2026 COMPTIA CYBERSECURITY CAREER
PATHWAY CERTIFICATION EXAM WITH
QUESTIONS AND VERIFIED ANSWERS,
PLUS DETAILED RATIONALES/EXPERT
VERIFIED FOR GUARANTEED PASS
2026/LATEST UPDATE/INSTANT
DOWNLOAD PDF
1. A security analyst is reviewing an organization’s vulnerability
management program. A critical vulnerability is discovered on an
internet-facing web server, but the organization cannot
immediately patch it because the application is supporting a critical
business process. Which action BEST reduces the immediate risk?
A. Disable all logging on the server
B. Apply compensating controls such as restricting network access and
deploying virtual patching
C. Wait until the next scheduled maintenance window
D. Remove the vulnerability scanner from the network
Answer: B. Apply compensating controls such as restricting
network access and deploying virtual patching
Rationale: When immediate patching is not feasible, compensating
controls can reduce the attack surface while preserving business
operations. Network restrictions, web application firewalls, IPS rules,
and virtual patching can limit exploitation until the permanent fix is
deployed.
2. An organization discovers that an employee's credentials were
used to authenticate from Kenya at 09:00 and from Germany at
09:05. The organization knows the employee could not physically
1
, travel between the two locations in five minutes. What security
detection technique is MOST appropriate?
A. Data masking
B. Impossible-travel detection
C. Hash collision detection
D. Port knocking
Answer: B. Impossible-travel detection
Rationale: Impossible-travel detection compares authentication
locations and timestamps to identify geographically impossible activity.
It is commonly used as an indicator of credential compromise, account
takeover, VPN abuse, or stolen session credentials.
3. A penetration tester successfully obtains administrator privileges
on a workstation after exploiting a vulnerable application. The
tester then attempts to access additional systems using the
compromised credentials. Which phase of the attack is BEST
represented?
A. Reconnaissance
B. Privilege escalation
C. Lateral movement
D. Initial access
Answer: C. Lateral movement
Rationale: Lateral movement occurs after initial compromise when an
attacker attempts to move from one compromised host or account to
additional systems. Techniques can include pass-the-hash, remote
services, stolen credentials, and exploitation of internal systems.
4. A security engineer wants to ensure that a downloaded software
package has not been modified since it was published. Which
mechanism BEST accomplishes this?
2
,A. Hash verification
B. Network segmentation
C. NAT
D. Load balancing
Answer: A. Hash verification
Rationale: A cryptographic hash produces a fixed-length
representation of data. Comparing the published hash with a locally
calculated hash can reveal whether the file has changed. Hashing
provides integrity verification but does not by itself prove authenticity
unless the trusted hash source is authentic.
5. An organization wants employees to authenticate using something
they know, something they have, and something they are. Which
security concept does this represent?
A. Single sign-on
B. Multifactor authentication
C. Federation
D. Password synchronization
Answer: B. Multifactor authentication
Rationale: Multifactor authentication combines two or more different
authentication factors. Knowledge factors include passwords,
possession factors include hardware tokens, and inherence factors
include biometrics. Using multiple factors reduces the impact of a
compromised password.
6. A security operations center receives an alert indicating that a
workstation has executed PowerShell commands that download an
executable from an external server. What should the analyst
investigate FIRST?
A. Whether the workstation is authorized to use PowerShell
B. The process tree, command line, network connections, and parent
3
, process
C. Whether the employee has completed security awareness training
D. The workstation's screen resolution
Answer: B. The process tree, command line, network connections,
and parent process
Rationale: Examining execution context helps determine whether the
activity is malicious. The analyst should establish what launched
PowerShell, what commands were executed, what destination was
contacted, and whether the downloaded file executed.
7. A company wants to prevent users from accessing unauthorized
websites while also inspecting web traffic for malicious content.
Which technology would BEST support this requirement?
A. Web application firewall
B. Secure web gateway
C. Network time protocol
D. Hardware security module
Answer: B. Secure web gateway
Rationale: A secure web gateway can enforce web access policies,
filter URLs, inspect traffic, and identify malicious or inappropriate
content. A web application firewall primarily protects applications and
web servers from attacks against application-layer functionality.
8. A security architect divides a corporate network into separate
VLANs for finance, human resources, engineering, and guest
devices. What security principle is primarily being implemented?
