CompTIA Security+ Certification Exam
Practice Questions And Correct Answers
(Verified Answers) Plus Rationales 2026
Q&A | Instant Download Pdf
1. Which of the following cryptographic algorithms is best suited for securely
transmitting a symmetric encryption key over an insecure network? A) RSA
B) AES C) SHA-256 D) HMAC Rationale: RSA is an asymmetric algorithm
commonly used for secure key exchange, allowing two parties to securely
establish a symmetric key (like AES) over an insecure channel. AES is
symmetric, SHA is hashing, and HMAC provides integrity and authenticity,
not key exchange.
2. A security analyst notices multiple failed login attempts from a single IP
address followed by a successful login. What type of attack has most likely
occurred? A) Cross-site scripting B) Brute force C) SQL injection D) Pass the
hash Rationale: A brute force attack involves systematically submitting
many passwords or passphrases with the hope of eventually guessing
correctly. The pattern of multiple failed attempts followed by a success is a
classic indicator of this attack type.
3. Which of the following access control models uses labels and security
clearances to grant access to objects? A) Discretionary Access Control (DAC)
B) Role-Based Access Control (RBAC) C) Mandatory Access Control (MAC)
D) Attribute-Based Access Control (ABAC) Rationale: Mandatory Access
Control (MAC) relies on security clearances for subjects and classification
labels for objects. Access is determined by comparing these attributes, a
model heavily used in military and government environments.
4. Which network device is primarily designed to actively filter and block
malicious traffic based on a set of defined rules and signatures before it
, reaches the internal network? A) Switch B) Load Balancer C) Passive IDS D)
Intrusion Prevention System (IPS) Rationale: An Intrusion Prevention
System (IPS) sits inline with network traffic and actively blocks or prevents
malicious activity based on signatures or anomalies. A passive IDS only
detects and alerts, while switches and load balancers serve routing and
availability functions.
5. In the context of incident response, which phase involves isolating an
infected workstation to prevent the spread of malware? A) Containment B)
Identification C) Eradication D) Recovery Rationale: The Containment phase
focuses on limiting the scope and impact of an incident. Isolating an
infected system from the network prevents malware from spreading
laterally to other systems.
6. An organization wants to ensure that data stored on stolen corporate
laptops cannot be accessed. Which of the following is the most effective
solution? A) BIOS passwords B) Full Disk Encryption (FDE) C) Complex OS
passwords D) Cable locks Rationale: Full Disk Encryption (FDE) encrypts the
entire hard drive, ensuring that even if the physical drive is removed and
placed in another system, the data remains unreadable without the
correct decryption key. Passwords can be bypassed if the drive is removed.
7. Which of the following is a primary characteristic of a watering hole attack?
A) Directly attacking the target organization's firewall B) Sending massive
amounts of spam to employee emails C) Compromising a specific website
that the target group frequently visits D) Intercepting communications over
a public Wi-Fi network Rationale: A watering hole attack targets a specific
group of users by infecting a website they are known to trust and visit
frequently. The attacker waits for the targets to visit the compromised site
to deliver malware.
8. What is the primary purpose of implementing a demilitarized zone (DMZ) in
a network architecture? A) To completely isolate the internal network from
all external access B) To encrypt all outgoing traffic from the internal
network C) To provide a secure space for internal databases D) To provide a
, subnetwork for external-facing services while protecting the internal
network Rationale: A DMZ is designed to host public-facing servers (like
web or email servers) in an isolated subnet. This setup adds a layer of
security, meaning an external attacker must breach the DMZ and a
secondary firewall to reach the sensitive internal network.
9. Which protocol is considered insecure and should be replaced by SSH for
remote command-line administration? A) Telnet B) RDP C) HTTPS D) SFTP
Rationale: Telnet transmits data, including usernames and passwords, in
cleartext, making it highly vulnerable to packet sniffing. SSH (Secure Shell)
provides a secure, encrypted alternative for remote command-line
administration.
10.A user receives an SMS message claiming to be from their bank, asking
them to click a link to verify their account details. What type of attack is
this? A) Vishing B) Smishing C) Pharming D) Whaling Rationale: Smishing
(SMS phishing) is a form of social engineering that uses text messages to
trick victims into providing sensitive information or clicking malicious
links. Vishing uses voice, and whaling targets high-profile executives.
11.Which risk management strategy involves purchasing cybersecurity
insurance to handle potential financial losses from a data breach? A)
Mitigation B) Acceptance C) Transference D) Avoidance Rationale: Risk
transference (or sharing) involves shifting the financial burden of a risk to
a third party, such as an insurance company. This does not eliminate the
risk but offsets the financial impact.
12.Which of the following best describes the principle of least privilege? A)
Giving administrators full access to all systems B) Ensuring all users have the
same level of access C) Providing temporary elevated access only when
requested D) Granting users only the minimum access rights necessary to
perform their job functions Rationale: The principle of least privilege
dictates that users, systems, and processes should only have the exact
permissions required to complete their authorized tasks, minimizing the
potential impact of a compromised account.
