COMPTIA SECURITY+ – PRACTICE QUESTIONS AND CORRECT ANSWERS
(VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD
PDF.
Core Domains
- General Security Concepts
- Threats, Vulnerabilities, and Mitigations
- Security Architecture
- Security Operations
- Security Program Management and Oversight
- Identity and Access Management
- Network Security Operations
- Incident Response and Monitoring
Introduction
The CompTIA Security+ assessment is a global certification that validates the
baseline skills necessary to perform core security functions and pursue an IT security
career. This exam is designed to ensure that candidates possess the knowledge
required to install and configure systems to secure applications, networks, and
,devices; perform threat analysis and respond with appropriate mitigation techniques;
participate in risk mitigation activities; and operate with an awareness of applicable
policies, laws, and regulations. The structure consists of multiple-choice and complex
scenario-based questions that emphasize real-world application and hands-on
problem-solving. Success requires a deep understanding of how to apply technical
knowledge to make critical security decisions in a professional environment.
SECTION ONE: QUESTIONS 1–100
1. An organization is implementing a new security policy that requires all users to
provide two different forms of identification before accessing the internal
network. Which of the following best describes this implementation?
A. Single sign-on
B. Federation
C. Multi-factor authentication
D. Role-based access control
🟢 C. Multi-factor authentication
🔴 RATIONALE: Multi-factor authentication requires two or more different categories
of credentials (something you know, something you have, or something you are) to
,verify a user's identity.
2. A security analyst discovers an unauthorized device plugged into a network
switch in a common area. The device is capturing traffic and sending it to an
external IP address. Which type of attack is occurring?
A. Denial of service
B. Man-in-the-middle
C. Replay attack
D. ARP poisoning
🟢 B. Man-in-the-middle
🔴 RATIONALE: A man-in-the-middle attack involves an attacker placing themselves
between two communicating parties to intercept or alter the communication.
3. Which of the following protocols is used to securely transfer files over a network
by encrypting both the commands and the data?
A. FTP
B. SNMPv2
C. SFTP
D. TFTP
, 🟢 C. SFTP
🔴 RATIONALE: SFTP (SSH File Transfer Protocol) uses Secure Shell to provide a
secure channel for file transfers, protecting both credentials and data.
4. A company wants to ensure that its sensitive data remains confidential even if
the physical hard drives are stolen. Which of the following should be
implemented?
A. Hashing
B. Full disk encryption
C. File integrity monitoring
D. Redundant Array of Independent Disks
🟢 B. Full disk encryption
🔴 RATIONALE: Full disk encryption (FDE) protects data at rest by encrypting the
entire drive, making the data inaccessible without the correct decryption key.
5. A security administrator is configuring a firewall to allow only encrypted web
traffic to reach an internal server. Which port should be opened?
(VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD
PDF.
Core Domains
- General Security Concepts
- Threats, Vulnerabilities, and Mitigations
- Security Architecture
- Security Operations
- Security Program Management and Oversight
- Identity and Access Management
- Network Security Operations
- Incident Response and Monitoring
Introduction
The CompTIA Security+ assessment is a global certification that validates the
baseline skills necessary to perform core security functions and pursue an IT security
career. This exam is designed to ensure that candidates possess the knowledge
required to install and configure systems to secure applications, networks, and
,devices; perform threat analysis and respond with appropriate mitigation techniques;
participate in risk mitigation activities; and operate with an awareness of applicable
policies, laws, and regulations. The structure consists of multiple-choice and complex
scenario-based questions that emphasize real-world application and hands-on
problem-solving. Success requires a deep understanding of how to apply technical
knowledge to make critical security decisions in a professional environment.
SECTION ONE: QUESTIONS 1–100
1. An organization is implementing a new security policy that requires all users to
provide two different forms of identification before accessing the internal
network. Which of the following best describes this implementation?
A. Single sign-on
B. Federation
C. Multi-factor authentication
D. Role-based access control
🟢 C. Multi-factor authentication
🔴 RATIONALE: Multi-factor authentication requires two or more different categories
of credentials (something you know, something you have, or something you are) to
,verify a user's identity.
2. A security analyst discovers an unauthorized device plugged into a network
switch in a common area. The device is capturing traffic and sending it to an
external IP address. Which type of attack is occurring?
A. Denial of service
B. Man-in-the-middle
C. Replay attack
D. ARP poisoning
🟢 B. Man-in-the-middle
🔴 RATIONALE: A man-in-the-middle attack involves an attacker placing themselves
between two communicating parties to intercept or alter the communication.
3. Which of the following protocols is used to securely transfer files over a network
by encrypting both the commands and the data?
A. FTP
B. SNMPv2
C. SFTP
D. TFTP
, 🟢 C. SFTP
🔴 RATIONALE: SFTP (SSH File Transfer Protocol) uses Secure Shell to provide a
secure channel for file transfers, protecting both credentials and data.
4. A company wants to ensure that its sensitive data remains confidential even if
the physical hard drives are stolen. Which of the following should be
implemented?
A. Hashing
B. Full disk encryption
C. File integrity monitoring
D. Redundant Array of Independent Disks
🟢 B. Full disk encryption
🔴 RATIONALE: Full disk encryption (FDE) protects data at rest by encrypting the
entire drive, making the data inaccessible without the correct decryption key.
5. A security administrator is configuring a firewall to allow only encrypted web
traffic to reach an internal server. Which port should be opened?
