I85PREP
⌘ K
Security+ study materials
Security+ study resources

Security+ practice questions

One question at a time. Build your Security+ understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1General Security Concepts

Which element of the CIA triad ensures that data has not been altered or destroyed in an unauthorized manner?

  1. Availability
  2. Integrity Correct answer.
  3. Confidentiality
  4. Non-repudiation

Explanation

Integrity is the CIA property that ensures data is accurate, complete, and unaltered by unauthorized parties. Controls such as hashing and digital signatures help detect unauthorized modification. Confidentiality and availability address different goals.

Question 2General Security Concepts

Which process confirms a user's claimed identity before access is granted?

  1. Authentication Correct answer.
  2. Authorization checks
  3. Accounting reports
  4. Audit logging

Explanation

Authentication is the process of verifying a claimed identity, typically with a credential such as a password, certificate, or biometric. Authorization happens after authentication and determines what the identity may do.

Question 3General Security Concepts

Which security service prevents a sender from denying that they signed a message?

  1. Non-repudiation Correct answer.
  2. Fault tolerance
  3. Data confidentiality
  4. System availability

Explanation

Non-repudiation provides evidence that a specific party performed an action, so the party cannot later deny it. A digital signature binds the message to the signer's private key, creating that evidence.

Question 4General Security Concepts

A badge reader that restricts entry to a server room is which category of security control?

  1. Operational
  2. Technical
  3. Managerial
  4. Physical Correct answer.

Explanation

Physical controls act on the physical environment, such as locks, badge readers, fences, and guards. A badge reader restricts who can physically enter the server room.

Question 5General Security Concepts

A posted sign warning that video surveillance is in use is which type of control?

  1. Corrective
  2. Deterrent Correct answer.
  3. Compensating
  4. Preventive

Explanation

A deterrent control discourages potential attackers by making an action seem risky or likely to be detected. A surveillance warning sign is intended to deter rather than physically stop entry.

Question 6General Security Concepts

Which principle is central to a zero trust architecture?

  1. One-time login that grants permanent access
  2. Implicit trust for anyone inside the corporate perimeter
  3. A flat internal network without any segmentation
  4. Continuous verification of every request Correct answer.

Explanation

Zero trust removes implicit trust based on network location and requires every access request to be authenticated and authorized continuously. Segmentation and least privilege support this model, but the core idea is verify explicitly.

Question 7General Security Concepts

Which cryptographic operation produces a fixed-length digest that cannot be reversed to the original input?

  1. Steganography
  2. Hashing Correct answer.
  3. Symmetric encryption
  4. Key exchange

Explanation

A hash function maps input of any length to a fixed-length digest and is designed to be one-way, so the original input cannot be recovered from the digest. Encryption is reversible with the correct key.

Question 8General Security Concepts

Why is a unique salt added to each password before hashing?

  1. To shorten the resulting hash value
  2. To let administrators recover passwords
  3. To encrypt the password with a public key
  4. To make equal passwords hash differently Correct answer.

Explanation

A salt is a unique random value added to each password before hashing, so two users with the same password produce different hashes. This defeats precomputed rainbow tables and makes identical passwords harder to spot.

Question 9General Security Concepts

Which approach lets a web server provide a cached, signed revocation status to clients without each client contacting the CA?

  1. Submitting a certificate signing request
  2. OCSP stapling Correct answer.
  3. Downloading a full CRL
  4. Using a self-signed certificate

Explanation

OCSP stapling lets the server obtain a signed, time-stamped OCSP response from the CA and present it during the TLS handshake. Clients avoid contacting the CA directly for each connection, reducing latency and CA load.

Question 10General Security Concepts

Which hardware component stores keys and performs cryptographic operations on a workstation's mainboard?

  1. Hardware security module
  2. Trusted Platform Module Correct answer.
  3. Certificate authority
  4. Key management service

Explanation

A Trusted Platform Module is a dedicated chip on the mainboard that stores keys and performs cryptographic measurements and operations. It is commonly used to protect full-disk encryption keys.

Question 11General Security Concepts

TLS is used primarily to protect data in which state?

