44 Architecture, Cryptography & Concepts Practice Questions & Answers

1. 1. A company moves its database servers to a cloud provider's IaaS offering. During an audit, the question arises: who must apply security patches to the guest operating systems running on those virtual machines?

   • A.Neither party, because virtual machines automatically inherit patches from the hypervisor
   • B.The customer, because IaaS delivers only virtualized infrastructure and the consumer manages the guest OS and everything above it✓ Answer
   • C.The cloud provider, because guest operating system patching is always bundled into an IaaS subscription
   • D.The cloud provider, because it owns and maintains the hypervisor and the physical hosts

   In the shared responsibility model the dividing line moves with the service model. Under IaaS the provider is accountable only up to the hypervisor and the physical layer; everything the customer instantiates above that line — guest OS, middleware, applications and data — is the customer's to configure, harden and patch. Assuming the provider silently patches guest instances is the classic root cause of unpatched cloud VMs.

   Source: CompTIA Security+ Exam Objectives, Domain 3.1 (cloud shared responsibility matrix); NIST SP 800-145 service model definitionsReport a problem with this question

2. 2. An organization adopts a fully managed SaaS human-resources platform. The provider hosts the application, the operating systems and the data center. Which security responsibility still belongs to the customer?

   • A.Hardening the underlying operating systems and hypervisor
   • B.Patching vulnerabilities in the platform's application code
   • C.Maintaining physical access controls at the hosting facility
   • D.Managing user accounts, roles, permissions and tenant sharing settings✓ Answer

   SaaS pushes the most responsibility to the provider, but identity and access decisions inside the tenant never transfer. The customer alone knows who should hold which role, so account provisioning, de-provisioning, permission assignment and sharing configuration remain customer-owned in every SaaS shared responsibility matrix — which is why misconfigured tenant sharing, not provider code, drives most SaaS exposures.

   Source: CompTIA Security+ Exam Objectives, Domain 3.1 (cloud shared responsibility matrix); NIST SP 800-145 SaaS definitionReport a problem with this question

3. 3. In a zero trust deployment, an access request arrives from a managed laptop. Identity attributes, device posture and risk signals are evaluated against policy, and a grant-or-deny verdict is produced before any session is allowed. Which component produces that verdict?

   • A.The policy engine✓ Answer
   • B.The implicit trust zone
   • C.The policy administrator
   • D.The policy enforcement point

   Zero trust separates the decision from the enforcement. The policy engine is the control-plane component that evaluates the request against policy and trust algorithm inputs and renders the access decision; the policy administrator then communicates that decision and establishes or tears down the session credentials, and the enforcement point on the data plane physically allows or blocks the traffic. Only the engine decides.

   Source: NIST SP 800-207 Zero Trust Architecture, Sec. 3.1 (policy engine / policy administrator / PEP); CompTIA Security+ Objective 1.2Report a problem with this question

4. 4. An architect is labeling a zero trust diagram. She needs to identify the component that sits in the data plane and actually permits, terminates or blocks the session between the subject and the protected resource.

   • A.The policy enforcement point✓ Answer
   • B.Adaptive identity
   • C.The policy administrator
   • D.The policy engine

   The policy engine and the policy administrator both live in the control plane and never touch the traffic itself. The policy enforcement point is the data-plane gateway or agent that opens, monitors and terminates the connection to the resource, so it is the only component that can actually stop a session. Placing enforcement close to each resource is what makes micro-segmentation possible.

   Source: NIST SP 800-207 Zero Trust Architecture, Sec. 3.1 and Sec. 2 (control plane vs. data plane)Report a problem with this question

5. 5. Remote staff currently authenticate once to a VPN concentrator and then reach any internal subnet with no further checks. Management wants the design brought in line with zero trust principles. Which change accomplishes that?

   • A.Add VPN concentrator capacity and enable split tunneling so less traffic traverses the internal network
   • B.Move the VPN concentrator inside the internal network to shorten the path to application servers
   • C.Replace post-login implicit trust with per-resource authorization and continuous verification, micro-segmenting resources behind enforcement points✓ Answer
   • D.Strengthen the VPN ciphers and require certificates to establish the tunnel

   A VPN that dumps an authenticated user onto a flat internal network creates exactly what zero trust forbids: a large implicit trust zone where one authentication grants broad lateral reach. Stronger tunnel crypto does not change that. Zero trust requires that every request to every resource be authorized separately and re-evaluated continuously, which shrinks the blast radius (threat scope reduction) when an account or device is compromised.

