COMPTIA SECURITY+ CERTMASTER – DOMAIN
3.0 ASSESSMENT QUESTIONS WITH CORRECT
ANSWERS 2026-2027
An authoritative server for a zone creates a Resource Records Set (RRSet) signed with a zone signing k
ey. From the following Domain Name System (DNS) traits and functions, what does this scenario dem
onstrate? - CORRECT ANSWER -DNS Security Extensions
The administrator in an exchange server needs to send digitally signed and encrypted messages. What
should the administrator use? - CORRECT ANSWER -S/MIME
An organization uses a Session Initiation Protocol (SIP) endpoint for establishing communications with
remote branch offices. Which of the following protocols will provide encryption for streaming data du
ring the call? - CORRECT ANSWER -SRTP
A web server will utilize a directory protocol to enable users to authenticate with domain credentials.
A certificate will be issued to the server to set up a secure tunnel. Which protocol is ideal for this situ
ation? - CORRECT ANSWER -LDAPS
A Transport Layer Security (TLS) Virtual Private Network (VPN) requires a remote access server listenin
g on port 443 to encrypt traffic with a client machine. An IPSec (Internet Protocol Security) VPN can d
eliver traffic in two modes. One mode encrypts only the payload of the IP packet. The other mode en
crypts the whole IP packet (header and payload). These two modes describe which of the following? (
Select all that apply.) - CORRECT ANSWER -Tunnel
Transport
Consider the principles of web server hardening and determine which actions a system administrator
should take when deploying a new web server in a demilitarized zone (DMZ). (Select all that apply.) -
CORRECT ANSWER -Establish a guest zone
Upload files using SSH
Use configuration templates
Which of the following protocols would secure file transfer services for an internal network? -
CORRECT ANSWER -FTPES
, Implementing Lightweight Directory Access Protocol Secure (LDAPS) on a web server secures direct qu
eries to which of the following? - CORRECT ANSWER -Directory services
Select the vulnerabilities that can influence routing. (Select all that apply.) - CORRECT ANSWER -
Source routing
Route injection
Software exploits
Management has set up a feed or subscription service to inform users on regular updates to the netw
ork and its various systems and services. The feed is only accessible from the internal network. What
else can systems administrators do to limit the service to internal access? - CORRECT ANSWER -
Provision SSO access.
A small organization operates several virtual servers in a single host environment. The physical networ
k utilizes a physical firewall with NIDS for security. What would be the benefits of installing a Host Intr
usion Prevention System (HIPS) at the end points? (Select all that apply.) - CORRECT ANSWER -
Prevent malicious traffic between VMs
Protection from zero day attacks
Which of the following would secure an endpoint and provide attestation signed by a trusted platform
module (TPM)? - CORRECT ANSWER -Measured boot
A support technician reviews a computer's boot integrity capabilities and discovers that the system su
pports a measured boot process. Which statement accurately describes this process? -
CORRECT ANSWER -Measured boot will record the presence of unsigned kernel-level code.
A developer writes code for a new application, and wants to ensure protective countermeasures again
st the execution of SQL injection attacks. What secure coding technique will provide this? -
CORRECT ANSWER -Input validation
A web administrator notices a few security vulnerabilities that need to be addressed on the company
Intranet site. The portal must force a secure browsing connection, mitigate script injection, and preve
nt caching on shared client devices. Determine the secure options to set on the web server's respons
e headers. (Select all that apply.) - CORRECT ANSWER -HTTP Strict Transport Security (HSTS)
3.0 ASSESSMENT QUESTIONS WITH CORRECT
ANSWERS 2026-2027
An authoritative server for a zone creates a Resource Records Set (RRSet) signed with a zone signing k
ey. From the following Domain Name System (DNS) traits and functions, what does this scenario dem
onstrate? - CORRECT ANSWER -DNS Security Extensions
The administrator in an exchange server needs to send digitally signed and encrypted messages. What
should the administrator use? - CORRECT ANSWER -S/MIME
An organization uses a Session Initiation Protocol (SIP) endpoint for establishing communications with
remote branch offices. Which of the following protocols will provide encryption for streaming data du
ring the call? - CORRECT ANSWER -SRTP
A web server will utilize a directory protocol to enable users to authenticate with domain credentials.
A certificate will be issued to the server to set up a secure tunnel. Which protocol is ideal for this situ
ation? - CORRECT ANSWER -LDAPS
A Transport Layer Security (TLS) Virtual Private Network (VPN) requires a remote access server listenin
g on port 443 to encrypt traffic with a client machine. An IPSec (Internet Protocol Security) VPN can d
eliver traffic in two modes. One mode encrypts only the payload of the IP packet. The other mode en
crypts the whole IP packet (header and payload). These two modes describe which of the following? (
Select all that apply.) - CORRECT ANSWER -Tunnel
Transport
Consider the principles of web server hardening and determine which actions a system administrator
should take when deploying a new web server in a demilitarized zone (DMZ). (Select all that apply.) -
CORRECT ANSWER -Establish a guest zone
Upload files using SSH
Use configuration templates
Which of the following protocols would secure file transfer services for an internal network? -
CORRECT ANSWER -FTPES
, Implementing Lightweight Directory Access Protocol Secure (LDAPS) on a web server secures direct qu
eries to which of the following? - CORRECT ANSWER -Directory services
Select the vulnerabilities that can influence routing. (Select all that apply.) - CORRECT ANSWER -
Source routing
Route injection
Software exploits
Management has set up a feed or subscription service to inform users on regular updates to the netw
ork and its various systems and services. The feed is only accessible from the internal network. What
else can systems administrators do to limit the service to internal access? - CORRECT ANSWER -
Provision SSO access.
A small organization operates several virtual servers in a single host environment. The physical networ
k utilizes a physical firewall with NIDS for security. What would be the benefits of installing a Host Intr
usion Prevention System (HIPS) at the end points? (Select all that apply.) - CORRECT ANSWER -
Prevent malicious traffic between VMs
Protection from zero day attacks
Which of the following would secure an endpoint and provide attestation signed by a trusted platform
module (TPM)? - CORRECT ANSWER -Measured boot
A support technician reviews a computer's boot integrity capabilities and discovers that the system su
pports a measured boot process. Which statement accurately describes this process? -
CORRECT ANSWER -Measured boot will record the presence of unsigned kernel-level code.
A developer writes code for a new application, and wants to ensure protective countermeasures again
st the execution of SQL injection attacks. What secure coding technique will provide this? -
CORRECT ANSWER -Input validation
A web administrator notices a few security vulnerabilities that need to be addressed on the company
Intranet site. The portal must force a secure browsing connection, mitigate script injection, and preve
nt caching on shared client devices. Determine the secure options to set on the web server's respons
e headers. (Select all that apply.) - CORRECT ANSWER -HTTP Strict Transport Security (HSTS)
