KENTUCKY COMPTIA SECURITY+ CERTIFICATION EXAM PRACTICE TEST QUESTIONS AND
CORRECT ANSWERS (VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT
DOWNLOAD PDF.
Core Domains:• General Security Concepts• Threats, Vulnerabilities, and Mitigations• Security
Architecture• Security Operations• Security Program Management and Oversight
IntroductionThe CompTIA Security+ certification exam validates the foundational knowledge necessary
to perform core security functions and pursue an information security career. This practice assessment
evaluates a candidate's grasp of cybersecurity principles, baseline security operations, and regulatory
compliance frameworks. Comprising multiple-choice and scenario-based questions, the exam tests
technical skill alongside critical thinking and professional ethics. Candidates must demonstrate an ability
to assess the security posture of an enterprise environment and recommend or implement appropriate
security solutions. Real-world application and threat mitigation decision-making are heavily emphasized
to ensure professionals can safeguard organizational infrastructure against evolving global risks.
Section One: Questions 1–100
Question 1
An administrator discovers an unauthorized device broadcasting a corporate Service Set Identifier
(SSID) in the parking lot, attempting to intercept employee login credentials. Which of the following
describes this specific threat?
A. Rogue access point
B. Evil twin
C. Bluejacking
D. Disassociation attack
🟢 B. Evil twin
🔴 RATIONALE: An evil twin is a fraudulent Wi-Fi access point that mimics a legitimate, trusted network
by broadcasting the same SSID to trick users into connecting. A rogue access point is an unauthorized
,AP connected to the internal network but does not necessarily mimic an existing SSID. Bluejacking
involves sending unsolicited messages over Bluetooth. A disassociation attack kicks devices off a
legitimate wireless network.
Question 2
A systems engineer wants to prevent unauthorized physical assets from communicating with the internal
network by validating the device's hardware address at the switch level. Which technology should be
implemented?
A. 802.1X
B. MAC filtering
C. DHCP snooping
D. Access Control Lists
🟢 B. MAC filtering
🔴 RATIONALE: MAC filtering restricts network access to devices with specific, approved Media Access
Control hardware addresses at the switch port level. 802.1X is a more advanced network authentication
protocol that utilizes a RADIUS server. DHCP snooping prevents rogue DHCP servers. Access Control
Lists filter traffic based on IP addresses and ports rather than hardware addresses alone.
Question 3
A software development company wants to test a new application in an isolated environment where
malicious code cannot affect the host system or external production networks. Which of the following is
the best solution?
A. Containers
B. Sandbox
C. Virtual Private Network
D. Honeynet
🟢 B. Sandbox
🔴 RATIONALE: A sandbox provides a highly secure, isolated environment explicitly designed for
executing untrusted applications or malware without impacting production systems. Containers share the
,host operating system kernel and are less isolated than sandboxes. A VPN encrypts network traffic. A
honeynet is a network of decoys used to attract and analyze hackers.
Question 4
An organization experiences a security incident where an attacker successfully guesses a user's
password by systematically trying millions of combinations from a precomputed list of common words.
What type of attack occurred?
A. Dictionary attack
B. Brute-force attack
C. Rainbow table attack
D. Birthday attack
🟢 A. Dictionary attack
🔴 RATIONALE: A dictionary attack uses a predefined list of words or common phrases to guess
passwords systematically. A pure brute-force attack tries every possible character combination. A
rainbow table attack uses precomputed cryptographic hashes of passwords, not plain words. A birthday
attack exploits the mathematics behind hash collisions.
Question 5
Which of the following cryptographic algorithms is asymmetric and relies on the mathematical difficulty of
factoring large prime numbers?
A. AES
B. RSA
C. SHA-256
D. 3DES
🟢 B. RSA
🔴 RATIONALE: RSA is an asymmetric cryptographic algorithm based on the difficulty of factoring the
product of two large prime numbers. AES and 3DES are symmetric algorithms used for bulk data
encryption. SHA-256 is a cryptographic hash function used for data integrity, not encryption or key
exchange.
, Question 6
A risk officer calculates that a severe flood occurs once every 20 years in the region where a data center
resides. What metric does this frequency represent?
A. Single Loss Expectancy (SLE)
B. Annualized Rate of Occurrence (ARO)
C. Annualized Loss Expectancy (ALE)
D. Asset Value (AV)
🟢 B. Annualized Rate of Occurrence (ARO)
🔴 RATIONALE: The Annualized Rate of Occurrence (ARO) is the estimated frequency with which a
specific threat or risk is expected to occur within a single year. A flood once every 20 years translates to
an ARO of 0.05. SLE is the monetary loss of a single event. ALE is the yearly expected financial loss (
SLE × ARO). AV is the total value of the asset.
Question 7
An internal audit reveals that multiple system administrators are sharing a single "root" account to
perform configuration updates on production servers. Which core security principle does this practice
violate?
A. Confidentiality
B. Accountability
C. Availability
D. Least privilege
🟢 B. Accountability
🔴 RATIONALE: Shared accounts completely destroy non-repudiation and individual accountability,
because it is impossible to determine which specific person performed an action. Confidentiality refers to
data secrecy, availability ensures systems remain accessible, and least privilege means users only have
the bare minimum rights needed for their jobs.
