CompTIA SECURITY + EXAM TESTBANK | ALL QUESTIONS AND
ANSWERS 2026/2027 | VERIFIED ANSWERS PLUS RATIONALES
| GRADED Q&A COMPREHENSIVE STUDY GUIDE | VERIFIED
LATEST 2027
1. A security administrator discovers that several employees are using the same local
administrator password on multiple Windows workstations. Which security principle is
MOST directly violated?
A. Non-repudiation
B. Least privilege
C. Separation of duties
D. Availability
Answer: B
Least privilege requires users and accounts to have only the permissions necessary to perform
their assigned functions. Shared administrator credentials also reduce accountability and
increase the potential impact of a compromised password.
2. A company wants to ensure that a user cannot later deny approving a financial
transaction. Which security control BEST supports this requirement?
A. Hashing
B. Encryption
C. Non-repudiation
D. Redundancy
Answer: C
Non-repudiation provides evidence that a particular entity performed an action, commonly
through mechanisms such as digital signatures, audit records, and authenticated
transactions.
3. A security analyst receives an alert indicating that an employee's workstation has
established an outbound connection to an unfamiliar IP address over TCP port 443. What
should the analyst do FIRST?
A. Investigate the connection and correlate it with endpoint and network logs
B. Immediately wipe the workstation
C. Disable every outbound firewall rule
D. Reinstall the operating system
Answer: A
,Initial investigation should establish whether the connection is legitimate and determine its
context. Correlating endpoint, DNS, firewall, and authentication data can provide evidence
before disruptive containment actions are taken.
4. Which security control is designed primarily to prevent unauthorized users from
entering a restricted server room?
A. IDS
B. SIEM
C. DLP
D. Mantrap
Answer: D
A mantrap is a physical access-control mechanism that helps prevent unauthorized individuals
from entering a secured area, often by requiring one door to close before another opens.
5. A company wants to prevent an attacker who steals a user's password from accessing
corporate resources without an additional authentication factor. Which control is BEST?
A. Password history
B. Multifactor authentication
C. Account lockout
D. CAPTCHA
Answer: B
Multifactor authentication requires authentication factors from multiple categories, such as
something the user knows, has, or is. A stolen password alone is therefore insufficient.
6. A security engineer needs to protect confidential data while it is being transmitted
between a browser and a web server. Which technology is MOST appropriate?
A. TLS
B. RAID
C. AES at rest
D. File hashing
Answer: A
TLS protects data in transit by providing encryption and integrity protection between
communicating endpoints.
7. An organization classifies information as public, internal, confidential, and restricted.
Which process is this an example of?
,A. Risk transfer
B. Data masking
C. Data classification
D. Vulnerability scanning
Answer: C
Data classification assigns sensitivity levels to information so that appropriate security
controls can be applied based on its business value and confidentiality requirements.
8. A vulnerability scanner reports that a server is running an outdated version of an
application. What is the BEST next step before applying a patch in production?
A. Ignore the finding
B. Disable the server
C. Delete the application
D. Test the patch in a controlled environment
Answer: D
Testing helps determine whether the patch resolves the vulnerability without introducing
compatibility or availability problems.
9. A company wants to reduce the likelihood that a compromised employee account can
access every internal server. Which architecture BEST supports this goal?
A. Network segmentation
B. Flat networking
C. Shared credentials
D. Open wireless access
Answer: A
Network segmentation limits lateral movement by separating systems into controlled security
zones and restricting communication between them.
10. Which type of malware encrypts a victim's files and demands payment for restoration?
A. Spyware
B. Ransomware
C. Rootkit
D. Worm
Answer: B
, Ransomware is designed to deny access to data or systems, commonly by encrypting files,
and typically demands payment from the victim.
11. A security analyst wants to identify unusual patterns across firewall, authentication,
endpoint, and application logs. Which technology is MOST suitable?
A. HSM
B. NAC
C. SIEM
D. VPN
Answer: C
A SIEM aggregates and correlates security data from multiple sources, allowing analysts to
identify events and patterns that may indicate attacks.
12. An attacker sends a fraudulent email that appears to come from the organization's
CEO and requests an urgent wire transfer. What type of attack is this?
A. Tailgating
B. Credential stuffing
C. Pharming
D. Business email compromise
Answer: D
Business email compromise uses trusted or impersonated business identities to manipulate
employees into transferring money, credentials, or sensitive information.
13. A network administrator wants to ensure that only company-managed laptops can
connect to the internal wired network. Which control is MOST appropriate?
A. Network access control
B. Load balancing
C. Port mirroring
D. DNS filtering
Answer: A
Network access control can evaluate devices before granting network access and enforce
requirements such as device ownership, security posture, and authentication.
