TABLE OF CONTENTS
SECTION 1: CompTIA Security+ Certmaster - Domain 1.0 ....................... Q1-Q8
SECTION 2: CompTIA Certmaster CE Security+ Domain 1.0
General Security Concepts Assessment ............................. Q9-Q14
SECTION 3: Certmaster CE Security+ Domain 1.0
General Security Concepts ....................................... Q15-Q18
SECTION 4: CompTIA Certmaster CE Security+ Domain 1.0
General Security Concepts Assessment ............................ Q19-Q25
SECTION 5: Security+ Certmaster CE 701 Renewal - Domain 1.0 ............... Q26-Q30
SECTION 6: Security+ SY0-701 Certmaster CE Domain 1.0 ..................... Q31-Q33
SECTION 7: CompTIA Certmaster CE Security+ Domain 2.0
Threats, Vulnerabilities, And Mitigations Assessment ............ Q34-Q44
SECTION 8: CompTIA Certmaster CE Security+ Section 2 ...................... Q45-Q54
SECTION 9: CompTIA Security+ Certmaster - Domain 3.0 Assessment ........... Q55-Q65
SECTION 10: Sec+ Certmaster SY0-701 Domain 3 Assessment ................... Q66-Q77
SECTION 11: CompTIA Certmaster Security+ SY0-701 Domain 3.0
Security Architecture Assessment ............................... Q78-Q88
SECTION 12: CompTIA Certmaster CE For Security+ - Domain 4.0
Security Operations Assessment ................................ Q89-Q131
SECTION 13: CompTIA Certmaster CE Security+ Domain 4.0
Security Operations Assessment ............................... Q132-Q138
SECTION 14: CompTIA Certmaster Security+ SY0-701 Domain 4.0
Security Operations Assessment ............................... Q139-Q153
SECTION 15: CompTIA Certmaster CE Security+ Domain 5.0 ................... Q154-Q158
SECTION 16: CERTMASTER CE SECURITY+ DOMAIN 5.0 .......................... Q159-Q168
SECTION 17: Certmaster CompTIA Network+ Final Assessment ................. Q169-Q300
SCHOLARSOURCE 1
,SECTION 1: COMPTIA SECURITY+ CERTMASTER - DOMAIN 1.0
Questions 1-8
QUESTION 1
A security analyst is implementing a control that requires users to provide two different
types of authentication factors. Which of the following BEST describes this security
control?
A) Single sign-on
B) Multifactor authentication
C) Biometric verification
D) Password complexity
Correct Answer: B
Rationale: Multifactor authentication (MFA) requires users to provide two or more
verification factors from different categories: something you know (password),
something you have (smart card), or something you are (biometric). This significantly
enhances security compared to single-factor authentication. The key is that the factors
must be from different categories, not just multiple instances of the same type. MFA is a
fundamental security control recommended by security frameworks including NIST and
is mandatory for many compliance requirements such as PCI-DSS and HIPAA.
Implementing MFA reduces the risk of account compromise by over 99% according to
industry studies.
QUESTION 2
Which of the following attack types involves redirecting users from a legitimate website
to a malicious one without their knowledge?
A) Phishing
B) Pharming
SCHOLARSOURCE 2
,C) Spoofing
D) Vishing
Correct Answer: B
Rationale: Pharming is a cyberattack that redirects website traffic from a legitimate site
to a fraudulent one without the user's knowledge. This is typically achieved by exploiting
DNS vulnerabilities or modifying host files. Unlike phishing, which relies on deceptive
emails, pharming works at the DNS level and can affect multiple users simultaneously.
Organizations can mitigate pharming by implementing DNSSEC, ensuring DNS servers
are properly secured against poisoning attacks, and using HTTPS with proper certificate
validation. Users can protect themselves by verifying website URLs and being cautious
of unexpected redirects.
QUESTION 3
An organization wants to implement a security control that prevents unauthorized
access to sensitive data by ensuring that users only have access to the information
necessary for their job functions. Which principle is being applied?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Zero trust
Correct Answer: B
Rationale: The principle of least privilege ensures that users, systems, and processes are
granted only the minimum permissions necessary to perform their specific job
functions. This limits potential damage from accidental errors, malicious insiders, or
compromised accounts. Separation of duties divides critical functions among multiple
individuals to prevent fraud. The principle of least privilege is a cornerstone of zero trust
architectures and should be applied consistently across all systems and applications.
Regular access reviews and automated privilege management tools help maintain least
privilege over time.
SCHOLARSOURCE 3
, QUESTION 4
Which type of cryptographic algorithm uses the same key for both encryption and
decryption?
A) Asymmetric encryption
B) Symmetric encryption
C) Hashing
D) Elliptic curve cryptography
Correct Answer: B
Rationale: Symmetric encryption uses a single shared secret key for both encryption and
decryption processes. Examples include AES, DES, and 3DES. While it is significantly
faster than asymmetric encryption, the main challenge is secure key distribution.
Asymmetric encryption uses a public-private key pair, solving the key distribution
problem. Hashing is a one-way function used for integrity verification, not
confidentiality. AES-256 is currently considered the gold standard for symmetric
encryption and is widely used for encrypting data at rest and in transit. Key
management is critical when using symmetric encryption.
QUESTION 5
A security administrator is configuring a firewall to allow only specific types of traffic
into the network. Which security control is being implemented?
