COMPTIA CERTIFICATION | CYBERSECURITY
CompTIA Security+ Exam
A+
2026/2027 | CompTIA
Complete Review with Questions
& Verified Answers 2026/2027
Professional Certification Practice Examination — Threats, Architecture, Implementation, Operations, GRC
A+ QUESTIONS 5 SECTIONS 100%
VERIFIED COVERED RATIONALES
CATEGORIES
■ Threats, Attacks & Vulnerabilities
■ Architecture & Design
■ Implementation
■ Operations & Incident Response
■ Governance, Risk & Compliance
STUVIAACTUALEXAM
Original practice content aligned to CompTIA Security+ public exam domains. Not an official CompTIA exam.
, SECTION 1: Threats, Attacks & Vulnerabilities
Q1. A security analyst reviews network logs and notices repeated authentication attempts from a single external IP against
multiple user accounts, each trying a small number of common passwords. The activity is spaced over several hours to avoid
triggering lockout thresholds. Which type of attack is most likely occurring?
A. Credential stuffing using previously breached password lists
B. Brute-force attack focused on a single high-value account
C. Password spraying against many accounts with a few common passwords
D. Man-in-the-middle interception of authentication traffic
Correct Answer: C
Rationale: Password spraying tries a small set of common passwords against many accounts while staying under lockout thresholds.
Credential stuffing reuses known breached username/password pairs; pure brute force concentrates on one account.
Q2. An employee receives an email that appears to come from the company’s CEO, urgently requesting a wire transfer to a
new vendor. The email domain is slightly misspelled and the request bypasses normal approval workflows. This scenario best
describes which social-engineering technique?
A. Vishing using a phone call from a spoofed number
B. Business email compromise combined with spear-phishing
C. Watering-hole attack on a frequently visited industry site
D. Tailgating into a secure facility
Correct Answer: B
Rationale: Business email compromise (BEC) often uses spoofed or look-alike domains and urgent financial requests that circumvent normal
controls. Spear-phishing targets specific individuals with tailored messages.
Q3. A web application allows users to upload profile images. An attacker uploads a file named “shell.php.jpg” that contains
executable PHP code. The application stores the file and later executes it when the image is requested. Which vulnerability is
being exploited?
A. Cross-site scripting (XSS) in the image metadata
B. SQL injection in the filename parameter
C. Insecure direct object reference to another user’s profile
D. Unrestricted file upload leading to remote code execution
Correct Answer: D
Rationale: Unrestricted or improperly validated file uploads can allow attackers to place executable code on the server. The double extension
is a common evasion technique when content-type or extension checks are weak.
Q4. During a penetration test, the tester discovers that a critical internal application still accepts TLSv1.0 connections and uses
a weak cipher suite. An attacker positioned on the network could exploit this to decrypt sensitive traffic. Which attack technique
is most relevant?
A. Protocol downgrade or cryptographic attack against weak TLS
B. SQL injection against the application database
C. Cross-site request forgery forcing the user to change settings
D. ARP spoofing solely to redirect DNS queries
Correct Answer: A
Rationale: Weak or obsolete TLS versions and cipher suites are vulnerable to known cryptographic attacks and protocol downgrade
techniques that can expose plaintext data.
Q5. A company’s public-facing API returns detailed error messages that include stack traces and database table names when
invalid input is supplied. An attacker uses this information to craft more precise injection payloads. Which vulnerability category
does this represent?
A. Broken access control allowing horizontal privilege escalation
B. Insufficient logging and monitoring of API calls
C. Server-side request forgery targeting internal resources
D. Security misconfiguration exposing sensitive diagnostic information
Correct Answer: D
Rationale: Verbose error messages that reveal internal structure are a classic security misconfiguration. They reduce the attacker’s
reconnaissance effort and increase the success rate of subsequent exploits.
CompTIA Security+ Exam 2026/2027 | CompTIA | Complete Review | Page 2
, Q6. An organization finds that several workstations have been infected with ransomware that encrypts files and demands
payment in cryptocurrency. Forensic analysis shows the initial infection vector was a malicious macro in a document opened
from a phishing email. Which mitigation would have been most effective at preventing the initial execution?
A. Increasing the password complexity requirements for all users
B. Disabling the corporate VPN for remote workers
C. Implementing application allow-listing that blocks unauthorized macros and scripts
D. Removing all antivirus software to reduce false positives
Correct Answer: C
Rationale: Application allow-listing and macro controls prevent untrusted code from executing even if a user opens a malicious document.
Password complexity and VPN settings do not address the code-execution vector.
