CompTIA Security+ sample questions with answers

Question 1

Domain: General Security Concepts

A certificate authority has revoked a certificate. Which protocol lets a client check the status of that single certificate in real time without downloading a complete revocation list?

1. CRL
2. CSR
3. OCSP
4. LDAP

Question 2

Domain: General Security Concepts

A company mounts signs at its data center entrance stating that the area is under continuous video surveillance and that intruders will be prosecuted. What type of control are the signs themselves?

1. Detective
2. Deterrent
3. Corrective
4. Compensating

Question 3

Domain: Threats, Vulnerabilities, and Attacks

Which system provides a standard identifier, such as CVE-2026-1234, for a publicly known vulnerability?

1. CVSS
2. CVE
3. SCAP
4. CWE

Question 4

Domain: Threats, Vulnerabilities, and Attacks

An employee receives a phone call from someone claiming to be from the IT help desk, who says the employee's account is locked and asks for the one-time code just sent to their phone.

Which social engineering technique is being used?

1. Smishing
2. Tailgating
3. Watering hole
4. Vishing

Question 5

Domain: Security Architecture

A Windows service on several servers needs a domain account whose password rotates automatically and that no person ever signs in with.

Which account type should be used?

1. A shared domain admin account
2. A group Managed Service Account
3. A local administrator account
4. An emergency access account

Question 6

Domain: Security Architecture

Which architecture model runs application code in short-lived functions where the cloud provider manages the underlying servers and operating system?

1. Serverless
2. Microservices on dedicated hosts
3. Virtual desktop infrastructure
4. On-premises clustering

Question 7

Domain: Security Operations

A monitoring platform learns typical sign-in volumes for each hour and department, then alerts on deviations instead of using a fixed threshold.

Which AI capability is this?

1. Agentic AI
2. Chatbot
3. AI-augmented baselines
4. Predictive analysis

Question 8

Domain: Security Operations

Solid-state drives that held confidential data are being retired and will not be reused. The organization wants the highest assurance that the data cannot be recovered with laboratory techniques.

Which disposal method is most appropriate?

1. Performing a single-pass overwrite with zeros across the whole drive using a disk utility
2. Deleting the partitions and reformatting
3. Degaussing the drives
4. Physically destroying the drives by shredding or disintegration

Question 9

Domain: Security Operations

A cloud team configures its pipeline so that any infrastructure template that creates a storage bucket without encryption or with public access fails automatically and cannot be deployed.

Which automation use case does this represent?

1. Guard rails
2. Ticket creation
3. Escalation
4. User provisioning

Question 10

Domain: Security Program Management and Oversight

Which model describes an intrusion by its adversary, capability, infrastructure and victim?

1. Cyber Kill Chain
2. MITRE ATT&CK
3. Diamond Model of Intrusion Analysis
4. CVSS

Question 1

Domain: General Security Concepts

In a zero trust architecture, which component makes the decision to grant, deny or revoke a subject's access to a resource, based on policy and inputs such as threat intelligence?

1. Policy enforcement point
2. Implicit trust zone
3. Policy engine
4. Data plane

Question 2

Domain: Threats, Vulnerabilities, and Mitigations

Which statement best describes the risk of running hardware that has reached end-of-life?

1. The vendor no longer supplies security updates, so newly found vulnerabilities stay unpatched
2. The hardware automatically stops functioning on the end-of-life date and can no longer be powered on
3. End-of-life hardware cannot be connected to modern networks
4. End-of-life status means the device has a known backdoor

Question 3

Domain: Threats, Vulnerabilities, and Mitigations

An application checks that a file is safe and then opens it, but an attacker swaps the file in the brief interval between the check and the use. What type of vulnerability is this?

1. Race condition (time-of-check to time-of-use)
2. Buffer overflow
3. SQL injection
4. Memory leak

Question 4

Domain: Security Architecture

A company's unreleased product formula gives it a competitive advantage and is protected by keeping it confidential rather than by patent. Which data type is this?

1. Regulated data
2. Public data
3. Legal information
4. Trade secret

Question 5

Domain: Security Architecture

A firewall protecting a hospital's patient monitoring network loses power to its inspection module. Management decides that monitoring traffic must keep flowing even if inspection is unavailable.

Which failure mode has management chosen?

1. Fail-open
2. Fail-closed
3. Fail-secure
4. Fail-over to passive mode

Question 6

Domain: Security Operations

During an audit, the security team finds servers on the network that do not appear in the asset inventory and have no assigned owner.

What is the main security risk of these unknown assets?

1. They increase software licensing costs and complicate annual vendor license true-up audits
2. They slow down the network
3. They are unlikely to be patched, monitored or protected by security controls
4. They violate the data retention policy

Question 7

Domain: Security Operations

A network team wants to know which internal hosts talk to which external IP addresses, how many bytes are transferred and for how long, without storing full packet payloads.

Which data source best meets the requirement?

1. Full packet capture
2. SNMP traps
3. Antivirus logs
4. NetFlow or IPFIX flow records

Question 8

Domain: Security Operations

Two vulnerabilities have the same CVSS base score of 8.1. One affects an internet-facing payment server; the other affects an isolated lab machine with no sensitive data.

Which approach should drive the remediation order?

1. Fix them in the order the scanner listed them
2. Adjust priority using environmental factors such as exposure and asset criticality
3. Fix the lab machine first because it is easier
4. Treat them identically, because matching base scores mean matching organizational risk

Question 9

Domain: Security Program Management and Oversight

During reconnaissance, a tester gathers employee names from the company's website, searches public DNS records and reviews job postings, without sending any traffic to the target's systems beyond normal public browsing.

What type of reconnaissance is this?

1. Active reconnaissance
2. Passive reconnaissance
3. Vulnerability scanning
4. Offensive testing

Question 10

Domain: Security Program Management and Oversight

A SaaS provider's customers want independent assurance about its controls, so it hires a CPA firm to evaluate how well its controls operated over a 12-month period and issue a report.

What type of assessment is this?

1. Internal self-assessment
2. Regulatory examination
3. Independent third-party audit
4. Partially known penetration test