retained. What does the combined process achieve?

Enable JavaScript for the interactive step-by-step quiz with instant scoring and explanations.