   Source: NIST SP 800-207 Zero Trust Architecture, Sec. 2.1 tenets (per-session authorization, continuous evaluation); CompTIA Security+ Objective 1.2Report a problem with this question

6. 6. A trading platform's business owners state that after a failure the company can afford to lose no more than 15 minutes of committed transactions. The current design takes a full backup every night and an incremental backup every four hours.

   • A.The recovery point objective is unmet; increase replication or backup frequency so no more than 15 minutes of data is ever at risk✓ Answer
   • B.The mean time to repair is unmet; staff a second on-call rotation
   • C.The recovery time objective is unmet; add standby servers so failover completes faster
   • D.The mean time between failures is unmet; replace the storage hardware on a shorter cycle

   A statement about how much data may be lost is a recovery point objective, and the RPO is satisfied by how often data is captured or replicated, not by how fast systems come back. With a four-hour incremental cycle, a failure just before a job runs loses nearly four hours of transactions, far exceeding the 15-minute tolerance, so the fix is more frequent capture — near-continuous replication or journaling.

   Source: CompTIA Security+ Exam Objectives, Domain 3.4 (RPO); NIST SP 800-34 Rev. 1, Sec. 3.2 recovery objectivesReport a problem with this question

7. 7. A hospital's scheduling system must be back in service within two hours of any outage. Testing shows that rebuilding servers and restoring from offsite tape takes about nine hours. Which conclusion and remedy fit the scenario?

   • A.The recovery time objective is exceeded; move to a warm standby with pre-staged hardware and replicated data so service resumes within the window✓ Answer
   • B.This is a capacity planning failure; purchase additional tape drives to widen the backup window
   • C.The mean time between failures is exceeded; buy more reliable servers
   • D.The recovery point objective is exceeded; take snapshots more frequently

   The two-hour figure describes maximum tolerable downtime, which is the recovery time objective. A nine-hour rebuild-and-restore cannot meet a two-hour RTO no matter how good the backups are, because RTO is driven by how quickly a working environment can be presented to users. Pre-staged hardware with replicated data removes the rebuild and the tape read from the critical path.

   Source: CompTIA Security+ Exam Objectives, Domain 3.4 (RTO, site considerations); NIST SP 800-34 Rev. 1, Sec. 3.4.2 alternate sitesReport a problem with this question

8. 8. A vendor data sheet states that a network appliance averages 40,000 hours of operation between failures and that, once a failure occurs, service is typically restored in about 3 hours. How should these two figures be labeled?

   • A.Both figures describe MTTF, since the appliance is field-repairable
   • B.40,000 hours is the RPO and 3 hours is the RTO
   • C.40,000 hours is the MTTR and 3 hours is the MTBF
   • D.40,000 hours is the MTBF and 3 hours is the MTTR✓ Answer

   Mean time between failures measures reliability — the average operating interval separating one failure from the next on a repairable item — while mean time to repair measures maintainability, the average time to restore service after a failure. RPO and RTO are business-defined recovery targets, not observed hardware statistics, and MTTF applies to items that are replaced rather than repaired.

   Source: CompTIA Security+ Exam Objectives, Domain 3.4 (MTBF, MTTR, MTTF); NIST SP 800-34 Rev. 1 reliability terminologyReport a problem with this question

9. 9. A small manufacturer must have a documented alternate processing site, but it can tolerate roughly a week of downtime for its back-office systems and has almost no recurring budget for standby capacity. Which alternate site type fits these constraints?

   • A.A hot site running synchronized systems ready for near-instant cutover
   • B.A cold site providing space, power and cooling only✓ Answer
   • C.An active-active multi-region cloud deployment
   • D.A warm site with pre-installed hardware awaiting a current data restore

   Alternate site selection is a trade of cost against recovery speed. A cold site supplies only the facility — space, power, cooling and connectivity — so equipment must be procured, installed and loaded with data, which takes days to weeks but costs the least to maintain. Because the stated tolerance is about a week and the budget is minimal, the cold site is the only option matching both constraints; hot sites and active-active clouds buy speed the business has not asked to pay for.

