CompTIA Security+ PREPARATION TEST
2026 QUESTIONS AND CORRECT ANSWERS
GRADED A+
● A. A worm Answer: A security operations center (SOC) analyst
investigates the propagation of a memory-resident virus across the
network and notices a rapid consumption of network bandwidth, causing
a Denial of Service (DoS). What type of virus is this?
A. A worm
B. A program virus
C. A multipartite virus
D. A macro virus
● D. PUP Answer: A user purchased a laptop from a local computer
shop. After powering on the laptop for the first time, the user noticed a
few programs like Norton Antivirus asking for permission to install.
How would an IT security specialist classify these programs?
A. Virus
B. Trojans
C. Ransomware
D. PUP
● A. Uses lightweight shellcode
,B. Uses low observable characteristic attacks Answer: A fileless
malicious software can replicate between processes in memory on a
local host or over network shares. What other behaviors and techniques
would classify malware as fileless rather than a normal virus? (Select all
that apply.)
A. Uses lightweight shellcode
B. Uses low observable characteristic attacks
C. Uses compiled executables to evade detection
D. Writes code to disk
● B. Computer Bots
D. Command & Control Answer: An attacker is planning to set up a
backdoor that will infect a set of specific computers at an organization,
to inflict a set of other intrusion attacks remotely. Which of the
following will support the attackers' plan? (Select all that apply.)
A. Crypto Malware
B. Computer Bots
C. Skimming
D. Command & Control
● D. Establish a connection with a Command and Control server
Answer: If a user's computer becomes infected with a botnet, which of
the following can this compromise allow the attacker to do? (Select all
that apply.)
A. Launch a Distributed Denial of Service (DDoS) attack
, B. Launch a tailgating attack
C. Launch a mass-mail spam attack
D. Establish a connection with a Command and Control server
● C. Have up-to-date backups. Answer: If a user's device becomes
infected with crypto-malware, which of the following is the best way to
mitigate this compromise?
A. Pay the ransom.
B. Remove the infection with antivirus.
C. Have up-to-date backups.
D. Update the operating system after the infection.
● A. A logic bomb Answer: A security specialist discovers a malicious
script on a computer. The script is set to execute if the administrator's
account becomes disabled. What type of malware did the specialist
discover?
A. A logic bomb
B. A worm
C. Crypto-malware
D. A Remote Access Trojan (RAT)
● B. Spyware infected the computers. Answer: End-users at an
organization contact the cybersecurity department. After downloading a
file, they are being redirected to shopping websites they did not intend to
2026 QUESTIONS AND CORRECT ANSWERS
GRADED A+
● A. A worm Answer: A security operations center (SOC) analyst
investigates the propagation of a memory-resident virus across the
network and notices a rapid consumption of network bandwidth, causing
a Denial of Service (DoS). What type of virus is this?
A. A worm
B. A program virus
C. A multipartite virus
D. A macro virus
● D. PUP Answer: A user purchased a laptop from a local computer
shop. After powering on the laptop for the first time, the user noticed a
few programs like Norton Antivirus asking for permission to install.
How would an IT security specialist classify these programs?
A. Virus
B. Trojans
C. Ransomware
D. PUP
● A. Uses lightweight shellcode
,B. Uses low observable characteristic attacks Answer: A fileless
malicious software can replicate between processes in memory on a
local host or over network shares. What other behaviors and techniques
would classify malware as fileless rather than a normal virus? (Select all
that apply.)
A. Uses lightweight shellcode
B. Uses low observable characteristic attacks
C. Uses compiled executables to evade detection
D. Writes code to disk
● B. Computer Bots
D. Command & Control Answer: An attacker is planning to set up a
backdoor that will infect a set of specific computers at an organization,
to inflict a set of other intrusion attacks remotely. Which of the
following will support the attackers' plan? (Select all that apply.)
A. Crypto Malware
B. Computer Bots
C. Skimming
D. Command & Control
● D. Establish a connection with a Command and Control server
Answer: If a user's computer becomes infected with a botnet, which of
the following can this compromise allow the attacker to do? (Select all
that apply.)
A. Launch a Distributed Denial of Service (DDoS) attack
, B. Launch a tailgating attack
C. Launch a mass-mail spam attack
D. Establish a connection with a Command and Control server
● C. Have up-to-date backups. Answer: If a user's device becomes
infected with crypto-malware, which of the following is the best way to
mitigate this compromise?
A. Pay the ransom.
B. Remove the infection with antivirus.
C. Have up-to-date backups.
D. Update the operating system after the infection.
● A. A logic bomb Answer: A security specialist discovers a malicious
script on a computer. The script is set to execute if the administrator's
account becomes disabled. What type of malware did the specialist
discover?
A. A logic bomb
B. A worm
C. Crypto-malware
D. A Remote Access Trojan (RAT)
● B. Spyware infected the computers. Answer: End-users at an
organization contact the cybersecurity department. After downloading a
file, they are being redirected to shopping websites they did not intend to
