CompTIA Security+ Certification Exam
Practice Questions And Correct Answers
(Verified Answers) Plus Rationale 2026
Q&A| Instant Download Pdf
1. A security analyst is reviewing logs and notices repeated failed login
attempts originating from multiple geographically dispersed IP
addresses targeting a single administrative account over a short
period. Which attack type is most likely occurring?
A. Phishing campaign
B. Password spraying attack
C. Distributed brute-force attack using botnet infrastructure
D. Shoulder surfing
The pattern of multiple failed login attempts from distributed IP addresses
against a single account strongly indicates a coordinated brute-force
attempt leveraging botnets to evade IP-based blocking mechanisms.
2. An organization wants to ensure that stored passwords remain secure
even if a database is compromised. Which method provides the
strongest protection for password storage?
A. Encoding passwords with Base64
B. Encrypting passwords with reversible encryption
C. Storing plaintext passwords in a secure vault
D. Hashing passwords with salt using a strong adaptive algorithm
(e.g., bcrypt or Argon2)
Hashing with a unique salt and adaptive algorithm prevents
, attackers from easily reversing or comparing password hashes,
significantly increasing resistance to offline attacks.
3. A company implements a system that allows employees to access
multiple cloud services using a single set of credentials. Which concept
does this describe?
A. Multifactor authentication
B. Role-based access control
C. Single sign-on (SSO)
D. Least privilege access
Single sign-on enables users to authenticate once and gain access to
multiple systems, improving usability while centralizing
authentication management.
4. A security engineer is configuring wireless security and wants the
strongest available encryption standard for enterprise Wi-Fi networks.
Which option should be selected?
A. WEP
B. WPA
C. WPA2 with TKIP
D. WPA3 with SAE (Simultaneous Authentication of Equals)
WPA3 provides the strongest modern wireless encryption using SAE,
which protects against offline dictionary attacks and improves
handshake security.
5. A user receives an email appearing to come from their bank asking
them to verify account details via a link. The email contains urgent
language and suspicious formatting. What type of attack is this?
A. Spear phishing
B. Tailgating
C. Phishing
D. Whaling
Generic deceptive emails attempting to trick users into revealing
credentials or sensitive information are classified as phishing attacks.
6. A company wants to ensure that data transmitted over a network
cannot be read even if intercepted. Which security control best
achieves this?
A. Data masking
, B. Tokenization
C. Hashing
D. Encryption in transit (e.g., TLS)
Encryption in transit ensures that intercepted data remains
unreadable without the proper decryption keys.
7. A penetration tester gains access to a system by exploiting an
unpatched vulnerability in a web application. What is this vulnerability
commonly called?
A. Social engineering flaw
B. Zero trust failure
C. Software vulnerability exploit
D. Physical security breach
Exploiting unpatched software flaws is a classic method of leveraging
software vulnerabilities to gain unauthorized access.
8. Which principle ensures that users are only granted the minimum
access required to perform their job functions?
A. Defense in depth
B. Separation of duties
C. Need to know
D. Least privilege principle
Least privilege limits access rights to only what is necessary, reducing
the attack surface and potential damage.
9. A security analyst is investigating malware that spreads by attaching
itself to executable files and activating when the host program runs.
What type of malware is this?
A. Worm
B. Trojan
C. Ransomware
D. Virus
A virus attaches to legitimate executable files and activates when the
infected file is executed.
10. An organization wants to verify user identity using something
the user knows, something the user has, and something the user is.
What concept is being implemented?
A. Single sign-on
Practice Questions And Correct Answers
(Verified Answers) Plus Rationale 2026
Q&A| Instant Download Pdf
1. A security analyst is reviewing logs and notices repeated failed login
attempts originating from multiple geographically dispersed IP
addresses targeting a single administrative account over a short
period. Which attack type is most likely occurring?
A. Phishing campaign
B. Password spraying attack
C. Distributed brute-force attack using botnet infrastructure
D. Shoulder surfing
The pattern of multiple failed login attempts from distributed IP addresses
against a single account strongly indicates a coordinated brute-force
attempt leveraging botnets to evade IP-based blocking mechanisms.
2. An organization wants to ensure that stored passwords remain secure
even if a database is compromised. Which method provides the
strongest protection for password storage?
A. Encoding passwords with Base64
B. Encrypting passwords with reversible encryption
C. Storing plaintext passwords in a secure vault
D. Hashing passwords with salt using a strong adaptive algorithm
(e.g., bcrypt or Argon2)
Hashing with a unique salt and adaptive algorithm prevents
, attackers from easily reversing or comparing password hashes,
significantly increasing resistance to offline attacks.
3. A company implements a system that allows employees to access
multiple cloud services using a single set of credentials. Which concept
does this describe?
A. Multifactor authentication
B. Role-based access control
C. Single sign-on (SSO)
D. Least privilege access
Single sign-on enables users to authenticate once and gain access to
multiple systems, improving usability while centralizing
authentication management.
4. A security engineer is configuring wireless security and wants the
strongest available encryption standard for enterprise Wi-Fi networks.
Which option should be selected?
A. WEP
B. WPA
C. WPA2 with TKIP
D. WPA3 with SAE (Simultaneous Authentication of Equals)
WPA3 provides the strongest modern wireless encryption using SAE,
which protects against offline dictionary attacks and improves
handshake security.
5. A user receives an email appearing to come from their bank asking
them to verify account details via a link. The email contains urgent
language and suspicious formatting. What type of attack is this?
A. Spear phishing
B. Tailgating
C. Phishing
D. Whaling
Generic deceptive emails attempting to trick users into revealing
credentials or sensitive information are classified as phishing attacks.
6. A company wants to ensure that data transmitted over a network
cannot be read even if intercepted. Which security control best
achieves this?
A. Data masking
, B. Tokenization
C. Hashing
D. Encryption in transit (e.g., TLS)
Encryption in transit ensures that intercepted data remains
unreadable without the proper decryption keys.
7. A penetration tester gains access to a system by exploiting an
unpatched vulnerability in a web application. What is this vulnerability
commonly called?
A. Social engineering flaw
B. Zero trust failure
C. Software vulnerability exploit
D. Physical security breach
Exploiting unpatched software flaws is a classic method of leveraging
software vulnerabilities to gain unauthorized access.
8. Which principle ensures that users are only granted the minimum
access required to perform their job functions?
A. Defense in depth
B. Separation of duties
C. Need to know
D. Least privilege principle
Least privilege limits access rights to only what is necessary, reducing
the attack surface and potential damage.
9. A security analyst is investigating malware that spreads by attaching
itself to executable files and activating when the host program runs.
What type of malware is this?
A. Worm
B. Trojan
C. Ransomware
D. Virus
A virus attaches to legitimate executable files and activates when the
infected file is executed.
10. An organization wants to verify user identity using something
the user knows, something the user has, and something the user is.
What concept is being implemented?
A. Single sign-on