   Source: CompTIA Security+ Exam Objectives, Domain 3.4 (site considerations: hot/warm/cold); NIST SP 800-34 Rev. 1, Sec. 3.4.2Report a problem with this question

10. 10. Executives want to validate that department leads understand their roles in the continuity plan. The exercise must not touch production systems, must consume only a few hours, and must cost as little as possible. Which test type should be selected?

    • A.A tabletop exercise walking participants through a scenario in discussion form✓ Answer
    • B.A parallel processing test that runs the recovery site alongside production
    • C.An unannounced interruption test during peak business hours
    • D.A full failover test that cuts production over to the recovery site

    Continuity testing forms a hierarchy from least to most disruptive: tabletop discussion, then simulation, then parallel processing, then actual failover. A tabletop exercise validates roles, decision authority and plan gaps purely through discussion, so it consumes no production capacity and carries no outage risk — the correct choice whenever the constraint is minimum disruption and minimum cost.

    Source: CompTIA Security+ Exam Objectives, Domain 3.4 (testing: tabletop, simulation, parallel processing, failover); NIST SP 800-84 exercise typesReport a problem with this question

11. 11. After a successful tabletop, the same organization now wants proof that the recovery site can genuinely process a full day's real workload — but production must keep serving customers the entire time. Which test satisfies both requirements?

    • A.A failover test that shifts live users to the recovery site
    • B.Another tabletop exercise with more participants
    • C.A checklist review of backup job logs
    • D.A parallel processing test in which the recovery site processes the same workload alongside production✓ Answer

    A parallel processing test brings the recovery environment up and runs the real workload through it at the same time production continues, then compares results. That proves capacity, data currency and application function without any customer-facing cutover. A failover test would be more realistic still, but it interrupts production, which the scenario forbids.

    Source: CompTIA Security+ Exam Objectives, Domain 3.4 (parallel processing vs. failover testing); NIST SP 800-84 functional exercise guidanceReport a problem with this question

12. 12. A company closes its branch offices and moves to a fully distributed workforce. Users work from home, consume mostly cloud applications, and need identity-aware, consistently enforced security policy without backhauling traffic to headquarters. Which architecture best meets this requirement?

    • A.Deploy SD-WAN appliances to steer traffic intelligently across available links
    • B.Build a site-to-site IPSec mesh between home offices and headquarters
    • C.Adopt SASE, delivering network transport and the security stack together from the cloud edge✓ Answer
    • D.Backhaul all remote traffic through the headquarters firewall over remote-access VPN

    SASE converges WAN transport with cloud-delivered security services — secure web gateway, cloud access security broker, firewall-as-a-service and zero trust network access — and applies policy at a point of presence near the user based on identity and context. SD-WAN alone optimizes transport but adds no security stack, and VPN backhaul reintroduces the hairpin and the single choke point the distributed model is trying to remove.

    Source: CompTIA Security+ Exam Objectives, Domain 3.2 (secure communication and access: VPN, SD-WAN, SASE)Report a problem with this question

13. 13. A security sensor attached to a switch SPAN port generated a high-fidelity alert for an exploit attempt, but the malicious traffic still reached the target server. What best explains this and what design change would allow the traffic to be stopped?

    • A.The sensor's signatures were outdated; updating them will let it block future attempts
    • B.The sensor is passive and out of band, seeing only copied traffic; placing an inline IPS in the forwarding path lets it drop the packets✓ Answer
    • C.The sensor was configured to fail closed, which suppressed its blocking action
    • D.The switch needed port security enabled so the sensor could enforce policy

    A device on a tap or SPAN port receives duplicated frames after the switch has already forwarded the originals, so it is architecturally incapable of preventing anything — it can only detect and alert, which is the defining limitation of an IDS. Prevention requires the appliance to sit inline so every packet must transit it before delivery; the trade-off is that an inline device becomes a potential point of failure and latency.

