CompTIA Security+ Certification: Security Operations

Question 1

Which of the following best describes the concept of non-repudiation?

A. Ensuring data is only accessible to authorized users

B. Ensuring a party cannot deny having performed an action

C. Ensuring data has not been altered in transit

D. Ensuring systems remain available during an attack

Explanation: Non-repudiation ensures that a party cannot later deny having sent a message or performed an action, typically achieved through digital signatures and audit logs that provide verifiable proof of origin.

Question 2

Which of the three principles of the CIA triad is primarily supported by hashing?

A. Confidentiality

B. Integrity

C. Availability

D. Authentication

Explanation: Hashing produces a fixed-size digest that changes if the underlying data is altered, making it a primary tool for verifying data integrity rather than confidentiality or availability.

Question 3

A security administrator wants to ensure that no single employee can both create and approve a purchase order. Which control does this represent?

A. Least privilege

B. Separation of duties

C. Job rotation

D. Mandatory vacation

Explanation: Separation of duties divides critical tasks among multiple people so that no single individual has enough control to commit fraud or errors without collusion, reducing insider risk.

Question 4

Which type of control is a security awareness training program considered?

A. Technical

B. Physical

C. Managerial

D. Operational

Explanation: Operational controls are implemented and executed by people in day-to-day processes, such as security awareness training, rather than through technology (technical) or policy-setting (managerial).

Question 5

Which cryptographic concept ensures that if a long-term key is compromised, past session keys remain secure?

A. Key stretching

B. Perfect forward secrecy

C. Salting

D. Key escrow

Explanation: Perfect forward secrecy generates unique, ephemeral session keys for each session so that compromising a server's long-term private key does not expose previously recorded encrypted sessions.

Question 6

An organization implements a policy requiring employees to use a badge, a PIN, and a fingerprint scan to enter a secure data center. This is an example of which concept?

A. Single-factor authentication

B. Multifactor authentication

C. Federation

D. Single sign-on

Explanation: Multifactor authentication requires two or more independent categories of credentials, such as something you have (badge), something you know (PIN), and something you are (fingerprint), to strengthen identity verification.

Question 7

Which of the following best describes a compensating control?

A. A control that directly prevents an incident

B. A control implemented after an incident to prevent recurrence

C. An alternative control used when a primary control cannot be implemented

D. A control designed to detect anomalies

Explanation: A compensating control is put in place as a substitute when the primary recommended control is impractical or too costly to implement, while still addressing the associated risk to an acceptable level.

Question 8

Which of the following is the primary purpose of a certificate authority in a PKI system?

A. Encrypting data at rest

B. Issuing and validating digital certificates

C. Generating symmetric session keys

D. Managing firewall rules

Explanation: A certificate authority (CA) is a trusted entity responsible for issuing, signing, and revoking digital certificates, which bind public keys to verified identities within a public key infrastructure.

Question 9

Symmetric encryption is generally faster than asymmetric encryption for large volumes of data.

A. True

B. False

Explanation: Symmetric encryption uses a single shared key and simpler mathematical operations, making it significantly faster than asymmetric encryption, which relies on more computationally intensive key-pair operations.

Question 10

Which authentication factor category does a smart card belong to?

A. Something you know

B. Something you have

C. Something you are

D. Somewhere you are

Explanation: A smart card is a physical token the user must possess to authenticate, placing it in the "something you have" category, distinct from knowledge-based or biometric factors.

Question 11

Which access control model assigns permissions based on job function within an organization?

A. Discretionary access control (DAC)

B. Mandatory access control (MAC)

C. Role-based access control (RBAC)

D. Rule-based access control

Explanation: Role-based access control assigns permissions to predefined roles that correspond to job functions, and users are granted access by being assigned to the appropriate role rather than individually.

Question 12

What is the primary purpose of a honeypot?

A. To encrypt sensitive traffic

B. To lure and study attackers in an isolated, monitored environment

C. To back up critical data

D. To authenticate remote users

Explanation: A honeypot is a decoy system designed to appear as an attractive target, allowing security teams to observe attacker behavior and techniques in a controlled, isolated environment without risking production systems.

Question 13

Zero trust architecture assumes that all users and devices, whether inside or outside the network, must be verified before being granted access.

A. True

B. False

Explanation: Zero trust operates on the principle of "never trust, always verify," requiring continuous authentication and authorization for every access request regardless of whether it originates inside or outside the traditional network perimeter.

Question 14

Which term describes the amount of risk an organization is willing to accept before taking action to reduce it?

A. Risk appetite

B. Risk tolerance

C. Risk transfer

D. Risk avoidance

Explanation: Risk tolerance refers to the specific, measurable level of risk exposure an organization is willing to accept in a given area before action must be taken, operationalizing the broader concept of risk appetite.