  1. At rest
  2. In use
  3. In long-term archive
  4. In transit Correct answer.

Explanation

Data in transit is moving between systems over a network, and TLS encrypts that traffic to protect confidentiality and integrity. Data at rest is stored, and data in use is being processed in memory.

Question 12General Security Concepts

Who is accountable for classifying data and defining who may access it?

  1. Data custodian
  2. Data processor
  3. Data subject
  4. Data owner Correct answer.

Explanation

The data owner is the business role accountable for classifying data and deciding who may access it. Custodians implement the controls, and processors handle data on behalf of others.

Question 13General Security Concepts

A company stores EU residents' personal data on servers located in the United States. Which concept is most directly at issue?

  1. Data minimization
  2. Data sovereignty Correct answer.
  3. Data retention
  4. Data masking

Explanation

Data sovereignty refers to data being subject to the laws and regulations of the country where it is stored. Moving EU personal data to US servers can raise sovereignty and cross-border transfer issues.

Question 14General Security Concepts

Replacing a credit card number with a non-sensitive value that maps back to the original through a secure vault is called:

  1. Hashing
  2. Steganography
  3. Masking
  4. Tokenization Correct answer.

Explanation

Tokenization replaces sensitive data with a token that has no exploitable value and maps back to the original only through a secured token vault. Unlike encryption, the token itself is not a mathematically transformed version of the original.

Question 15General Security Concepts

Embedding a secret message inside the pixels of an image file is an example of:

  1. Steganography Correct answer.
  2. Encryption
  3. Hashing
  4. Data tokenization

Explanation

Steganography hides the existence of a message by embedding it in a carrier such as an image, audio file, or video. The cover file remains usable while concealing the payload.

Question 16General Security Concepts

Which step should occur before a production change is implemented?

  1. Notify users after the change is complete
  2. Disable event logging to reduce noise
  3. Apply the change directly to production
  4. Obtain approval through change control Correct answer.

Explanation

Change control requires a proposed change to be reviewed, tested, and approved before implementation. This reduces the risk of unplanned outages and security regressions.

Question 17General Security Concepts

Comparing an organization's current security posture with a framework to find missing controls is called:

  1. Gap analysis Correct answer.
  2. Risk register review
  3. Business impact analysis
  4. Penetration testing

Explanation

A gap analysis compares the current state of controls against a chosen framework or standard and identifies missing or deficient areas. The result helps prioritize remediation.

Question 18General Security Concepts

A legacy server cannot be patched. It is isolated on a segmented VLAN with strict firewall rules. Which control type best describes the segmentation?

  1. A purely corrective control
  2. A purely detective control
  3. A purely directive control
  4. A compensating control Correct answer.

Explanation

A compensating control provides an alternative safeguard when the preferred or required control cannot be implemented. Isolating an unpatched legacy server with strict segmentation reduces risk in place of patching.

Question 19General Security Concepts

Granting a user only the permissions required to perform their job is known as:

  1. Separation of duties
  2. Least privilege Correct answer.
  3. Mandatory vacation
  4. Job rotation

Explanation

Least privilege means giving users and processes only the access necessary for their assigned tasks. It limits the damage that can result from misuse or compromise.

Question 20General Security Concepts

A decoy server placed in a DMZ to attract and observe attackers is called a:

  1. Reverse proxy
  2. Bastion host
  3. Jump server
  4. Honeypot Correct answer.

Explanation

A honeypot is a decoy system intended to attract attackers, detect activity, and gather intelligence while keeping them away from production assets. It has no legitimate production purpose.

Question 21General Security Concepts

Which property makes a public blockchain tamper-evident?

  1. Each block hashes the prior block Correct answer.
  2. A central authority approves every block
  3. Records are stored on a single server
  4. All transactions use a shared secret key

Explanation

In a blockchain, each block includes a cryptographic hash of the previous block. Changing an earlier block would alter its hash and break the chain, making tampering evident.

Question 22General Security Concepts

Which mechanism allows an organization to recover encrypted data if the private key is lost?