    Source: CompTIA Security+ Exam Objectives, Domain 3.2 (device attributes: active vs. passive, inline vs. tap/monitor; IDS vs. IPS)Report a problem with this question

14. 14. Policy for a regulated cardholder segment states that no traffic may enter or leave the segment without passing through inspection, even if the inspecting appliance faults. How should the inline appliance's failure mode be configured?

    • A.Fail-open with enhanced logging, so the inspection gap is documented afterward
    • B.Fail-closed, so traffic stops when the appliance fails, accepting an outage to preserve confidentiality✓ Answer
    • C.Fail-open, so traffic keeps flowing while the appliance is down
    • D.An automatic bypass switch that routes around the appliance whenever it faults

    Failure mode is chosen by asking which property the scenario refuses to lose. Fail-open preserves availability but lets uninspected traffic through; fail-closed preserves confidentiality and control by denying traffic when the device cannot inspect it. Because the stated policy is absolute about inspection, the outage is the accepted cost, and bypass switches are simply an automated form of fail-open.

    Source: CompTIA Security+ Exam Objectives, Domain 3.2 (failure modes: fail-open vs. fail-closed)Report a problem with this question

15. 15. Utility power to a data center is lost. The facility has both a battery UPS and a diesel generator. Which statement correctly describes how these two controls are meant to work together?

    • A.The generator picks up the load instantly while the UPS covers multi-day outages
    • B.Both start at the same moment and share the load indefinitely
    • C.The UPS carries the load immediately for a short period until the generator starts, stabilizes and assumes the load✓ Answer
    • D.The UPS only conditions and suppresses surges and provides no run time of its own

    A UPS is a bridging control: its batteries transfer within milliseconds but supply only minutes of run time. A generator can run for as long as fuel lasts but needs time to crank, come up to speed and stabilize before the transfer switch will move load to it. The UPS exists precisely to cover that start-up gap, which is why sizing UPS run time against generator start time is a standard capacity-planning check.

    Source: CompTIA Security+ Exam Objectives, Domain 3.4 (power: UPS and generators)Report a problem with this question

16. 16. In a design review, a database tier uses two nodes where a standby node takes over only if the primary fails, while the web tier spreads incoming requests across four simultaneously active servers. How should each tier be characterized?

    • A.The database is an active-passive cluster providing failover only, while the web tier uses load balancing to distribute traffic across active nodes✓ Answer
    • B.Both tiers are active-active clusters providing identical benefits
    • C.Neither arrangement provides high availability; only geographic dispersion does
    • D.The database is load balanced and the web tier is clustered

    Clustering makes multiple nodes behave as one logical system so that a survivor can assume the failed node's identity and workload; in active-passive form the standby adds resilience but no extra throughput. Load balancing distributes requests among nodes that are all serving at once, adding both scalability and redundancy. Recognizing that only one of these adds capacity is the key distinction.

    Source: CompTIA Security+ Exam Objectives, Domain 3.4 (high availability: load balancing vs. clustering, active-active vs. active-passive)Report a problem with this question

17. 17. An auditor finds that directory lookups traverse the network on TCP port 389 in cleartext and that network devices are managed with SNMP versions that authenticate using community strings. Which remediation pairs each service with its secure replacement?

    • A.Move directory traffic to LDAPS on TCP 636 and replace the legacy SNMP versions with SNMPv3✓ Answer
    • B.Move directory traffic to TCP 3389 and keep SNMP as-is with longer community strings
    • C.Leave LDAP on TCP 389 and change SNMP from port 161 to port 162
    • D.Tunnel directory queries over Telnet on TCP 23 and restrict SNMP to port 161 only

    Secure protocol selection means substituting a protocol that adds authentication and encryption, not merely changing port numbers. LDAPS carries directory traffic inside TLS on TCP 636, and SNMPv3 is the first SNMP version to provide a real user-based security model with authentication and privacy, whereas earlier versions send community strings in the clear. Port 162 is simply the SNMP trap port and Telnet is itself cleartext.

    Source: IANA Service Name and Transport Protocol Port Number Registry (ldaps 636, snmp 161/snmptrap 162); RFC 3410 (SNMPv3 framework); CompTIA Security+ Objective 4.5 secure protocolsReport a problem with this question

18. 18. A platform must execute untrusted code submitted by many different customers on shared infrastructure. The primary requirement is the strongest possible isolation between tenants, and some extra startup latency and memory overhead is acceptable. Which approach best meets the requirement?