Question 15

Which of the following best describes the purpose of change management processes?

A. To eliminate all system downtime

B. To ensure changes are reviewed, tested, and approved before implementation

C. To automatically deploy all software updates

D. To replace the need for security patches

Explanation: Change management establishes a formal, documented process for proposing, reviewing, testing, and approving changes to IT systems, reducing the risk of unintended outages or security gaps caused by unvetted changes.

Question 16

A digital signature primarily provides which two security properties?

A. Confidentiality and availability

B. Integrity and non-repudiation

C. Authorization and accounting

D. Obfuscation and redundancy

Explanation: A digital signature is created by hashing a message and encrypting the hash with the sender's private key; this proves the message has not been altered (integrity) and confirms who sent it (non-repudiation).

Question 17

Which encryption approach uses the same key for both encryption and decryption?

A. Asymmetric encryption

B. Symmetric encryption

C. Hashing

D. Elliptic curve cryptography exclusively

Explanation: Symmetric encryption algorithms, such as AES, use a single shared secret key for both encrypting and decrypting data, requiring that key to be securely distributed to all parties involved.

Question 18

Which of the following best defines the principle of least privilege?

A. Users should be granted the minimum access necessary to perform their job

B. Users should periodically rotate through different job roles

C. Users should never be granted administrative access

D. Users should share credentials for auditing purposes

Explanation: The principle of least privilege dictates that users, applications, and systems should be granted only the minimum level of access required to perform their necessary functions, limiting the potential impact of a compromised account.

Question 19

What is the primary function of a hardware security module (HSM)?

A. To physically secure the server room

B. To generate, store, and manage cryptographic keys securely

C. To filter network traffic based on rules

D. To monitor employee productivity

Explanation: A hardware security module is a dedicated, tamper-resistant physical device used to securely generate, store, and manage cryptographic keys, offloading sensitive key operations from general-purpose servers.

Question 20

Salting a password hash primarily protects against which type of attack?

A. Denial-of-service attacks

B. Rainbow table attacks

C. Man-in-the-middle attacks

D. SQL injection attacks

Explanation: Salting adds a unique random value to each password before hashing, ensuring identical passwords produce different hashes; this defeats precomputed rainbow table attacks that rely on matching known hash values.

Question 21

Federation allows a user to access multiple, independently managed systems using a single set of credentials issued by a trusted identity provider.

A. True

B. False

Explanation: Federation establishes trust relationships between separate organizations or systems, allowing an identity provider to authenticate a user once and share that assertion with multiple relying parties without separate logins.

Question 22

Which of the following is an example of a physical security control?

A. Firewall rule

B. Bollard

C. Security policy

D. Access control list

Explanation: Bollards are sturdy physical posts installed to prevent vehicles from ramming into a building or restricted area, making them a physical control category distinct from technical or managerial controls.

Question 23

Which of the following best describes the purpose of a business impact analysis (BIA)?

A. To identify and prioritize critical business functions and the impact of their disruption

B. To assign encryption standards for sensitive data

C. To configure firewall access control lists

D. To train employees on phishing recognition

Explanation: A business impact analysis identifies critical business processes and quantifies the operational and financial impact of their disruption, informing recovery time objectives and priorities within a business continuity plan.

Question 24

Which term refers to the maximum acceptable amount of data loss measured in time?

A. Recovery time objective (RTO)

B. Recovery point objective (RPO)

C. Mean time to repair (MTTR)

D. Mean time between failures (MTBF)

Explanation: The recovery point objective defines the maximum tolerable period during which data might be lost due to an incident, directly informing how frequently backups must be taken to meet business requirements.

Question 25

Which of the following describes a gap analysis in a security context?

A. Comparing current security posture against a desired or required standard to identify deficiencies

B. Testing network bandwidth utilization

C. Reviewing firewall logs for anomalies

D. Measuring employee satisfaction with IT services

Explanation: A gap analysis compares an organization's current controls and practices against a target framework, regulation, or best-practice baseline, highlighting areas that need improvement to close identified deficiencies.

Question 26

Which of the following best describes an air-gapped network?

A. A network segmented using VLANs only

B. A network physically isolated from unsecured networks, including the internet

C. A network protected solely by a next-generation firewall

D. A wireless network using WPA3 encryption

Explanation: An air-gapped network has no physical or logical connection to unsecured networks such as the internet, providing a high level of isolation often used to protect highly sensitive systems like industrial control systems.

Question 27

Obfuscation is a technique used to make code or data difficult to understand in order to protect it from analysis.

A. True

B. False

Explanation: Obfuscation intentionally makes code, data, or logic more difficult to interpret or reverse-engineer, which can help protect intellectual property or make malware analysis more challenging for defenders, though it is not true encryption.

