Practice test

CompTIA Security+ Practice 1

Practice 1 for CompTIA Security+ Exam: 25 questions, explained answers, and a review routine.

These questions are for study practice only and are not official exam questions.

Question 1

1

A password-storage system assigns each password a unique random salt before using an appropriate password-hashing function. What benefit does the salt provide?

Question 2

2

An organization investigates whether an incident triggers legal or contractual notification duties. Why should it consult the applicable requirements and qualified responsible teams?

Question 3

3

A business requires a critical service to be restored within four hours after an outage. Which objective is being specified?

Question 4

4

A ransomware incident makes production files unreadable. The organization has backups but has never tested restoration. What uncertainty remains?

Question 5

5

A database operator needs read access to one reporting dataset for a temporary assignment. Which grant best follows least privilege?

Question 6

6

A team reduces exposure by replacing broad network access with narrowly permitted connections, but some risk remains. Which treatment is this?

Question 7

7

A team must prioritize remediation among several findings. One affected Internet-facing system has active exploitation reported and holds sensitive data. What should influence priority beyond a generic severity score?

Question 8

8

A public service becomes unavailable while receiving traffic from many distributed sources that exhaust its capacity. Which security objective is primarily affected?

Question 9

9

An employee badge grants access only to the office floor, while the server room requires an additional approved access group. What security design is illustrated?

Question 10

10

An organization purchases insurance for certain cyber-related financial losses. What should it understand about this risk treatment?

Question 11

11

An exercise identifies 45 detected incidents and 5 missed incidents. It defines recall as detected incidents divided by all actual incidents. What is recall?

Question 12

12

An investigation finds that an attacker tried username-password pairs previously exposed by an unrelated service. Which attack pattern does this most directly describe?

Question 13

13

A public web server must accept Internet requests while an internal database should be reachable only through an explicitly allowed application path. What architecture principle supports this separation?

Question 14

14

A vendor contract promises 99.9% monthly service availability and defines how it is measured and remedied. Which contract element is being described?

Question 15

15

A forensic copy is hashed when collected and again before analysis. The values match. What does this comparison support?

Question 16

16

A report identifies an unpatched software flaw, an attacker capable of using it, and potential data loss. Which element is the vulnerability?

Question 17

17

A platform verifies approved boot components before executing them. Which objective is this control most directly intended to support?

Question 18

18

A form asks for a person full birth date even though the service only needs confirmation that the person meets an age threshold. Which privacy principle suggests reconsidering that collection?

Question 19

19

An analyst correlates endpoint and identity logs to investigate a sign-in followed by an unusual file export. Why is consistent time synchronization important?

Question 20

20

Two systems have the same software vulnerability. One is isolated in a lab with synthetic data; the other is publicly reachable and processes sensitive records. What should a risk assessment consider?

Question 21

21

An organization assigns permissions to job roles such as payroll clerk and auditor, then assigns users to those roles. Which access-control model is illustrated?

Question 22

22

A business decides not to launch a proposed service because its risks exceed the organization tolerance and no acceptable design is available. Which treatment is represented?

Question 23

23

After recovering a service, the incident team reviews root causes, response delays, and corrective-action owners. What phase or activity is this?

Question 24

24

A web application displays user-supplied text inside an HTML page. The security requirement is to keep that text from being interpreted as active markup in its output context. Which defensive technique directly addresses that requirement?

Question 25

25

A trusted platform module protects device-bound cryptographic material. Why should that not be described as an ordinary folder for users to browse?

Enable JavaScript for the interactive step-by-step quiz with instant scoring and explanations.