A) Deterrent control
B) Detective control
C) Preventive control
D) Compensating control
Correct Answer: C
SCHOLARSOURCE 4
SECTION 1: CompTIA Security+ Certmaster - Domain 1.0 ....................... Q1-Q8
SECTION 2: CompTIA Certmaster CE Security+ Domain 1.0
General Security Concepts Assessment ............................. Q9-Q14
SECTION 3: Certmaster CE Security+ Domain 1.0
General Security Concepts ....................................... Q15-Q18
SECTION 4: CompTIA Certmaster CE Security+ Domain 1.0
General Security Concepts Assessment ............................ Q19-Q25
SECTION 5: Security+ Certmaster CE 701 Renewal - Domain 1.0 ............... Q26-Q30
SECTION 6: Security+ SY0-701 Certmaster CE Domain 1.0 ..................... Q31-Q33
SECTION 7: CompTIA Certmaster CE Security+ Domain 2.0
Threats, Vulnerabilities, And Mitigations Assessment ............ Q34-Q44
SECTION 8: CompTIA Certmaster CE Security+ Section 2 ...................... Q45-Q54
SECTION 9: CompTIA Security+ Certmaster - Domain 3.0 Assessment ........... Q55-Q65
SECTION 10: Sec+ Certmaster SY0-701 Domain 3 Assessment ................... Q66-Q77
SECTION 11: CompTIA Certmaster Security+ SY0-701 Domain 3.0
Security Architecture Assessment ............................... Q78-Q88
SECTION 12: CompTIA Certmaster CE For Security+ - Domain 4.0
Security Operations Assessment ................................ Q89-Q131
SECTION 13: CompTIA Certmaster CE Security+ Domain 4.0
Security Operations Assessment ............................... Q132-Q138
SECTION 14: CompTIA Certmaster Security+ SY0-701 Domain 4.0
Security Operations Assessment ............................... Q139-Q153
SECTION 15: CompTIA Certmaster CE Security+ Domain 5.0 ................... Q154-Q158
SECTION 16: CERTMASTER CE SECURITY+ DOMAIN 5.0 .......................... Q159-Q168
SECTION 17: Certmaster CompTIA Network+ Final Assessment ................. Q169-Q300
SCHOLARSOURCE 1
,SECTION 1: COMPTIA SECURITY+ CERTMASTER - DOMAIN 1.0
Questions 1-8
QUESTION 1
A security analyst is implementing a control that requires users to provide two different
types of authentication factors. Which of the following BEST describes this security
control?
A) Single sign-on
B) Multifactor authentication
C) Biometric verification
D) Password complexity
Correct Answer: B
Rationale: Multifactor authentication (MFA) requires users to provide two or more
verification factors from different categories: something you know (password),
something you have (smart card), or something you are (biometric). This significantly
enhances security compared to single-factor authentication. The key is that the factors
must be from different categories, not just multiple instances of the same type. MFA is a
fundamental security control recommended by security frameworks including NIST and
is mandatory for many compliance requirements such as PCI-DSS and HIPAA.
Implementing MFA reduces the risk of account compromise by over 99% according to
industry studies.
QUESTION 2
Which of the following attack types involves redirecting users from a legitimate website
to a malicious one without their knowledge?
A) Phishing
B) Pharming
SCHOLARSOURCE 2
,C) Spoofing
D) Vishing
Correct Answer: B
Rationale: Pharming is a cyberattack that redirects website traffic from a legitimate site
to a fraudulent one without the user's knowledge. This is typically achieved by exploiting
DNS vulnerabilities or modifying host files. Unlike phishing, which relies on deceptive
emails, pharming works at the DNS level and can affect multiple users simultaneously.
Organizations can mitigate pharming by implementing DNSSEC, ensuring DNS servers
are properly secured against poisoning attacks, and using HTTPS with proper certificate
validation. Users can protect themselves by verifying website URLs and being cautious
of unexpected redirects.
QUESTION 3
An organization wants to implement a security control that prevents unauthorized
access to sensitive data by ensuring that users only have access to the information
necessary for their job functions. Which principle is being applied?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Zero trust
Correct Answer: B
Rationale: The principle of least privilege ensures that users, systems, and processes are
granted only the minimum permissions necessary to perform their specific job
functions. This limits potential damage from accidental errors, malicious insiders, or
compromised accounts. Separation of duties divides critical functions among multiple
individuals to prevent fraud. The principle of least privilege is a cornerstone of zero trust
architectures and should be applied consistently across all systems and applications.
Regular access reviews and automated privilege management tools help maintain least
privilege over time.
SCHOLARSOURCE 3
, QUESTION 4
Which type of cryptographic algorithm uses the same key for both encryption and
decryption?
A) Asymmetric encryption
B) Symmetric encryption
C) Hashing
D) Elliptic curve cryptography
Correct Answer: B
Rationale: Symmetric encryption uses a single shared secret key for both encryption and
decryption processes. Examples include AES, DES, and 3DES. While it is significantly
faster than asymmetric encryption, the main challenge is secure key distribution.
Asymmetric encryption uses a public-private key pair, solving the key distribution
problem. Hashing is a one-way function used for integrity verification, not
confidentiality. AES-256 is currently considered the gold standard for symmetric
encryption and is widely used for encrypting data at rest and in transit. Key
management is critical when using symmetric encryption.
QUESTION 5
A security administrator is configuring a firewall to allow only specific types of traffic
into the network. Which security control is being implemented?
A) Deterrent control
B) Detective control
C) Preventive control
D) Compensating control
Correct Answer: C
SCHOLARSOURCE 4