Question 8
CORRECT ANSWERS (VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT
DOWNLOAD PDF.
Core Domains:• General Security Concepts• Threats, Vulnerabilities, and Mitigations• Security
Architecture• Security Operations• Security Program Management and Oversight
IntroductionThe CompTIA Security+ certification exam validates the foundational knowledge necessary
to perform core security functions and pursue an information security career. This practice assessment
evaluates a candidate's grasp of cybersecurity principles, baseline security operations, and regulatory
compliance frameworks. Comprising multiple-choice and scenario-based questions, the exam tests
technical skill alongside critical thinking and professional ethics. Candidates must demonstrate an ability
to assess the security posture of an enterprise environment and recommend or implement appropriate
security solutions. Real-world application and threat mitigation decision-making are heavily emphasized
to ensure professionals can safeguard organizational infrastructure against evolving global risks.
Section One: Questions 1–100
Question 1
An administrator discovers an unauthorized device broadcasting a corporate Service Set Identifier
(SSID) in the parking lot, attempting to intercept employee login credentials. Which of the following
describes this specific threat?
A. Rogue access point
B. Evil twin
C. Bluejacking
D. Disassociation attack
🟢 B. Evil twin
🔴 RATIONALE: An evil twin is a fraudulent Wi-Fi access point that mimics a legitimate, trusted network
by broadcasting the same SSID to trick users into connecting. A rogue access point is an unauthorized
,AP connected to the internal network but does not necessarily mimic an existing SSID. Bluejacking
involves sending unsolicited messages over Bluetooth. A disassociation attack kicks devices off a
legitimate wireless network.
Question 2
A systems engineer wants to prevent unauthorized physical assets from communicating with the internal
network by validating the device's hardware address at the switch level. Which technology should be
implemented?
A. 802.1X
B. MAC filtering
C. DHCP snooping
D. Access Control Lists
🟢 B. MAC filtering
🔴 RATIONALE: MAC filtering restricts network access to devices with specific, approved Media Access
Control hardware addresses at the switch port level. 802.1X is a more advanced network authentication
protocol that utilizes a RADIUS server. DHCP snooping prevents rogue DHCP servers. Access Control
Lists filter traffic based on IP addresses and ports rather than hardware addresses alone.
Question 3
A software development company wants to test a new application in an isolated environment where
malicious code cannot affect the host system or external production networks. Which of the following is
the best solution?
A. Containers
B. Sandbox
C. Virtual Private Network
D. Honeynet
🟢 B. Sandbox
🔴 RATIONALE: A sandbox provides a highly secure, isolated environment explicitly designed for
executing untrusted applications or malware without impacting production systems. Containers share the
,host operating system kernel and are less isolated than sandboxes. A VPN encrypts network traffic. A
honeynet is a network of decoys used to attract and analyze hackers.
Question 4
An organization experiences a security incident where an attacker successfully guesses a user's
password by systematically trying millions of combinations from a precomputed list of common words.
What type of attack occurred?
A. Dictionary attack
B. Brute-force attack
C. Rainbow table attack
D. Birthday attack
🟢 A. Dictionary attack
🔴 RATIONALE: A dictionary attack uses a predefined list of words or common phrases to guess
passwords systematically. A pure brute-force attack tries every possible character combination. A
rainbow table attack uses precomputed cryptographic hashes of passwords, not plain words. A birthday
attack exploits the mathematics behind hash collisions.
Question 5
Which of the following cryptographic algorithms is asymmetric and relies on the mathematical difficulty of
factoring large prime numbers?
A. AES
B. RSA
C. SHA-256
D. 3DES
🟢 B. RSA
🔴 RATIONALE: RSA is an asymmetric cryptographic algorithm based on the difficulty of factoring the
product of two large prime numbers. AES and 3DES are symmetric algorithms used for bulk data
encryption. SHA-256 is a cryptographic hash function used for data integrity, not encryption or key
exchange.
, Question 6
A risk officer calculates that a severe flood occurs once every 20 years in the region where a data center
resides. What metric does this frequency represent?
A. Single Loss Expectancy (SLE)
B. Annualized Rate of Occurrence (ARO)
C. Annualized Loss Expectancy (ALE)
D. Asset Value (AV)
🟢 B. Annualized Rate of Occurrence (ARO)
🔴 RATIONALE: The Annualized Rate of Occurrence (ARO) is the estimated frequency with which a
specific threat or risk is expected to occur within a single year. A flood once every 20 years translates to
an ARO of 0.05. SLE is the monetary loss of a single event. ALE is the yearly expected financial loss (
SLE × ARO). AV is the total value of the asset.
Question 7
An internal audit reveals that multiple system administrators are sharing a single "root" account to
perform configuration updates on production servers. Which core security principle does this practice
violate?
A. Confidentiality
B. Accountability
C. Availability
D. Least privilege
🟢 B. Accountability
🔴 RATIONALE: Shared accounts completely destroy non-repudiation and individual accountability,
because it is impossible to determine which specific person performed an action. Confidentiality refers to
data secrecy, availability ensures systems remain accessible, and least privilege means users only have
the bare minimum rights needed for their jobs.
Question 8
