Free Security+ practice test
12 original questions written by our editors against the official CompTIA exam domains. They are not real exam questions. Pick an answer to see the explanation.
-
General security concepts
A purchasing manager approves a large order by email, then later claims she never sent it. The company wants future approvals to be provably tied to the person who sent them. What should it implement?
Show answer
Answer: D. A digital signature made with a private key only the sender holds provides non-repudiation. TLS protects messages in transit but does not prove who wrote them. A hash alone shows integrity, and stronger passwords do not create proof of origin.
-
General security concepts
A security team places a fake cloud access key in a code repository. The key works for nothing, but any attempt to use it triggers an alert. What is this control called?
Show answer
Answer: A. A honeytoken is a fake credential or data item whose only purpose is to reveal misuse. A honeynet is a network of decoy systems, a sandbox isolates code for testing, and tokenization replaces sensitive data with surrogate values.
-
Threats, vulnerabilities, and mitigations
Engineers at several aerospace suppliers are infected after visiting a niche industry forum. Investigation shows attackers compromised the forum and added malicious script to it. What type of attack is this?
Show answer
Answer: C. A watering hole attack compromises a site the target group already trusts and visits. Typosquatting relies on look-alike domain names, credential stuffing reuses leaked passwords, and business email compromise uses fraudulent or hijacked email.
-
Threats, vulnerabilities, and mitigations
Authentication logs show one failed login for each of 3,000 different accounts within an hour, all from the same IP range and all using the password 'Winter2026!'. What is the most likely attack?
Show answer
Answer: B. Password spraying tries one common password against many accounts to avoid lockouts. Brute force hammers one account with many passwords. Pass-the-hash reuses captured hashes, and rainbow tables crack stolen hashes offline rather than through login attempts.
-
Threats, vulnerabilities, and mitigations
A factory runs a control system on an operating system that the vendor no longer patches, and replacing it is not possible this year. What is the best way to reduce the risk?
Show answer
Answer: D. When a system cannot be patched, a compensating control such as segmentation limits who and what can reach it. Patches from another OS version will not apply and can break the system. Disabling logging removes visibility, and accepting the risk with no controls ignores a practical mitigation.
-
Security architecture
Sales staff often travel with laptops containing customer data. The main concern is that a lost or stolen laptop could expose that data. Which control addresses this most directly?
Show answer
Answer: A. Full-disk encryption protects data at rest, so a thief who has the device still cannot read the drive. A host firewall protects against network attacks, privacy filters stop shoulder surfing, and cable locks only help while the laptop is in a fixed place.
-
Security architecture
A company moving to a public cloud is told that personal data about its EU customers must remain subject to EU law. What should it consider first when designing the deployment?
Show answer
Answer: D. Data sovereignty means data is subject to the laws of the place where it is stored, so region selection is the key design decision. Cost does not address the legal requirement, a global CDN could copy data outside the EU, and MFA is good practice but unrelated to jurisdiction.
-
Security operations
Attackers are sending email that appears to come from your company's domain. You have already published SPF and DKIM records. Which DNS record tells receiving mail servers what to do with messages that fail those checks, and where to send reports?
Show answer
Answer: C. DMARC builds on SPF and DKIM and publishes a policy (none, quarantine or reject) plus reporting addresses. MX records route incoming mail, PTR records map IP addresses to names, and CNAME records create aliases.
-
Security operations
A vulnerability scan reports a CVSS 9.8 flaw on an isolated internal test server and a CVSS 7.5 flaw on an internet-facing web server. The 7.5 flaw is listed as actively exploited in the wild. Which should be fixed first?
Show answer
Answer: D. Prioritisation should weigh exposure and active exploitation, not only the base CVSS score. An exploited flaw on an exposed server is the most likely to be used against the company soon. Waiting for the monthly window or a pen test leaves a known, active risk open.
-
Security operations
During an incident, the team has disconnected three infected hosts from the network. It is now removing the malware and closing the vulnerability that let it in. Which incident response phase is this?
Show answer
Answer: C. Removing the threat and its root cause after containment is eradication. Preparation happens before incidents, detection is when the incident is identified, and lessons learned is the review after recovery.
-
Security program management and oversight
After a risk assessment, a company buys a cyber insurance policy to cover the financial impact of a data breach. Which risk response is this?
Show answer
Answer: C. Insurance shifts the financial impact to a third party, which is transference. Avoidance stops the risky activity, acceptance takes the risk as it is, and mitigation adds controls to reduce likelihood or impact.
-
Security program management and oversight
A company is signing with a managed hosting provider. It needs a document that defines 99.9% uptime, response times for outages and penalties if the targets are missed. Which agreement is this?
Show answer
Answer: D. An SLA sets measurable service targets and the consequences of missing them. An MOU records a general intent to cooperate and is usually not binding on performance, an NDA covers confidentiality, and an MSA sets the overall terms under which more specific agreements such as SLAs are made.