Q7. A threat actor gains initial access to a network through a compromised VPN credential and then moves laterally by
exploiting an unpatched remote-code-execution vulnerability on an internal file server. Which combination of tactics from the
MITRE ATT&CK; framework best describes this activity?
A. Initial Access followed by Lateral Movement
B. Persistence followed by Exfiltration
C. Defense Evasion followed by Impact only
D. Discovery followed by Collection exclusively
Correct Answer: A
Rationale: Compromised credentials represent Initial Access; exploiting an internal vulnerability to reach other systems is Lateral Movement.
Both tactics are central to many modern intrusion campaigns.
Q8. Security researchers publish a zero-day vulnerability affecting a widely used enterprise VPN appliance. Within hours,
multiple organizations report active exploitation. Which term best describes this situation?
A. An advanced persistent threat that has remained undetected for years
B. A vulnerability that is being actively exploited in the wild before a patch is available
C. A false positive generated by signature-based detection systems
D. A supply-chain compromise of the VPN vendor’s build system only
Correct Answer: B
Rationale: A zero-day that is already being used by attackers is an actively exploited vulnerability. Organizations must rely on compensating
controls until a vendor patch or mitigation is released.
Q9. An attacker sends a specially crafted packet to a network service that causes the service to crash and become unavailable
to legitimate users. No authentication was required. Which type of attack has occurred?
A. Privilege escalation to gain administrative rights
B. Denial-of-service attack exploiting a vulnerability in the service
C. Man-in-the-middle attack intercepting session tokens
D. Replay attack reusing a previous authentication message
Correct Answer: B
Rationale: Crashing a service so that it cannot respond to legitimate requests is a classic denial-of-service condition, often achieved by
exploiting an unhandled exception or resource exhaustion flaw.
Q10. A developer hard-codes a database connection string containing a privileged username and password into the source
code of a web application. The code is later committed to a public repository. Which risk has been introduced?
A. Insecure cryptographic storage of session tokens
B. Cross-site scripting through the connection string parameter
C. Broken function-level authorization on administrative endpoints
D. Exposure of credentials leading to potential unauthorized database access
Correct Answer: D
Rationale: Hard-coded credentials in source code, especially when the repository becomes public, give attackers a direct path to the database.
Secrets must be stored outside the codebase and rotated if exposed.
CompTIA Security+ Exam 2026/2027 | CompTIA | Complete Review | Page 3
CompTIA Security+ Exam
A+
2026/2027 | CompTIA
Complete Review with Questions
& Verified Answers 2026/2027
Professional Certification Practice Examination — Threats, Architecture, Implementation, Operations, GRC
A+ QUESTIONS 5 SECTIONS 100%
VERIFIED COVERED RATIONALES
CATEGORIES
■ Threats, Attacks & Vulnerabilities
■ Architecture & Design
■ Implementation
■ Operations & Incident Response
■ Governance, Risk & Compliance
STUVIAACTUALEXAM
Original practice content aligned to CompTIA Security+ public exam domains. Not an official CompTIA exam.
, SECTION 1: Threats, Attacks & Vulnerabilities
Q1. A security analyst reviews network logs and notices repeated authentication attempts from a single external IP against
multiple user accounts, each trying a small number of common passwords. The activity is spaced over several hours to avoid
triggering lockout thresholds. Which type of attack is most likely occurring?
A. Credential stuffing using previously breached password lists
B. Brute-force attack focused on a single high-value account
C. Password spraying against many accounts with a few common passwords
D. Man-in-the-middle interception of authentication traffic
Correct Answer: C
Rationale: Password spraying tries a small set of common passwords against many accounts while staying under lockout thresholds.
Credential stuffing reuses known breached username/password pairs; pure brute force concentrates on one account.
Q2. An employee receives an email that appears to come from the company’s CEO, urgently requesting a wire transfer to a
new vendor. The email domain is slightly misspelled and the request bypasses normal approval workflows. This scenario best
describes which social-engineering technique?
A. Vishing using a phone call from a spoofed number
B. Business email compromise combined with spear-phishing
C. Watering-hole attack on a frequently visited industry site
D. Tailgating into a secure facility
Correct Answer: B
Rationale: Business email compromise (BEC) often uses spoofed or look-alike domains and urgent financial requests that circumvent normal
controls. Spear-phishing targets specific individuals with tailored messages.
Q3. A web application allows users to upload profile images. An attacker uploads a file named “shell.php.jpg” that contains
executable PHP code. The application stores the file and later executes it when the image is requested. Which vulnerability is
being exploited?
