CompTIA CertMaster CE Security+ (2026/2027)
Complete Practice Questions and Answers with
Explanations
1. Which of the following is the primary purpose of the CIA triad in
information security?
A) To ensure data is encrypted at rest
B) To define the core security objectives: Confidentiality, Integrity, and Availability
C) To establish authentication protocols
D) To manage access control lists
Answer B: To define the core security objectives: Confidentiality, Integrity,
and Availability
Rationale: The CIA triad is the foundation of information security, balancing three
goals: keeping data secret, ensuring it is trustworthy, and keeping it accessible.
2. An attacker sends a phishing email to employees, posing as the IT
department and requesting password verification. This is an example of:
A) Social engineering
B) Malware infection
C) Denial of service
D) Spoofing
Answer A: Social engineering
,Rationale: Social engineering manipulates people into revealing confidential
information or performing actions. Phishing is a classic social engineering attack.
3. A company implements a policy requiring employees to use both a smart
card and a PIN to access workstations. This is an example of:
A) Single-factor authentication
B) Multi-factor authentication (MFA)
C) Biometric authentication
D) Role-based access control
Answer B: Multi-factor authentication (MFA)
Rationale: MFA uses two or more authentication factors. A smart card (something
you have) and a PIN (something you know) are distinct factors, providing stronger
security.
4. An organization wants to ensure that a security patch is tested before
deployment. Which change management step should be performed first?
A) Approve the change
B) Initiate a change request in a lab environment
C) Deploy to production
D) Document the rollback procedure
Answer B: Initiate a change request in a lab environment
Rationale: Change management includes testing changes in a non-production
environment before approval and deployment to production.
,5. Which of the following is a detective security control?
A) Firewall rule blocking inbound traffic
B) Intrusion Detection System (IDS) alerting on suspicious traffic
C) Encryption of data at rest
D) Mandatory access control policy
Answer B: Intrusion Detection System (IDS) alerting on suspicious traffic
Rationale: Detective controls identify and alert on security events after they occur.
Firewalls and encryption are preventive; policies are administrative.
6. A security analyst reviews logs and notices multiple failed login attempts
from a single IP address followed by a successful login. This activity is most
indicative of:
A) Normal user behavior
B) A brute-force attack followed by successful compromise
C) A denial-of-service attack
D) System maintenance activity
Answer B: A brute-force attack followed by successful compromise
Rationale: A series of failed logins followed by a successful one suggests an
attacker was attempting to guess credentials and succeeded.
7. What is the primary purpose of a hardware security module (HSM)?
, A) To store and manage digital certificates for web servers
B) To securely generate, store, and manage cryptographic keys
C) To provide endpoint detection and response
D) To scan for vulnerabilities in the network
Answer B: To securely generate, store, and manage cryptographic keys
Rationale: HSMs are physical devices designed to protect cryptographic keys
from theft or misuse.
8. Which of the following is a valid recovery time objective (RTO)?
A) The maximum acceptable data loss measured in time
B) The target time to restore systems after a disruption
C) The minimum system uptime required
D) The time between security patches
Answer B: The target time to restore systems after a disruption
Rationale: RTO is the time from disaster declaration to system restoration.
Recovery Point Objective (RPO) measures data loss.
9. A network administrator configures a firewall rule to allow only traffic on
port 443 to a web server. This is an example of:
A) Least privilege
B) Defense in depth
C) Zero trust
D) Separation of duties
Complete Practice Questions and Answers with
Explanations
1. Which of the following is the primary purpose of the CIA triad in
information security?
A) To ensure data is encrypted at rest
B) To define the core security objectives: Confidentiality, Integrity, and Availability
C) To establish authentication protocols
D) To manage access control lists
Answer B: To define the core security objectives: Confidentiality, Integrity,
and Availability
Rationale: The CIA triad is the foundation of information security, balancing three
goals: keeping data secret, ensuring it is trustworthy, and keeping it accessible.
2. An attacker sends a phishing email to employees, posing as the IT
department and requesting password verification. This is an example of:
A) Social engineering
B) Malware infection
C) Denial of service
D) Spoofing
Answer A: Social engineering
,Rationale: Social engineering manipulates people into revealing confidential
information or performing actions. Phishing is a classic social engineering attack.
3. A company implements a policy requiring employees to use both a smart
card and a PIN to access workstations. This is an example of:
A) Single-factor authentication
B) Multi-factor authentication (MFA)
C) Biometric authentication
D) Role-based access control
Answer B: Multi-factor authentication (MFA)
Rationale: MFA uses two or more authentication factors. A smart card (something
you have) and a PIN (something you know) are distinct factors, providing stronger
security.
4. An organization wants to ensure that a security patch is tested before
deployment. Which change management step should be performed first?
A) Approve the change
B) Initiate a change request in a lab environment
C) Deploy to production
D) Document the rollback procedure
Answer B: Initiate a change request in a lab environment
Rationale: Change management includes testing changes in a non-production
environment before approval and deployment to production.
,5. Which of the following is a detective security control?
A) Firewall rule blocking inbound traffic
B) Intrusion Detection System (IDS) alerting on suspicious traffic
C) Encryption of data at rest
D) Mandatory access control policy
Answer B: Intrusion Detection System (IDS) alerting on suspicious traffic
Rationale: Detective controls identify and alert on security events after they occur.
Firewalls and encryption are preventive; policies are administrative.
6. A security analyst reviews logs and notices multiple failed login attempts
from a single IP address followed by a successful login. This activity is most
indicative of:
A) Normal user behavior
B) A brute-force attack followed by successful compromise
C) A denial-of-service attack
D) System maintenance activity
Answer B: A brute-force attack followed by successful compromise
Rationale: A series of failed logins followed by a successful one suggests an
attacker was attempting to guess credentials and succeeded.
7. What is the primary purpose of a hardware security module (HSM)?
, A) To store and manage digital certificates for web servers
B) To securely generate, store, and manage cryptographic keys
C) To provide endpoint detection and response
D) To scan for vulnerabilities in the network
Answer B: To securely generate, store, and manage cryptographic keys
Rationale: HSMs are physical devices designed to protect cryptographic keys
from theft or misuse.
8. Which of the following is a valid recovery time objective (RTO)?
A) The maximum acceptable data loss measured in time
B) The target time to restore systems after a disruption
C) The minimum system uptime required
D) The time between security patches
Answer B: The target time to restore systems after a disruption
Rationale: RTO is the time from disaster declaration to system restoration.
Recovery Point Objective (RPO) measures data loss.
9. A network administrator configures a firewall rule to allow only traffic on
port 443 to a web server. This is an example of:
A) Least privilege
B) Defense in depth
C) Zero trust
D) Separation of duties
