Practice test

CompTIA Security+ Practice 3

Practice 3 for CompTIA Security+ Exam: 25 questions, explained answers, and a review routine.

These questions are for study practice only and are not official exam questions.

Question 1

1

An analyst adjusts an alert rule after many verified benign events. What should accompany the change to avoid silently losing useful detection?

Question 2

2

A storage container intended for internal records is accidentally configured for public reads. No software defect is required for outsiders to access it. What is the primary weakness?

Question 3

3

A design says that being connected to the office network is not sufficient reason to trust an access request. Identity, device state, and authorization must still be evaluated. Which principle is reflected?

Question 4

4

A risk owner formally agrees to retain a documented residual risk because further treatment is not justified under the organization criteria. Which treatment is illustrated?

Question 5

5

A detection exercise has 80 true alerts and 20 false alerts among 100 total alerts. It defines precision as true alerts divided by all alerts. What is precision?

Question 6

6

An attacker records a valid authorization message and later resends it unchanged to repeat the action. Which defensive property is most relevant?

Question 7

7

A policy permits access only when a user has the required department attribute, uses a managed device, and connects during an approved window. Which model most closely fits the combined conditions?

Question 8

8

A business data owner decides which roles should access a dataset, while an IT custodian implements the approved permissions. Which responsibility belongs primarily to the owner in this scenario?

Question 9

9

A live-system investigation needs information held only in volatile memory. Why must responders consider collection order before powering off the system?

Question 10

10

A user sees a certificate warning on a site used for sensitive sign-in. Which response is most appropriate?

Question 11

11

A downloaded file matches a published cryptographic hash, but both file and hash were obtained from the same untrusted attacker-controlled location. What limitation remains?

Question 12

12

After awareness training, a program wants to evaluate whether staff can recognize and report suspicious requests. Which measure is more useful than attendance alone?

Question 13

13

A scheduled access review finds accounts still assigned to a project that ended months ago. What operational action is most appropriate?

Question 14

14

A server accepts a URL from a user and fetches it. Security wants to prevent the feature from reaching internal-only services. What control direction best addresses this risk?

Question 15

15

A cloud provider secures its physical data center, while the customer configures user access to its hosted application. What model does this illustrate?

Question 16

16

Before setting recovery priorities, an organization identifies critical processes, outage impacts, and required dependencies. What activity is this?

Question 17

17

A security platform collects logs from many systems and correlates them into alerts for analyst review. Which function is most directly described?

Question 18

18

After one endpoint is compromised, investigation shows access attempts from it to several internal servers using stolen credentials. Which behavior is most relevant?

Question 19

19

An application enables only required features on a new deployment, and additional capabilities need explicit approval. What principle does this follow?

Question 20

20

A system receives a temporary exception to a security standard. What makes the exception more governable?

Question 21

21

A server setting differs from the approved hardened baseline, but no approved change explains it. What is the appropriate interpretation?

Question 22

22

A developer builds database queries by combining user text with query syntax. Which change most directly separates values from executable query structure?

Question 23

23

An organization combines preventive access controls, monitoring, and tested recovery instead of relying on one filter. What strategy is illustrated?

Question 24

24

A security program reports average detection time but excludes all incidents that were never detected during the measurement period. What limitation should readers understand?

Question 25

25

A firewall cleanup proposes deleting a rule that appears unused. What evidence is especially useful before the approved change?

Enable JavaScript for the interactive step-by-step quiz with instant scoring and explanations.