Download CompTIA Security+ Exam Practice Questions 2025: 600+ Updated SY0-701 Practice Tests and more Exams Computer Security in PDF only on Docsity!
CompTIA Security+ Exam Practice Questions
2025: 600+ Updated SY0-701 Practice Tests with
Detailed Answers, Explanations, and Domain-
Based Coverage for Certification Success
Here are the multiple-choice questions with rationales and the correct answers indicated: Question 1: An organization needs to implement a large PKI. Network engineers are concerned that repeated transmission of the OCSP will impact network performance. Which of the following should the security analyst recommend in lieu of an OCSP? A. CSR B. CRL - Correct Answer C. CA D. OID Rationale:
- B. CRL (Certificate Revocation List): A CRL is a list of revoked digital certificates. Instead of real-time OCSP (Online Certificate Status Protocol) queries, clients can periodically download and check the CRL locally to determine the revocation status of a certificate. This reduces the network traffic associated with frequent OCSP requests.
- A. CSR (Certificate Signing Request): A CSR is a message sent to a Certificate Authority to apply for a digital certificate.
- C. CA (Certificate Authority): A CA is a trusted entity that issues digital certificates.
- D. OID (Object Identifier): An OID is a unique identifier used in various standards, including X.509 certificates. Question 2: When considering a third-party cloud service provider, which of the following criteria would be the BEST to include in the security assessment process? (Select two.)
A. Use of performance analytics B. Adherence to regulatory compliance - Correct Answer C. Data retention policies - Correct Answer D. Size of the corporation E. Breadth of applications support Rationale:
- B. Adherence to regulatory compliance: Ensuring the cloud provider adheres to relevant industry regulations (e.g., HIPAA, GDPR, SOC 2) is crucial for legal and security reasons, especially when handling sensitive data.
- C. Data retention policies: Understanding how the cloud provider stores, retains, and eventually disposes of data is critical for compliance, data governance, and mitigating potential data leakage risks.
- A. Use of performance analytics: While performance is important, security assessment should prioritize security-related criteria.
- D. Size of the corporation: The size of the corporation doesn't directly correlate with its security practices. Smaller providers can have robust security, and large ones can have vulnerabilities.
- E. Breadth of applications support: The range of applications supported is more relevant to functionality than inherent security. Question 3: Which of the following occurs when the security of a web application relies on JavaScript for input validation? A. The integrity of the data is at risk. - Correct Answer B. The security of the application relies on antivirus. C. A host-based firewall is required. D. The application is vulnerable to race conditions. Rationale:
- A. The integrity of the data is at risk: Relying solely on client-side JavaScript for input validation is insecure. Attackers can easily bypass JavaScript controls by disabling it in their browser or by sending malicious requests directly to the server. This can lead to invalid or malicious data being submitted, compromising the integrity of the application's data.
- C. Integer overflow: An integer overflow occurs when an arithmetic operation results in a value that exceeds the maximum value that can be stored in the integer type. This is not apparent in the given code.
- D. Backdoor: A backdoor is a hidden entry point into a program that allows unauthorized access. The code snippet doesn't intentionally create a backdoor. Question 5: An organization's file server has been virtualized to reduce costs. Which of the following types of backups would be MOST appropriate for the particular file server? A. Snapshot B. Full C. Incremental - Correct Answer D. Differential Rationale:
- C. Incremental: For a virtualized file server, incremental backups are often the most efficient and appropriate for regular backups after an initial full backup. Incremental backups only copy the data that has changed since the last backup (either full or incremental), resulting in smaller backup sizes and faster backup times. Snapshots are useful for quick recovery but are not true backups and often reside on the same storage. Full backups can be resource-intensive, and differential backups grow larger over time.
- A. Snapshot: Snapshots capture the state of a VM at a specific point in time. While useful for quick rollbacks, they are not typically considered long-term backups and usually reside on the same storage as the VM, making them vulnerable to storage-level failures.
- B. Full: Full backups copy all data every time. While comprehensive, they consume more storage and take longer to complete, especially for large file servers.
- D. Differential: Differential backups copy all data that has changed since the last full backup. They are larger and take longer than incremental backups after several cycles. Question 6: A wireless network uses a RADIUS server that is connected to an authenticator, which in turn connects to a supplicant. Which of the following represents the authentication architecture in use?
A. Open systems authentication B. Captive portal C. RADIUS federation D. 802.1x - Correct Answer Rationale:
- D. 802.1x: The description of a supplicant (client), authenticator (access point or switch), and an authentication server (RADIUS) is the standard architecture for 802.1x port-based network access control. 802.1x provides a framework for authenticating users or devices before granting them access to the network.
- A. Open systems authentication: Open systems authentication is a basic authentication method in wireless networks that doesn't provide strong security.
- B. Captive portal: A captive portal is a web page that users are redirected to upon connecting to a network, often used for guest Wi-Fi authentication and acceptance of terms. While it might use RADIUS in the backend, the core architecture described is 802.1x.