    • A.Containers on a shared host, since namespaces and cgroups provide isolation equivalent to a hypervisor
    • B.Separate virtual machines, since each tenant receives its own guest OS isolated by the hypervisor✓ Answer
    • C.Containers built from minimal images, since a smaller image is sufficient isolation on its own
    • D.A single monolithic host process that runs each customer's code in a separate thread

    Containers share the host kernel, so a kernel-level escape or a container-runtime flaw can cross the tenant boundary; that shared kernel is exactly what makes containers lightweight and fast. Virtual machines each carry their own guest OS and are separated by the hypervisor, giving a much stronger security boundary at the cost of memory, storage and boot time — the correct trade when isolation strength outranks density and speed.

    Source: CompTIA Security+ Exam Objectives, Domain 3.1 (virtualization vs. containerization); NIST SP 800-190 Application Container Security GuideReport a problem with this question

19. 19. A legacy programmable logic controller runs the plant's bottling line on an unsupported operating system. The equipment vendor states that installing OS patches voids the machine's safety certification, and the line cannot be taken out of service. What is the most appropriate risk treatment?

    • A.Place the controller in a tightly segmented zone with restrictive access lists, an inspecting gateway and continuous monitoring as compensating controls✓ Answer
    • B.Publish the controller through an internet-facing gateway so the vendor can maintain it remotely
    • C.Install a modern endpoint detection agent directly on the controller
    • D.Apply the operating system vendor's latest patches during the next maintenance window anyway

    Industrial control, embedded and real-time operating systems frequently carry an inability to patch, driven by vendor certification, uptime or hardware constraints rather than by neglect. When the vulnerability cannot be removed, the architectural answer is to reduce exposure: isolate the device in its own zone, permit only the specific protocols and peers it requires, and monitor that boundary. Patching against vendor guidance risks a safety-certified system, and adding agents to a resource-constrained controller is typically unsupported.

    Source: CompTIA Security+ Exam Objectives, Domain 3.1 (ICS/SCADA, embedded, RTOS; considerations including inability to patch); NIST SP 800-82 Guide to OT Security (network segmentation and compensating controls)Report a problem with this question

20. 20. Administrators on the corporate LAN need to manage servers inside a restricted zone. Security requires a single, hardened, fully audited entry point into that zone, with no direct routes from workstations to the servers. Which design element satisfies this?

    • A.A reverse proxy publishing each server's management interface to the corporate network
    • B.Adding administrator workstations directly to the restricted zone's VLAN
    • C.A split-tunnel VPN that gives administrators direct routes to every server
    • D.A hardened jump server as the only permitted path into the zone, brokering and logging all administrative sessions✓ Answer

    A jump server (bastion host) is deliberately the only device permitted to open management sessions into a protected zone, so firewall rules can deny all other paths and every administrative action funnels through one hardened, heavily logged system. Putting workstations inside the zone or handing out direct routes destroys the boundary, and publishing management interfaces through a proxy widens the attack surface instead of narrowing it.

    Source: CompTIA Security+ Exam Objectives, Domain 3.2 (network appliances: jump server; security zones and device placement)Report a problem with this question

21. 21. A contractor plugs a personal laptop into a conference-room wall jack and immediately receives a corporate IP address with full internal access. Which control most directly prevents this in the future?

    • A.802.1X port-based authentication with a RADIUS back end, quarantining unauthenticated devices in a restricted VLAN✓ Answer
    • B.MAC address filtering on the wireless controller
    • C.A web application firewall in front of the internal applications
    • D.Disabling DHCP on the conference-room switch so devices must be configured manually

    802.1X performs authentication at the switch port itself: the port stays in an unauthorized state passing only authentication traffic until the supplicant proves identity through EAP to a RADIUS authentication server, after which the port can be assigned to the appropriate VLAN. Disabling DHCP is trivially bypassed with a static address, MAC filtering is spoofable and applies to the wrong medium here, and a WAF inspects application traffic rather than controlling network admission.