Question 28

Which of the following best describes tokenization?

A. Replacing sensitive data with a non-sensitive placeholder that maps back to the original value in a secure system

B. Converting plaintext into ciphertext using a reversible cipher

C. Hashing data with a random salt

D. Compressing data to save storage space

Explanation: Tokenization substitutes sensitive data, such as a credit card number, with a non-sensitive token that has no exploitable value outside the tokenization system, which securely maps tokens back to original values when needed.

Question 29

Which of the following is the best description of a security baseline?

A. A documented set of minimum security configuration standards for a system or device

B. A one-time penetration test report

C. A list of all company assets

D. An incident response communication plan

Explanation: A security baseline defines the minimum acceptable security configuration settings for a given system type, providing a consistent standard against which deployed systems can be measured and hardened.

Question 30

Data masking is commonly used to protect sensitive data in which type of environment?

A. Production environments only

B. Non-production environments such as testing and development

C. Physical archive storage

D. Network perimeter devices

Explanation: Data masking obscures or replaces sensitive values with realistic but fictitious data, commonly used in test and development environments so developers can work with representative data without exposing real sensitive information.

Question 31

Which of the following best describes the concept of defense in depth?

A. Relying on a single, highly effective security control

B. Layering multiple, overlapping security controls to protect assets

C. Outsourcing all security functions to a third party

D. Encrypting all data regardless of sensitivity

Explanation: Defense in depth applies multiple layers of security controls, such as firewalls, endpoint protection, and access controls, so that if one layer fails or is bypassed, additional layers continue to provide protection.

Question 32

Which of the following best describes an attribute-based access control (ABAC) model?

A. Access decisions are based on a combination of user, resource, and environmental attributes

B. Access decisions are based solely on job title

C. Access decisions are made entirely by the resource owner

D. Access decisions never change once set

Explanation: Attribute-based access control evaluates a flexible combination of attributes, such as user department, resource classification, time of day, and location, to make dynamic, context-aware access decisions.

Question 33

Which of the following is the primary purpose of an acceptable use policy (AUP)?

A. To define encryption standards for the organization

B. To outline how employees are permitted to use company systems and resources

C. To specify network IP addressing schemes

D. To document disaster recovery procedures

Explanation: An acceptable use policy sets clear expectations and rules for how employees may use organizational systems, networks, and data, helping to reduce misuse and clarify consequences for policy violations.

Question 34

Which of the following best describes a memorandum of understanding (MOU)?

A. A legally binding contract specifying financial penalties

B. A document expressing mutual intent between two parties without necessarily being legally binding

C. A technical document describing network architecture

D. A formal incident response report

Explanation: A memorandum of understanding outlines a mutual understanding and intended cooperation between two or more parties, often used to define expectations before finalizing a more detailed and legally binding agreement.

Question 35

Which of the following describes the concept of a single point of failure?

A. A component whose failure would cause the entire system to stop functioning

B. A redundant power supply

C. A load-balanced server cluster

D. A backup data center

Explanation: A single point of failure is any component, whether hardware, software, or process, whose failure alone would cause an entire system or service to become unavailable, making redundancy critical to eliminate such risks.

Question 36

Which cryptographic technique combines a public and private key pair to enable secure communication without pre-sharing a secret key?

A. Symmetric encryption

B. Asymmetric encryption

C. Hashing

D. Steganography

Explanation: Asymmetric encryption uses a mathematically linked key pair, a public key for encryption and a private key for decryption, allowing secure communication between parties who have never exchanged a shared secret in advance.

Question 37

Which of the following best describes steganography?

A. Hiding data within another file or medium to conceal its existence

B. Converting data into an unreadable format using a key

C. Verifying the integrity of a file using a checksum

D. Distributing a workload across multiple servers

Explanation: Steganography conceals the very existence of a message by embedding it within another file, such as an image or audio file, differing from encryption, which scrambles content but does not hide its presence.

Question 38

Which type of site provides a fully equipped, ready-to-operate facility that can be activated almost immediately after a disaster?

A. Cold site

B. Warm site

C. Hot site

D. Cloud site only

Explanation: A hot site is a fully configured alternate facility with up-to-date data and operational systems, allowing an organization to resume critical operations almost immediately following a disaster, at a higher ongoing cost than warm or cold sites.

Question 39

Which of the following best describes the purpose of a data classification scheme?

A. To determine network bandwidth allocation

B. To categorize data based on sensitivity to apply appropriate protection levels

C. To assign IP addresses to devices

D. To schedule software updates

Explanation: Data classification schemes categorize information, such as public, internal, confidential, and restricted, so that appropriate handling, access, and protection controls can be applied based on the data's sensitivity and value.

Question 40

Which of the following is an example of an administrative (managerial) control?