  1. Key stretching
  2. Key rotation
  3. Key escrow Correct answer.
  4. Key exchange

Explanation

Key escrow stores a copy of encryption keys with a trusted third party or secure system so data can be recovered if the primary key is lost. It introduces a tradeoff between recoverability and key custody risk.

Question 23General Security Concepts

A documented minimum configuration standard applied to servers is called a:

  1. Risk appetite
  2. Security baseline Correct answer.
  3. Incident response plan
  4. Acceptable use policy

Explanation

A security baseline is a documented minimum set of configuration settings applied to systems to reduce risk. It is often derived from vendor guidance or frameworks such as CIS Benchmarks.

Question 24General Security Concepts

Before retiring a disk that stored regulated data, which action is most appropriate?

  1. Delete the files and empty the recycle bin
  2. Sanitize or destroy the media Correct answer.
  3. Perform a quick format of the drive
  4. Move the disk to a spare workstation

Explanation

Media that stored regulated data must be sanitized or destroyed according to policy before disposal or reuse. Deleting files or quick formatting leaves recoverable data on the disk.

Question 25Threats, Vulnerabilities, and Mitigations

Which type of malware self-replicates across networks without requiring user interaction?

  1. Rootkit
  2. Trojan
  3. Worm Correct answer.
  4. Virus

Explanation

A worm spreads by itself over network connections and can infect hosts without a user opening a file. Viruses typically require execution of an infected file, while trojans and rootkits rely on other delivery or concealment methods.

Question 26Threats, Vulnerabilities, and Mitigations

Which social engineering attack uses a highly tailored message aimed at a senior executive?

  1. Tailgating
  2. Whaling Correct answer.
  3. Vishing
  4. Shoulder surfing

Explanation

Whaling is a targeted phishing attack directed at high-value executives and often uses researched personal details. Vishing uses voice calls, tailgating follows someone through a door, and shoulder surfing observes a screen.

Question 27Threats, Vulnerabilities, and Mitigations

Which vulnerability occurs when an application places untrusted input directly into a database query?

  1. SQL injection Correct answer.
  2. Cross-site request forgery
  3. Directory traversal
  4. Cross-site scripting

Explanation

SQL injection happens when user-controlled input changes the structure or logic of a database query. Parameterized queries or prepared statements prevent the input from being interpreted as SQL code.

Question 28Threats, Vulnerabilities, and Mitigations

Which attack uses many compromised devices to overwhelm a target with traffic?

  1. Phishing email
  2. DDoS attack Correct answer.
  3. Rootkit
  4. Privilege escalation

Explanation

A distributed denial-of-service attack coordinates many systems to exhaust a victim's bandwidth or resources. Phishing, privilege escalation, and rootkits describe different initial-access or persistence techniques.

Question 29Threats, Vulnerabilities, and Mitigations

Which malware type disguises itself as legitimate software to trick a user into running it?

  1. Adware
  2. Trojan Correct answer.
  3. Worm
  4. Logic bomb

Explanation

A trojan presents itself as desirable or benign software so the user installs or executes it. Its payload may include backdoors, spyware, or other malicious functions.

Question 30Threats, Vulnerabilities, and Mitigations

Which activity involves searching discarded trash for sensitive information?

  1. Pretexting
  2. Dumpster diving Correct answer.
  3. Shoulder surfing
  4. Smishing

Explanation

Dumpster diving is the physical search of discarded materials for documents, media, or other information that was not properly destroyed. Shredding sensitive documents is a common mitigation.

Question 31Threats, Vulnerabilities, and Mitigations

Which control blocks execution of unauthorized applications on an endpoint?

  1. Network access control
  2. Endpoint detection and response
  3. Data loss prevention
  4. Application allowlisting Correct answer.

Explanation

Application allowlisting permits only approved executables to run and blocks everything else. DLP focuses on data movement, NAC controls network admission, and EDR detects and responds to endpoint threats.

Question 32Threats, Vulnerabilities, and Mitigations

Which malware encrypts files and demands payment for decryption?

