COMPTIA SECURITY+ EXAM – EXAM-STYLE QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED
PASS | 2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE TEST
1. A security administrator is configuring a new wireless network for a small
office. The primary requirement is to ensure that user credentials are not
transmitted in cleartext and that the authentication process provides mutual
authentication between the client and the authentication server. Which of the
following protocols and configurations should the administrator implement?
A. WPA2-Personal with TKIP
B. WPA3-Enterprise with SAE
C. WPA2-Enterprise with EAP-TLS
D. WPA3-Personal with CCMP-128
Correct Answer: C. WPA2-Enterprise with EAP-TLS
Rationale: EAP-TLS (Extensible Authentication Protocol-Transport Layer Security)
provides mutual authentication using digital certificates, ensuring that both the
client and the authentication server verify each other's identity. It also encrypts the
credential exchange process, preventing credentials from being transmitted in
cleartext. WPA2-Personal uses a pre-shared key and does not offer the enterprise-
level security of mutual authentication. WPA3-Enterprise can also support EAP-TLS,
but WPA2-Enterprise is a widely implemented standard. While SAE provides a
secure handshake, it is a feature of WPA3-Personal, not enterprise-level
authentication.
,2. A system administrator is reviewing an organization's security policies and
notices that a recent incident involved the theft of a laptop containing sensitive
client information. The laptop was encrypted, but the thief was able to access
the data. Which of the following was MOST likely the cause of the data breach?
A. The encryption algorithm used was weak and broken.
B. The encryption key was stored in plaintext on the laptop.
C. The user was logged in when the laptop was stolen.
D. The data on the laptop was not encrypted at rest.
Correct Answer: C. The user was logged in when the laptop was stolen.
Rationale: If the laptop was encrypted but the data was accessed, the most likely
scenario is that the encrypted volume was mounted and accessible because the user
was logged in when the device was stolen. Full-disk encryption protects data at rest,
but it does not protect data when the system is unlocked and in use. The question
confirms the laptop was encrypted, making A and D less likely. While storing the
encryption key on the device is a risk, modern encryption solutions typically do not
store the key in a retrievable, plaintext format that would be accessible.
3. A company has implemented a new web application firewall (WAF) to
protect its public-facing e-commerce site. The security team observes an
increase in alerts related to SQL injection attempts. Which of the following is
the BEST action for the team to take to improve the application's security
posture?
A. Increase the logging level on the WAF to capture more details.
B. Implement a parameterized queries solution in the application code.
,C. Block all incoming traffic from the source IP addresses of the attacks.
D. Configure the WAF to automatically update its rule sets daily.
Correct Answer: B. Implement a parameterized queries solution in the
application code.
Rationale: While a WAF can detect and block SQL injection attempts, the most
effective long-term solution is to fix the root cause in the application code.
Parameterized queries (also known as prepared statements) are a coding best
practice that separates SQL logic from data, preventing user-supplied input from
being interpreted as code. This is a more robust solution than relying solely on the
WAF, which can be bypassed. Updating rules or blocking IPs are reactive measures
that do not address the underlying vulnerability. Increasing logging provides better
visibility but doesn't prevent successful attacks.
4. A network administrator needs to securely allow remote users to access
internal resources. The solution must provide the highest level of security by
ensuring that endpoints are checked for compliance (e.g., up-to-date antivirus
and OS patches) before they are granted access. Which of the following
technologies should the administrator deploy?
A. SSL VPN
B. IPsec VPN
C. NAC (Network Access Control)
D. RDP Gateway
Correct Answer: C. NAC (Network Access Control)
, Rationale: Network Access Control (NAC) is a security solution that enforces policies
on endpoints attempting to access the network. It can perform a posture
assessment, checking for antivirus definitions, operating system patches, and other
security software, and then grant or deny access based on compliance. This is the
most suitable technology for the requirement. A VPN provides encrypted tunnels
but does not inherently perform endpoint posture checks. An RDP Gateway allows
secure remote desktop connections but does not have the same level of network-
level compliance enforcement.
5. A security analyst has discovered that an employee downloaded a file from a
phishing email, which then executed malware. The malware attempted to
create a scheduled task to run a script every hour. Which of the following
Windows utilities would be MOST effective for the analyst to identify the
persistence mechanism?
A. Event Viewer
B. Task Scheduler
C. Registry Editor
D. Services.msc
Correct Answer: B. Task Scheduler
Rationale: The scenario describes a persistence mechanism that creates a scheduled
task to run a script. Task Scheduler is the Windows utility specifically designed to
view, create, and manage scheduled tasks. An analyst would use Task Scheduler to
inspect the properties of the suspicious task and determine the script it executes, its
triggers, and its author. Registry Editor could be used to check for other forms of
persistence, but the specific mechanism mentioned uses scheduled tasks.