- C. RADIUS federation: RADIUS federation involves allowing users from one organization to authenticate to the network of another organization using their home realm's RADIUS infrastructure. Question 7: An employer requires that employees use a key-generating app on their smartphones to log into corporate applications. In terms of authentication of an individual, this type of access policy is BEST defined as: A. Something you have. - Correct Answer B. Something you know. C. Something you do. D. Something you are. Rationale:
- A. Something you have: A key-generating app on a smartphone is a physical possession of the user. This type of authentication factor is categorized as something you have, referring to a token or device in the user's possession that generates a time-sensitive code for login.
- B. Something you know: This refers to knowledge-based authentication, such as passwords or security questions.
D. Install a certificate signed by a public CA. E. Configure the web server to use a host header. Rationale:
- A. Install an X- 509 - compliant certificate: X.509 is the standard format for digital certificates used in PKI. Installing such a certificate is essential for establishing a certificate-based secure session.
- C. Enable and configure TLS on the server: TLS (Transport Layer Security) is the cryptographic protocol that provides secure communication over a network. Enabling and properly configuring the latest version of TLS (e.g., TLS 1.3) is crucial for utilizing the latest security techniques and standards for secure web sessions.
- B. Implement a CRL using an authorized CA: Implementing a CRL is important for certificate revocation checking, but installing the certificate and enabling TLS are more fundamental to establishing the secure, certificate-based session.
- D. Install a certificate signed by a public CA: While a public CA certificate can be used, the requirement specifies using the organization's PKI infrastructure, implying a certificate issued by their internal CA.
- E. Configure the web server to use a host header: Host headers are used in HTTP to specify which website should be served by a web server hosting multiple sites. While important for functionality, it's not directly related to establishing a secure, certificate-based session using TLS. A manager wants to distribute a report to several other managers within the company. Some of them reside in remote locations that are not connected to the domain but have a local server. Because there is sensitive data within the report and the size of the report is beyond the limit of the email attachment size, emailing the report is not an option. Which of the following protocols should be implemented to distribute the report securely? (Select three.) A. S/MIME B. SSH C. SNMPv D. FTPS E. SRTP
F. HTTPS
G. LDAPS - - correct ans- - B. SSH D. FTPS F. HTTPS An auditor is reviewing the following output from a password-cracking tool: user : 1 : Password user2 : Recovery! user3 : Alaskan user4 : 4Private user5 : PerForMance Which of the following methods did the author MOST likely use? A. Hybrid B. Dictionary C. Brute force D. Rainbow table - - correct ans- - A. Hybrid Which of the following must be intact for evidence to be admissible in court? A. Chain of custody B. Order of violation C. Legal hold D. Preservation - - correct ans- - A. Chain of custody
A new firewall has been places into service at an organization. However, a configuration has not been entered on the firewall. Employees on the network segment covered by the new firewall report they are unable to access the network. Which of the following steps should be completed to BEST resolve the issue? A. The firewall should be configured to prevent user traffic form matching the implicit deny rule. B. The firewall should be configured with access lists to allow inbound and outbound traffic. C. The firewall should be configured with port security to allow traffic. D. The firewall should be configured to include an explicit deny rule. - - correct ans- - A. The firewall should be configured to prevent user traffic form matching the implicit deny rule. Which of the following are the MAIN reasons why a systems administrator would install security patches in a staging environment before the patches are applied to the production server? (Select two.) A. To prevent server availability issues B. To verify the appropriate patch is being installed C. To generate a new baseline hash after patching D. To allow users to test functionality E. To ensure users are trained on new functionality - - correct ans- - A,D A Chief Information Officer (CIO) drafts an agreement between the organization and its employees. The agreement outlines ramifications for releasing information without consent and/ for approvals. Which of the following BEST describes this type of agreement? A. ISA B. NDA C. MOU
D. SLA - - correct ans- - B. NDA Which of the following would meet the requirements for multifactor authentication? A. Username, PIN, and employee ID number B. Fingerprint and password C. Smart card and hardware token D. Voice recognition and retina scan - - correct ans- - B. Fingerprint and password A manager suspects that an IT employee with elevated database access may be knowingly modifying financial transactions for the benefit of a competitor. Which of the following practices should the manager implement to validate the concern? A. Separation of duties B. Mandatory vacations C. Background checks D. Security awareness training - - correct ans- - A. Separation of duties A penetration tester finds that a company's login credentials for the email client were being sent in clear text. Which of the following should be done to provide encrypted logins to the email server? A. Enable IPSec and configure SMTP. B. Enable SSH and LDAP credentials. C. Enable MIME services and POP3. D. Enable an SSL certificate for IMAP services. - - correct ans- - D. Enable an SSL certificate for IMAP services.
A. Black box B. Regression C. White box D. Fuzzing - - correct ans- - C. White box A dumpster diver recovers several hard drives from a company and is able to obtain confidential data from one of the hard drives. The company then discovers its information is posted online. Which of the following methods would have MOST likely prevented the data from being exposed? A. Removing the hard drive from its enclosure B. Using software to repeatedly rewrite over the disk space C. Using Blowfish encryption on the hard drives D. Using magnetic fields to erase the data - - correct ans- - D. Using magnetic fields to erase the data Which of the following are methods to implement HA in a web application server environment? (Select two.) A. Load balancers B. Application layer firewalls C. Reverse proxies D. VPN concentrators E. Routers - - correct ans- - A. Load balancers B. Application layer firewalls An application developer is designing an application involving secure transports from one service to another that will pass over port 80 for a request.