Practice Questions And Correct Answers
(Verified Answers) Plus Rationales 2026
Q&A | Instant Download Pdf
1. Which of the following cryptographic algorithms is best suited for securely
transmitting a symmetric encryption key over an insecure network? A) RSA
B) AES C) SHA-256 D) HMAC Rationale: RSA is an asymmetric algorithm
commonly used for secure key exchange, allowing two parties to securely
establish a symmetric key (like AES) over an insecure channel. AES is
symmetric, SHA is hashing, and HMAC provides integrity and authenticity,
not key exchange.
2. A security analyst notices multiple failed login attempts from a single IP
address followed by a successful login. What type of attack has most likely
occurred? A) Cross-site scripting B) Brute force C) SQL injection D) Pass the
hash Rationale: A brute force attack involves systematically submitting
many passwords or passphrases with the hope of eventually guessing
correctly. The pattern of multiple failed attempts followed by a success is a
classic indicator of this attack type.
3. Which of the following access control models uses labels and security
clearances to grant access to objects? A) Discretionary Access Control (DAC)
B) Role-Based Access Control (RBAC) C) Mandatory Access Control (MAC)
D) Attribute-Based Access Control (ABAC) Rationale: Mandatory Access
Control (MAC) relies on security clearances for subjects and classification
labels for objects. Access is determined by comparing these attributes, a
model heavily used in military and government environments.
4. Which network device is primarily designed to actively filter and block
malicious traffic based on a set of defined rules and signatures before it
, reaches the internal network? A) Switch B) Load Balancer C) Passive IDS D)
Intrusion Prevention System (IPS) Rationale: An Intrusion Prevention
System (IPS) sits inline with network traffic and actively blocks or prevents
malicious activity based on signatures or anomalies. A passive IDS only
detects and alerts, while switches and load balancers serve routing and
availability functions.
5. In the context of incident response, which phase involves isolating an
infected workstation to prevent the spread of malware? A) Containment B)
Identification C) Eradication D) Recovery Rationale: The Containment phase
focuses on limiting the scope and impact of an incident. Isolating an
infected system from the network prevents malware from spreading
laterally to other systems.
6. An organization wants to ensure that data stored on stolen corporate
laptops cannot be accessed. Which of the following is the most effective
solution? A) BIOS passwords B) Full Disk Encryption (FDE) C) Complex OS
passwords D) Cable locks Rationale: Full Disk Encryption (FDE) encrypts the
entire hard drive, ensuring that even if the physical drive is removed and
placed in another system, the data remains unreadable without the
correct decryption key. Passwords can be bypassed if the drive is removed.
7. Which of the following is a primary characteristic of a watering hole attack?
A) Directly attacking the target organization's firewall B) Sending massive
amounts of spam to employee emails C) Compromising a specific website
that the target group frequently visits D) Intercepting communications over
a public Wi-Fi network Rationale: A watering hole attack targets a specific
group of users by infecting a website they are known to trust and visit
frequently. The attacker waits for the targets to visit the compromised site
to deliver malware.
8. What is the primary purpose of implementing a demilitarized zone (DMZ) in
a network architecture? A) To completely isolate the internal network from
all external access B) To encrypt all outgoing traffic from the internal
network C) To provide a secure space for internal databases D) To provide a
, subnetwork for external-facing services while protecting the internal
network Rationale: A DMZ is designed to host public-facing servers (like
web or email servers) in an isolated subnet. This setup adds a layer of
security, meaning an external attacker must breach the DMZ and a
secondary firewall to reach the sensitive internal network.
9. Which protocol is considered insecure and should be replaced by SSH for
remote command-line administration? A) Telnet B) RDP C) HTTPS D) SFTP
Rationale: Telnet transmits data, including usernames and passwords, in
cleartext, making it highly vulnerable to packet sniffing. SSH (Secure Shell)
provides a secure, encrypted alternative for remote command-line
administration.
10.A user receives an SMS message claiming to be from their bank, asking
them to click a link to verify their account details. What type of attack is
this? A) Vishing B) Smishing C) Pharming D) Whaling Rationale: Smishing
(SMS phishing) is a form of social engineering that uses text messages to
trick victims into providing sensitive information or clicking malicious
links. Vishing uses voice, and whaling targets high-profile executives.
11.Which risk management strategy involves purchasing cybersecurity
insurance to handle potential financial losses from a data breach? A)
Mitigation B) Acceptance C) Transference D) Avoidance Rationale: Risk
transference (or sharing) involves shifting the financial burden of a risk to
a third party, such as an insurance company. This does not eliminate the
risk but offsets the financial impact.
12.Which of the following best describes the principle of least privilege? A)
Giving administrators full access to all systems B) Ensuring all users have the
same level of access C) Providing temporary elevated access only when
requested D) Granting users only the minimum access rights necessary to
perform their job functions Rationale: The principle of least privilege
dictates that users, systems, and processes should only have the exact
permissions required to complete their authorized tasks, minimizing the
potential impact of a compromised account.