VERIFIED AND WELL DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED
PASS | 2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE TEST
1. A security administrator is configuring a new wireless network for a small
office. The primary requirement is to ensure that user credentials are not
transmitted in cleartext and that the authentication process provides mutual
authentication between the client and the authentication server. Which of the
following protocols and configurations should the administrator implement?
A. WPA2-Personal with TKIP
B. WPA3-Enterprise with SAE
C. WPA2-Enterprise with EAP-TLS
D. WPA3-Personal with CCMP-128
Correct Answer: C. WPA2-Enterprise with EAP-TLS
Rationale: EAP-TLS (Extensible Authentication Protocol-Transport Layer Security)
provides mutual authentication using digital certificates, ensuring that both the
client and the authentication server verify each other's identity. It also encrypts the
credential exchange process, preventing credentials from being transmitted in
cleartext. WPA2-Personal uses a pre-shared key and does not offer the enterprise-
level security of mutual authentication. WPA3-Enterprise can also support EAP-TLS,
but WPA2-Enterprise is a widely implemented standard. While SAE provides a
secure handshake, it is a feature of WPA3-Personal, not enterprise-level
authentication.
,2. A system administrator is reviewing an organization's security policies and
notices that a recent incident involved the theft of a laptop containing sensitive
client information. The laptop was encrypted, but the thief was able to access
the data. Which of the following was MOST likely the cause of the data breach?
A. The encryption algorithm used was weak and broken.
B. The encryption key was stored in plaintext on the laptop.
C. The user was logged in when the laptop was stolen.
D. The data on the laptop was not encrypted at rest.
Correct Answer: C. The user was logged in when the laptop was stolen.
Rationale: If the laptop was encrypted but the data was accessed, the most likely
scenario is that the encrypted volume was mounted and accessible because the user
was logged in when the device was stolen. Full-disk encryption protects data at rest,
but it does not protect data when the system is unlocked and in use. The question
confirms the laptop was encrypted, making A and D less likely. While storing the
encryption key on the device is a risk, modern encryption solutions typically do not
store the key in a retrievable, plaintext format that would be accessible.
3. A company has implemented a new web application firewall (WAF) to
protect its public-facing e-commerce site. The security team observes an
increase in alerts related to SQL injection attempts. Which of the following is
the BEST action for the team to take to improve the application's security
posture?
A. Increase the logging level on the WAF to capture more details.
B. Implement a parameterized queries solution in the application code.
,C. Block all incoming traffic from the source IP addresses of the attacks.
D. Configure the WAF to automatically update its rule sets daily.
Correct Answer: B. Implement a parameterized queries solution in the
application code.
Rationale: While a WAF can detect and block SQL injection attempts, the most
effective long-term solution is to fix the root cause in the application code.
Parameterized queries (also known as prepared statements) are a coding best
practice that separates SQL logic from data, preventing user-supplied input from
being interpreted as code. This is a more robust solution than relying solely on the
WAF, which can be bypassed. Updating rules or blocking IPs are reactive measures
that do not address the underlying vulnerability. Increasing logging provides better
visibility but doesn't prevent successful attacks.
4. A network administrator needs to securely allow remote users to access
internal resources. The solution must provide the highest level of security by
ensuring that endpoints are checked for compliance (e.g., up-to-date antivirus
and OS patches) before they are granted access. Which of the following
technologies should the administrator deploy?
A. SSL VPN
B. IPsec VPN
C. NAC (Network Access Control)
D. RDP Gateway
Correct Answer: C. NAC (Network Access Control)
, Rationale: Network Access Control (NAC) is a security solution that enforces policies
on endpoints attempting to access the network. It can perform a posture
assessment, checking for antivirus definitions, operating system patches, and other
security software, and then grant or deny access based on compliance. This is the
most suitable technology for the requirement. A VPN provides encrypted tunnels
but does not inherently perform endpoint posture checks. An RDP Gateway allows
secure remote desktop connections but does not have the same level of network-
level compliance enforcement.
5. A security analyst has discovered that an employee downloaded a file from a
phishing email, which then executed malware. The malware attempted to
create a scheduled task to run a script every hour. Which of the following
Windows utilities would be MOST effective for the analyst to identify the
persistence mechanism?
A. Event Viewer
B. Task Scheduler
C. Registry Editor
D. Services.msc
Correct Answer: B. Task Scheduler
Rationale: The scenario describes a persistence mechanism that creates a scheduled
task to run a script. Task Scheduler is the Windows utility specifically designed to
view, create, and manage scheduled tasks. An analyst would use Task Scheduler to
inspect the properties of the suspicious task and determine the script it executes, its
triggers, and its author. Registry Editor could be used to check for other forms of
persistence, but the specific mechanism mentioned uses scheduled tasks.