A. Cross-site scripting (XSS) in the image metadata
B. SQL injection in the filename parameter
C. Insecure direct object reference to another user’s profile
D. Unrestricted file upload leading to remote code execution
Correct Answer: D
Rationale: Unrestricted or improperly validated file uploads can allow attackers to place executable code on the server. The double extension
is a common evasion technique when content-type or extension checks are weak.
Q4. During a penetration test, the tester discovers that a critical internal application still accepts TLSv1.0 connections and uses
a weak cipher suite. An attacker positioned on the network could exploit this to decrypt sensitive traffic. Which attack technique
is most relevant?
A. Protocol downgrade or cryptographic attack against weak TLS
B. SQL injection against the application database
C. Cross-site request forgery forcing the user to change settings
D. ARP spoofing solely to redirect DNS queries
Correct Answer: A
Rationale: Weak or obsolete TLS versions and cipher suites are vulnerable to known cryptographic attacks and protocol downgrade
techniques that can expose plaintext data.
Q5. A company’s public-facing API returns detailed error messages that include stack traces and database table names when
invalid input is supplied. An attacker uses this information to craft more precise injection payloads. Which vulnerability category
does this represent?
A. Broken access control allowing horizontal privilege escalation
B. Insufficient logging and monitoring of API calls
C. Server-side request forgery targeting internal resources
D. Security misconfiguration exposing sensitive diagnostic information
Correct Answer: D
Rationale: Verbose error messages that reveal internal structure are a classic security misconfiguration. They reduce the attacker’s
reconnaissance effort and increase the success rate of subsequent exploits.
CompTIA Security+ Exam 2026/2027 | CompTIA | Complete Review | Page 2
, Q6. An organization finds that several workstations have been infected with ransomware that encrypts files and demands
payment in cryptocurrency. Forensic analysis shows the initial infection vector was a malicious macro in a document opened
from a phishing email. Which mitigation would have been most effective at preventing the initial execution?
A. Increasing the password complexity requirements for all users
B. Disabling the corporate VPN for remote workers
C. Implementing application allow-listing that blocks unauthorized macros and scripts
D. Removing all antivirus software to reduce false positives
Correct Answer: C
Rationale: Application allow-listing and macro controls prevent untrusted code from executing even if a user opens a malicious document.
Password complexity and VPN settings do not address the code-execution vector.
Q7. A threat actor gains initial access to a network through a compromised VPN credential and then moves laterally by
exploiting an unpatched remote-code-execution vulnerability on an internal file server. Which combination of tactics from the
MITRE ATT&CK; framework best describes this activity?
A. Initial Access followed by Lateral Movement
B. Persistence followed by Exfiltration
C. Defense Evasion followed by Impact only
D. Discovery followed by Collection exclusively
Correct Answer: A
Rationale: Compromised credentials represent Initial Access; exploiting an internal vulnerability to reach other systems is Lateral Movement.
Both tactics are central to many modern intrusion campaigns.
Q8. Security researchers publish a zero-day vulnerability affecting a widely used enterprise VPN appliance. Within hours,
multiple organizations report active exploitation. Which term best describes this situation?
A. An advanced persistent threat that has remained undetected for years
B. A vulnerability that is being actively exploited in the wild before a patch is available
C. A false positive generated by signature-based detection systems
D. A supply-chain compromise of the VPN vendor’s build system only
Correct Answer: B
Rationale: A zero-day that is already being used by attackers is an actively exploited vulnerability. Organizations must rely on compensating
controls until a vendor patch or mitigation is released.
Q9. An attacker sends a specially crafted packet to a network service that causes the service to crash and become unavailable
to legitimate users. No authentication was required. Which type of attack has occurred?
A. Privilege escalation to gain administrative rights
B. Denial-of-service attack exploiting a vulnerability in the service
C. Man-in-the-middle attack intercepting session tokens
D. Replay attack reusing a previous authentication message
Correct Answer: B
Rationale: Crashing a service so that it cannot respond to legitimate requests is a classic denial-of-service condition, often achieved by
exploiting an unhandled exception or resource exhaustion flaw.
Q10. A developer hard-codes a database connection string containing a privileged username and password into the source
code of a web application. The code is later committed to a public repository. Which risk has been introduced?
A. Insecure cryptographic storage of session tokens
B. Cross-site scripting through the connection string parameter
C. Broken function-level authorization on administrative endpoints
D. Exposure of credentials leading to potential unauthorized database access
Correct Answer: D
Rationale: Hard-coded credentials in source code, especially when the repository becomes public, give attackers a direct path to the database.
Secrets must be stored outside the codebase and rotated if exposed.
CompTIA Security+ Exam 2026/2027 | CompTIA | Complete Review | Page 3