Which of the following secure protocols is the developer MOST likely to use? A. FTPS B. SFTP C. SSL D. LDAPS - - correct ans- - C. SSL Which of the following precautions MINIMIZES the risk from network attacks directed at multifunction printers, as well as the impact on functionality at the same time? A. Isolating the systems using VLANs B. Installing a software-based IPS on all devices C. Enabling full disk encryption D. Implementing a unique user PIN access functions - - correct ans- - A. Isolating the systems using VLANs After an identified security breach, an analyst is tasked to initiate the IR process. Which of the following is the NEXT step the analyst should take? A. Recovery B. Identification C. Preparation D. Documentation E. Escalation - - correct ans- - B. Identification A company was recently audited by a third party. The audit revealed the company's network devices were transferring files in the clear. Which of the following protocols should the company use to transfer files?
A security analyst is performing a quantitative risk analysis. The risk analysis should show the potential monetary loss each time a threat or event occurs. Given this requirement, which of the following concepts would assist the analyst in determining this value? (Select two.) A. ALE B. AV C. ARO D. EF E. ROI - - correct ans- - B. AV D. EF Which of the following AES modes of operation provide authentication? (Select two.) A. CCM B. CBC C. GCM D. DSA E. CFB - - correct ans- - A. CCM C. GCM A security engineer is configuring a wireless network that must support mutual authentication of the wireless client and the authentication server before users provide credentials. The wireless network must also support authentication with usernames and passwords. Which of the following authentication protocols MUST the security engineer select? A. EAP-FAST
B. EAP-TLS
C. PEAP
D. EAP - - correct ans- - C. PEAP Which of the following vulnerability types would the type of hacker known as a script kiddie be MOST dangerous against? A. Passwords written on the bottom of a keyboard B. Unpatched exploitable Internet-facing services C. Unencrypted backup tapes D. Misplaced hardware token - - correct ans- - B. Unpatched exploitable Internet-facing services An in-house penetration tester is using a packet capture device to listen in on network communications. This is an example of: A. Passive reconnaissance B. Persistence C. Escalation of privileges D. Exploiting the switch - - correct ans- - A. Passive reconnaissance A black hat hacker is enumerating a network and wants to remain convert during the process. The hacker initiates a vulnerability scan. Given the task at hand the requirement of being convert, which of the following statements BEST indicates that the vulnerability scan meets these requirements? A. The vulnerability scanner is performing an authenticated scan. B. The vulnerability scanner is performing local file integrity checks. C. The vulnerability scanner is performing in network sniffer mode.
B. End-of-life system C. Weak cipher suite D. Zero-day threats - - correct ans- - B. End-of-life system An organization uses SSO authentication for employee access to network resources. When an employee resigns, as per the organization's security policy, the employee's access to all network resources is terminated immediately. Two weeks later, the former employee sends an email to the help desk for a password reset to access payroll information from the human resources server. Which of the following represents the BEST course of action? A. Approve the former employee's request, as a password reset would give the former employee access to only the human resources server. B. Deny the former employee's request, since the password reset request came from an external email address. C. Deny the former employee's request, as a password reset would give the employee access to all network resources. D. Approve the former employee's request, as there would not be a security issue with the former employee gaining access to netwo - - correct ans- - C. Deny the former employee's request, as a password reset would give the employee access to all network resources. Joe, a user, wants to send Ann, another user, a confidential document electronically. Which of the following should Joe do to ensure the document is protected from eavesdropping? A. Encrypt it with Joe's private key B. Encrypt it with Joe's public key C. Encrypt it with Ann's private key D. Encrypt it with Ann's public key - - correct ans- - D. Encrypt it with Ann's public key
A director of IR is reviewing a report regarding several recent breaches. The director compiles the following statistic's
- Initial IR engagement time frame
- Length of time before an executive management notice went out
- Average IR phase completion The director wants to use the data to shorten the response time. Which of the following would accomplish this? A. CSIRT B. Containment phase C. Escalation notifications D. Tabletop exercise - - correct ans- - D. Tabletop exercise To reduce disk consumption, an organization's legal department has recently approved a new policy setting the data retention period for sent email at six months. Which of the following is the BEST way to ensure this goal is met? A. Create a daily encrypted backup of the relevant emails. B. Configure the email server to delete the relevant emails. C. Migrate the relevant emails into an "Archived" folder. D. Implement automatic disk compression on email servers. - - correct ans- - A. Create a daily encrypted backup of the relevant emails. A security administrator is configuring a new network segment, which contains devices that will be accessed by external users, such as web and FTP server. Which of the following represents the MOST secure way to configure the new network segment? A. The segment should be placed on a separate VLAN, and the firewall rules should be configured to allow external traffic. B. The segment should be placed in the existing internal VLAN to allow internal traffic only.