14. Which principle requires two or more individuals to participate in a sensitive
administrative process?
ANSWERS 2026/2027 | VERIFIED ANSWERS PLUS RATIONALES
| GRADED Q&A COMPREHENSIVE STUDY GUIDE | VERIFIED
LATEST 2027
1. A security administrator discovers that several employees are using the same local
administrator password on multiple Windows workstations. Which security principle is
MOST directly violated?
A. Non-repudiation
B. Least privilege
C. Separation of duties
D. Availability
Answer: B
Least privilege requires users and accounts to have only the permissions necessary to perform
their assigned functions. Shared administrator credentials also reduce accountability and
increase the potential impact of a compromised password.
2. A company wants to ensure that a user cannot later deny approving a financial
transaction. Which security control BEST supports this requirement?
A. Hashing
B. Encryption
C. Non-repudiation
D. Redundancy
Answer: C
Non-repudiation provides evidence that a particular entity performed an action, commonly
through mechanisms such as digital signatures, audit records, and authenticated
transactions.
3. A security analyst receives an alert indicating that an employee's workstation has
established an outbound connection to an unfamiliar IP address over TCP port 443. What
should the analyst do FIRST?
A. Investigate the connection and correlate it with endpoint and network logs
B. Immediately wipe the workstation
C. Disable every outbound firewall rule
D. Reinstall the operating system
Answer: A
,Initial investigation should establish whether the connection is legitimate and determine its
context. Correlating endpoint, DNS, firewall, and authentication data can provide evidence
before disruptive containment actions are taken.
4. Which security control is designed primarily to prevent unauthorized users from
entering a restricted server room?
A. IDS
B. SIEM
C. DLP
D. Mantrap
Answer: D
A mantrap is a physical access-control mechanism that helps prevent unauthorized individuals
from entering a secured area, often by requiring one door to close before another opens.
5. A company wants to prevent an attacker who steals a user's password from accessing
corporate resources without an additional authentication factor. Which control is BEST?
A. Password history
B. Multifactor authentication
C. Account lockout
D. CAPTCHA
Answer: B
Multifactor authentication requires authentication factors from multiple categories, such as
something the user knows, has, or is. A stolen password alone is therefore insufficient.
6. A security engineer needs to protect confidential data while it is being transmitted
between a browser and a web server. Which technology is MOST appropriate?
A. TLS
B. RAID
C. AES at rest
D. File hashing
Answer: A
TLS protects data in transit by providing encryption and integrity protection between
communicating endpoints.
7. An organization classifies information as public, internal, confidential, and restricted.
Which process is this an example of?
,A. Risk transfer
B. Data masking
C. Data classification
D. Vulnerability scanning
Answer: C
Data classification assigns sensitivity levels to information so that appropriate security
controls can be applied based on its business value and confidentiality requirements.
8. A vulnerability scanner reports that a server is running an outdated version of an
application. What is the BEST next step before applying a patch in production?
A. Ignore the finding
B. Disable the server
C. Delete the application
D. Test the patch in a controlled environment
Answer: D
Testing helps determine whether the patch resolves the vulnerability without introducing
compatibility or availability problems.
9. A company wants to reduce the likelihood that a compromised employee account can
access every internal server. Which architecture BEST supports this goal?
A. Network segmentation
B. Flat networking
C. Shared credentials
D. Open wireless access
Answer: A
Network segmentation limits lateral movement by separating systems into controlled security
zones and restricting communication between them.
10. Which type of malware encrypts a victim's files and demands payment for restoration?
A. Spyware
B. Ransomware
C. Rootkit
D. Worm
Answer: B
, Ransomware is designed to deny access to data or systems, commonly by encrypting files,
and typically demands payment from the victim.
11. A security analyst wants to identify unusual patterns across firewall, authentication,
endpoint, and application logs. Which technology is MOST suitable?
A. HSM
B. NAC
C. SIEM
D. VPN
Answer: C
A SIEM aggregates and correlates security data from multiple sources, allowing analysts to
identify events and patterns that may indicate attacks.
12. An attacker sends a fraudulent email that appears to come from the organization's
CEO and requests an urgent wire transfer. What type of attack is this?
A. Tailgating
B. Credential stuffing
C. Pharming
D. Business email compromise
Answer: D
Business email compromise uses trusted or impersonated business identities to manipulate
employees into transferring money, credentials, or sensitive information.
13. A network administrator wants to ensure that only company-managed laptops can
connect to the internal wired network. Which control is MOST appropriate?
A. Network access control
B. Load balancing
C. Port mirroring
D. DNS filtering
Answer: A
Network access control can evaluate devices before granting network access and enforce
requirements such as device ownership, security posture, and authentication.
14. Which principle requires two or more individuals to participate in a sensitive
administrative process?