    Source: IEEE 802.1X port-based network access control; CompTIA Security+ Objectives 3.2 (port security, 802.1X, EAP) and 4.5 (NAC)Report a problem with this question

22. 22. Video review shows employees holding the data hall door open so a second, unbadged person can follow them in. Management wants a physical control that structurally prevents more than one person entering per authentication, rather than one that merely records the event.

    • A.Additional lighting and warning signage at the door
    • B.An access control vestibule that admits only one authenticated person at a time✓ Answer
    • C.Additional cameras covering the door to record every entry
    • D.Bollards installed at the building entrance

    The behavior described is tailgating, and the requirement is preventive rather than detective. An access control vestibule uses two interlocking doors so the inner door cannot open until the outer one closes and the occupant is authenticated, physically enforcing one-person-per-credential. Cameras and lighting are detective or deterrent, and bollards address vehicle impact, not pedestrian entry.

    Source: CompTIA Security+ Exam Objectives, Domain 1.2 (physical security: access control vestibule, bollards, lighting, video surveillance)Report a problem with this question

23. 23. A web server must protect large volumes of traffic while still letting any client connect securely without a pre-shared key. Which statement BEST describes how hybrid encryption accomplishes this?

    • A.Symmetric cryptography encrypts the session key, and asymmetric cryptography encrypts the bulk traffic
    • B.Hashing replaces encryption for the data stream because digests are faster to compute
    • C.Asymmetric cryptography establishes a shared symmetric session key, and symmetric cryptography then encrypts the bulk data✓ Answer
    • D.A single asymmetric key pair encrypts every session, so session keys never need to change

    Asymmetric cryptography solves the key-distribution problem but is computationally expensive; symmetric cryptography is fast but requires both parties to already share a secret. Hybrid encryption uses the key pair only to establish or exchange a symmetric session key, then encrypts the actual traffic symmetrically, gaining secure key establishment and high throughput at the same time.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 Cryptographic solutions — Encryption: symmetric vs. asymmetric, key exchangeReport a problem with this question

24. 24. Ana wants to send an encrypted file to Ben so that only Ben can read it. Which key must Ana use to encrypt the file?

    • A.Ben's public key✓ Answer
    • B.Ana's private key
    • C.Ben's private key
    • D.Ana's public key

    In asymmetric cryptography, whatever one key of the pair encrypts, only the matching key can decrypt. For confidentiality you encrypt with the recipient's public key, because only the recipient holds the corresponding private key needed to decrypt. Ben's private key never leaves Ben, so no one else can open the file.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Public key infrastructure (PKI): public key, private keyReport a problem with this question

25. 25. A contract system must let a company prove that a specific user submitted an approval and prevent that user from later denying it. Which control provides this?

    • A.Storing the record on an encrypted, permission-restricted file share
    • B.Hashing the record and storing the digest in an audit table
    • C.A digital signature generated with the user's private key✓ Answer
    • D.Encrypting the record with a symmetric key shared by the approval team

    Non-repudiation requires that only one person could possibly have produced the proof. A digital signature is created by hashing the message and encrypting that hash with the signer's private key, which no one else holds; anyone can verify it with the signer's public key. Shared-key and storage controls cannot attribute the action to one individual.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.2 non-repudiation; 1.4 — Digital signaturesReport a problem with this question

26. 26. Two servers validate API messages using a hash-based message authentication code (HMAC) with a shared secret key. Why does this NOT provide non-repudiation?

    • A.HMAC cannot detect whether a message was modified in transit
    • B.Both parties hold the same secret key, so either one could have produced the value✓ Answer
    • C.HMAC encrypts the message, and encryption never proves origin
    • D.HMAC output length varies, so it cannot be used as evidence

    HMAC does provide integrity and message authentication, but it relies on a secret both sides possess. Because either party could compute the same code, neither can be uniquely bound to the message. Non-repudiation requires a signing key held solely by one party, which is why only digital signatures deliver it.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Hashing / digital signatures; 1.2 non-repudiationReport a problem with this question

27. 27. An administrator configures a TLS service to negotiate a unique ephemeral key for every session. What security benefit does this provide?