  1. Remote access trojan
  2. Spyware
  3. Rootkit
  4. Ransomware Correct answer.

Explanation

Ransomware encrypts or otherwise denies access to data and demands payment for restoration. Reliable offline backups reduce the need to pay and enable recovery.

Question 33Threats, Vulnerabilities, and Mitigations

A web application reflects user-supplied search terms in its HTML response. Which mitigation most directly prevents reflected cross-site scripting?

  1. DNSSEC response signing
  2. Parameterized database queries
  3. Context-aware output encoding Correct answer.
  4. Anti-CSRF token validation

Explanation

Reflected XSS occurs when input is written into HTML without safe encoding for that output context. Context-aware output encoding turns special characters into inert text so the browser does not execute them as script.

Question 34Threats, Vulnerabilities, and Mitigations

Which control prevents an attacker's site from submitting authenticated state-changing requests on behalf of a logged-in user?

  1. Input length validation
  2. TLS inspection
  3. Anti-CSRF token Correct answer.
  4. Content Security Policy

Explanation

Cross-site request forgery abuses a victim's existing authenticated session to send unwanted requests. An unguessable anti-CSRF token tied to the user's session lets the server distinguish legitimate requests from forged ones.

Question 35Threats, Vulnerabilities, and Mitigations

Which coding practice most directly prevents a buffer overflow when copying input into a fixed-size array?

  1. Escaping HTML entities
  2. Enforcing password complexity
  3. Performing bounds checks Correct answer.
  4. Using a random salt

Explanation

Bounds checking verifies that data written into an array does not exceed its allocated size. This stops input from overwriting adjacent memory and corrupting control data.

Question 36Threats, Vulnerabilities, and Mitigations

An application checks a file's permissions and then opens it in a separate step. An attacker swaps the file between the two steps. Which weakness is this?

  1. Integer overflow
  2. TOCTOU race condition Correct answer.
  3. Directory traversal
  4. Cross-site request forgery

Explanation

A time-of-check to time-of-use race condition occurs when a resource can change after it is validated but before it is used. Atomic operations and locking help ensure the checked object is the same object acted upon.

Question 37Threats, Vulnerabilities, and Mitigations

A vulnerability has no vendor patch yet. Which mitigation best reduces exploitation risk while a fix is unavailable?

  1. Disabling all endpoint logging
  2. Sharing administrator credentials
  3. Removing offline backups
  4. Virtual patching at the IPS Correct answer.

Explanation

Virtual patching uses an intrusion prevention system or web application firewall rule to block known exploit traffic until a vendor patch is available. It reduces exposure without modifying the vulnerable application code.

Question 38Threats, Vulnerabilities, and Mitigations

Which technology helps clients validate that DNS responses have not been forged?

  1. Port security
  2. TLS stapling
  3. ARP inspection
  4. DNSSEC Correct answer.

Explanation

DNSSEC adds cryptographic signatures to DNS records so resolvers can verify authenticity and integrity. It addresses forged or tampered DNS answers rather than encrypting the query.

Question 39Threats, Vulnerabilities, and Mitigations

Which switch feature helps prevent an attacker from impersonating another host's MAC address on a LAN?

  1. Dynamic ARP inspection Correct answer.
  2. Loop protection
  3. Spanning Tree root guard
  4. BPDU guard

Explanation

Dynamic ARP inspection checks ARP packets against a trusted binding table to block spoofed IP-to-MAC associations. This mitigates ARP poisoning and on-path attacks on a local network.

Question 40Threats, Vulnerabilities, and Mitigations

A software vendor's build server is compromised and malicious code is inserted into an update. Which risk category is this?

  1. Distributed denial of service
  2. Watering hole website attack
  3. Malicious insider threat
  4. Supply chain compromise Correct answer.

Explanation

A supply chain compromise occurs when a trusted vendor, build process, or dependency is subverted to deliver malicious code to customers. Vendor risk assessment and build integrity controls reduce this exposure.

Question 41Threats, Vulnerabilities, and Mitigations

Which email control helps prevent an attacker from spoofing an organization's domain in the From header?