A. Network segmentation
B. Data deduplication
C. Nonrepudiation
D. Key escrow
Answer: A. Network segmentation
4
PATHWAY CERTIFICATION EXAM WITH
QUESTIONS AND VERIFIED ANSWERS,
PLUS DETAILED RATIONALES/EXPERT
VERIFIED FOR GUARANTEED PASS
2026/LATEST UPDATE/INSTANT
DOWNLOAD PDF
1. A security analyst is reviewing an organization’s vulnerability
management program. A critical vulnerability is discovered on an
internet-facing web server, but the organization cannot
immediately patch it because the application is supporting a critical
business process. Which action BEST reduces the immediate risk?
A. Disable all logging on the server
B. Apply compensating controls such as restricting network access and
deploying virtual patching
C. Wait until the next scheduled maintenance window
D. Remove the vulnerability scanner from the network
Answer: B. Apply compensating controls such as restricting
network access and deploying virtual patching
Rationale: When immediate patching is not feasible, compensating
controls can reduce the attack surface while preserving business
operations. Network restrictions, web application firewalls, IPS rules,
and virtual patching can limit exploitation until the permanent fix is
deployed.
2. An organization discovers that an employee's credentials were
used to authenticate from Kenya at 09:00 and from Germany at
09:05. The organization knows the employee could not physically
1
, travel between the two locations in five minutes. What security
detection technique is MOST appropriate?
A. Data masking
B. Impossible-travel detection
C. Hash collision detection
D. Port knocking
Answer: B. Impossible-travel detection
Rationale: Impossible-travel detection compares authentication
locations and timestamps to identify geographically impossible activity.
It is commonly used as an indicator of credential compromise, account
takeover, VPN abuse, or stolen session credentials.
3. A penetration tester successfully obtains administrator privileges
on a workstation after exploiting a vulnerable application. The
tester then attempts to access additional systems using the
compromised credentials. Which phase of the attack is BEST
represented?
A. Reconnaissance
B. Privilege escalation
C. Lateral movement
D. Initial access
Answer: C. Lateral movement
Rationale: Lateral movement occurs after initial compromise when an
attacker attempts to move from one compromised host or account to
additional systems. Techniques can include pass-the-hash, remote
services, stolen credentials, and exploitation of internal systems.
4. A security engineer wants to ensure that a downloaded software
package has not been modified since it was published. Which
mechanism BEST accomplishes this?
2
,A. Hash verification
B. Network segmentation
C. NAT
D. Load balancing
Answer: A. Hash verification
Rationale: A cryptographic hash produces a fixed-length
representation of data. Comparing the published hash with a locally
calculated hash can reveal whether the file has changed. Hashing
provides integrity verification but does not by itself prove authenticity
unless the trusted hash source is authentic.
5. An organization wants employees to authenticate using something
they know, something they have, and something they are. Which
security concept does this represent?
A. Single sign-on
B. Multifactor authentication
C. Federation
D. Password synchronization
Answer: B. Multifactor authentication
Rationale: Multifactor authentication combines two or more different
authentication factors. Knowledge factors include passwords,
possession factors include hardware tokens, and inherence factors
include biometrics. Using multiple factors reduces the impact of a
compromised password.
6. A security operations center receives an alert indicating that a
workstation has executed PowerShell commands that download an
executable from an external server. What should the analyst
investigate FIRST?
A. Whether the workstation is authorized to use PowerShell
B. The process tree, command line, network connections, and parent
3
, process
C. Whether the employee has completed security awareness training
D. The workstation's screen resolution
Answer: B. The process tree, command line, network connections,
and parent process
Rationale: Examining execution context helps determine whether the
activity is malicious. The analyst should establish what launched
PowerShell, what commands were executed, what destination was
contacted, and whether the downloaded file executed.
7. A company wants to prevent users from accessing unauthorized
websites while also inspecting web traffic for malicious content.
Which technology would BEST support this requirement?
A. Web application firewall
B. Secure web gateway
C. Network time protocol
D. Hardware security module
Answer: B. Secure web gateway
Rationale: A secure web gateway can enforce web access policies,
filter URLs, inspect traffic, and identify malicious or inappropriate
content. A web application firewall primarily protects applications and
web servers from attacks against application-layer functionality.
8. A security architect divides a corporate network into separate
VLANs for finance, human resources, engineering, and guest
devices. What security principle is primarily being implemented?
A. Network segmentation
B. Data deduplication
C. Nonrepudiation
D. Key escrow
Answer: A. Network segmentation
4