A. A security policy requiring annual risk assessments

B. A firewall access control list

C. A fence around the data center

D. A biometric door lock

Explanation: Managerial controls consist of policies, procedures, and governance decisions, such as requiring periodic risk assessments, that guide how an organization manages its overall security program.

Question 41

Which of the following best describes key stretching?

A. Extending the length of a network cable

B. Applying an algorithm repeatedly to a key or password to increase the time required for brute-force attacks

C. Sharing a key among multiple recipients

D. Compressing a key to reduce storage size

Explanation: Key stretching techniques, such as PBKDF2 or bcrypt, deliberately apply a hashing or derivation function many times over, significantly increasing the computational effort required for an attacker to brute-force a weak password or key.

Question 42

Which of the following best describes a service-level agreement (SLA)?

A. A contract that defines the expected level of service, including uptime and response times, between a provider and customer

B. A document outlining employee acceptable use of the internet

C. A technical diagram of network topology

D. An internal audit report

Explanation: A service-level agreement formally defines the measurable performance standards, such as uptime guarantees and support response times, that a service provider commits to delivering to a customer.

Question 43

Which of the following best explains the purpose of a certificate revocation list (CRL)?

A. A list of approved software vendors

B. A published list of digital certificates that have been revoked before their expiration date

C. A list of blocked IP addresses on a firewall

D. A record of failed login attempts

Explanation: A certificate revocation list is maintained and published by a certificate authority to inform relying parties which previously issued certificates should no longer be trusted, such as those compromised or improperly issued.

Question 44

Which of the following best describes the term "attack surface"?

A. The total sum of all possible points where an unauthorized user could attempt to enter or extract data from a system

B. The physical footprint of a data center

C. The number of employees with administrative access

D. The total storage capacity of a network

Explanation: The attack surface encompasses every exposed entry point, including open ports, applications, APIs, and user accounts, that a threat actor could potentially exploit to gain unauthorized access to a system or network.

Question 45

Which of the following best describes the purpose of a Faraday cage in a security context?

A. To block electromagnetic signals from entering or leaving an enclosed area

B. To provide backup power during outages

C. To filter malicious network traffic

D. To store cryptographic keys securely

Explanation: A Faraday cage is an enclosure constructed of conductive material that blocks electromagnetic fields, preventing wireless signals such as Wi-Fi or cellular transmissions from entering or leaving the protected space.

Question 46

Which of the following is the best example of a preventive control?

A. An intrusion detection system (IDS)

B. A security guard reviewing access badges before allowing entry

C. A post-incident audit log review

D. A disaster recovery plan

Explanation: Preventive controls are designed to stop an incident before it occurs; a security guard verifying credentials before granting physical access actively prevents unauthorized entry rather than merely detecting or responding to it after the fact.

Question 47

Which of the following best describes the term "threat vector"?

A. The specific method or pathway a threat actor uses to gain access to a target

B. The total financial loss from a security incident

C. A list of all known vulnerabilities in a system

D. The physical location of a data breach

Explanation: A threat vector describes the specific means by which an attacker gains unauthorized access to a system or network, such as a phishing email, an unpatched vulnerability, or a compromised removable media device.

Question 48

A public key can be freely shared, while the corresponding private key must remain secret.

A. True

B. False

Explanation: In asymmetric cryptography, the public key is intended to be distributed openly for others to encrypt data or verify signatures, while the mathematically linked private key must be kept confidential by its owner to preserve security.

Question 49

Which of the following best describes the term "impact" in the context of risk assessment?

A. The likelihood that a threat will exploit a vulnerability

B. The potential magnitude of harm resulting from a realized risk

C. The cost of implementing a security control

D. The number of vulnerabilities present in a system

Explanation: Impact refers to the potential severity of harm, whether financial, operational, or reputational, that would result if a given risk were realized, and is combined with likelihood to determine overall risk level.

Question 50

Which of the following best describes quantitative risk analysis?

A. Assigning subjective ratings such as "high," "medium," or "low" to risks

B. Using numerical values and financial metrics, such as ALE, to assess risk

C. Interviewing stakeholders about perceived risk

D. Ranking risks based on gut feeling alone

Explanation: Quantitative risk analysis assigns objective, numerical values, such as single loss expectancy (SLE) and annualized loss expectancy (ALE), to calculate the financial impact of risks, contrasting with the subjective ratings used in qualitative analysis.

Question 51

Which of the following best defines annualized loss expectancy (ALE)?

A. The total cost of a single security incident

B. The expected monetary loss from a risk over the course of a year, calculated as SLE multiplied by ARO

C. The percentage of an asset's value lost in a single event

D. The frequency of an event occurring in a decade

Explanation: Annualized loss expectancy is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO), producing an estimate of the expected yearly financial impact of a specific risk.