  1. DMARC Correct answer.
  2. DLP
  3. WAF
  4. NAC

Explanation

DMARC uses SPF and DKIM results plus an alignment policy to tell receivers how to handle mail that claims to be from the domain but fails authentication. This reduces domain spoofing in email.

Question 42Threats, Vulnerabilities, and Mitigations

Which control inspects HTTP requests and can block known web attack patterns before they reach the application?

  1. Host-based firewall
  2. Endpoint detection and response
  3. Full-disk encryption
  4. Web application firewall Correct answer.

Explanation

A web application firewall analyzes HTTP traffic for malicious patterns and can block requests before they reach the web server or application. It complements secure coding rather than replacing it.

Question 43Threats, Vulnerabilities, and Mitigations

Which action best reduces the attack surface of a newly deployed server?

  1. Using default vendor passwords
  2. Enabling every optional vendor service
  3. Granting local administrator rights to all users
  4. Disabling unused ports and services Correct answer.

Explanation

Disabling unnecessary ports and services removes potential entry points that attackers could exploit. This is a core part of system hardening and secure baseline configuration.

Question 44Threats, Vulnerabilities, and Mitigations

Which activity proactively searches endpoint and network telemetry for signs of compromise that alerts have not flagged?

  1. Vulnerability scanning
  2. Patch auditing
  3. Asset inventory
  4. Threat hunting Correct answer.

Explanation

Threat hunting uses hypotheses and telemetry analysis to find malicious activity that automated detections may have missed. It is proactive rather than waiting for an alert.

Question 45Threats, Vulnerabilities, and Mitigations

Which attack compromises a website frequently visited by a target group in order to infect those visitors?

  1. Smishing
  2. Tailgating
  3. Watering hole Correct answer.
  4. Evil twin access point

Explanation

A watering hole attack infects a site its targets are known to visit, then uses that trusted site to deliver malware or redirect victims. It is a targeted technique rather than broad opportunistic phishing.

Question 46Threats, Vulnerabilities, and Mitigations

Which technology checks an endpoint's patch level and antivirus status before allowing it onto a network?

  1. WAF
  2. NAC Correct answer.
  3. SIEM
  4. DLP

Explanation

Network access control evaluates endpoint posture, such as patch state and security agent status, before granting network access. Noncompliant devices can be quarantined or remediated.

Question 47Threats, Vulnerabilities, and Mitigations

Which control is designed to detect and block sensitive data from leaving the organization via email?

  1. NAC
  2. EDR
  3. WAF
  4. DLP Correct answer.

Explanation

Data loss prevention inspects content and context to identify sensitive information and enforce policies that block or log its transfer. It can apply to email, web traffic, and endpoint actions.

Question 48Threats, Vulnerabilities, and Mitigations

An attacker requests service tickets for accounts with registered SPNs and cracks them offline. Which attack is this?

  1. Pass-the-hash
  2. Kerberoasting Correct answer.
  3. Golden ticket
  4. ARP spoofing

Explanation

Kerberoasting targets service principal name accounts by requesting Kerberos service tickets and cracking their encrypted material offline. Strong, unique service account passwords and managed service accounts reduce the risk.

Question 49Threats, Vulnerabilities, and Mitigations

A web application accepts a URL and fetches it server-side. An attacker supplies the cloud metadata endpoint address. Which vulnerability is exploited?

  1. Server-side request forgery Correct answer.
  2. XML external entity expansion
  3. SQL injection
  4. Cross-site request forgery

Explanation

Server-side request forgery tricks the server into making requests to attacker-chosen destinations, including internal services or cloud metadata endpoints. Validating and restricting outbound destinations reduces this risk.

Question 50Threats, Vulnerabilities, and Mitigations

Which term describes a phishing attack conducted over a telephone call?

  1. Smishing
  2. Vishing Correct answer.
  3. Whaling
  4. Pharming

Explanation

Vishing is voice phishing: the attacker uses a phone call to persuade the target to reveal information or perform an action. Smishing uses SMS text messages, pharming redirects web traffic through DNS manipulation, and whaling targets senior executives.