    • A.Compromise of the server's long-term private key does not expose previously captured sessions✓ Answer
    • B.The server no longer needs a certificate issued by a certificate authority (CA)
    • C.Recorded sessions can later be decrypted by administrators for auditing
    • D.Asymmetric encryption fully replaces symmetric encryption for the data stream

    This is perfect forward secrecy. Each session key is derived independently and discarded when the session ends, so it cannot be reconstructed from the server's long-term private key. An attacker who records traffic today and steals the private key later still cannot decrypt those earlier sessions.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Key exchange; perfect forward secrecy / ephemeral keysReport a problem with this question

28. 28. A manufacturer must add asymmetric cryptography to battery-powered sensors that have very limited processing power. Which approach BEST balances strength and resource use?

    • A.Use elliptic curve cryptography, which reaches comparable strength with much smaller keys✓ Answer
    • B.Use the largest available RSA key size, because longer keys are always the better choice
    • C.Hard-code one shared symmetric key into every device at the factory
    • D.Replace the key pair with a one-way hashing function to save cycles

    Increasing key length increases strength but also increases computation, memory, and power draw. Elliptic curve cryptography achieves strength comparable to much larger conventional keys at a fraction of the key size, so constrained devices get real asymmetric protection without the processing cost. Hashing is one-way and cannot replace a key pair, and a shared hard-coded key compromises every device at once.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Encryption: algorithms, key lengthReport a problem with this question

29. 29. A block cipher running in a mode that uses an initialization vector (IV) produces different ciphertext each time the same plaintext is encrypted with the same key. What is the IV's primary purpose?

    • A.To authenticate the identity of the party sending the message
    • B.To randomize the encryption so identical plaintext does not yield identical ciphertext✓ Answer
    • C.To store the encryption key safely alongside the ciphertext
    • D.To lengthen the key so the effective key strength increases

    Without an IV, a block cipher mode maps identical plaintext blocks to identical ciphertext blocks, leaking patterns in the data. The IV injects per-message variability so the same message encrypted twice with the same key looks different. An IV must be unique (and often unpredictable) for each message, but unlike the key it does not have to be kept secret.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Encryption: block/stream ciphers, modes of operationReport a problem with this question

30. 30. A vendor publishes a hash value next to a software download. Which statement about cryptographic hashing is correct?

    • A.The digest length grows in proportion to the size of the input file
    • B.It is a one-way function that verifies integrity but provides no confidentiality✓ Answer
    • C.It is reversible, so the original file can be recovered with the correct key
    • D.Two different files producing the same digest is normal and expected behavior

    A cryptographic hash produces a fixed-length digest from input of any size, cannot be reversed, and changes completely when a single bit changes. That makes it ideal for proving a file was not altered, but it hides nothing — hashing gives integrity, not confidentiality. Two inputs sharing a digest is a collision, which indicates the algorithm is broken, not normal behavior.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Hashing; 1.2 integrityReport a problem with this question

31. 31. Why does adding a unique random salt to each password before hashing improve security?

    • A.Identical passwords produce different digests, defeating precomputed rainbow tables✓ Answer
    • B.The salt must be kept secret, and that secrecy is what prevents cracking
    • C.It encrypts the password so it can be recovered if the user forgets it
    • D.It shortens the stored digest so the password database indexes faster

    A salt is random data added to each password before hashing, so two users who choose the same password store completely different digests. That forces an attacker to attack each account individually instead of matching digests against a precomputed rainbow table. Salts add no reversibility and do not need to be secret — their value comes from uniqueness, not secrecy.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — SaltingReport a problem with this question

32. 32. An organization must be able to decrypt work files belonging to employees who leave the company or lose their credentials. Which control addresses this requirement?

    • A.Perfect forward secrecy applied to all file encryption operations
    • B.Certificate revocation checked through the Online Certificate Status Protocol (OCSP)
    • C.Key stretching, which repeatedly hashes a weak password to make brute force expensive
    • D.Key escrow, in which the organization or a trusted third party retains a copy of private keys✓ Answer

    Key escrow stores a copy of private keys so encrypted data remains recoverable when a key holder is gone, making it a business-continuity control rather than a strengthening one — and it adds insider and trust risk because someone else can decrypt the data. Key stretching is unrelated: it slows password-derived key generation. Forward secrecy deliberately makes past keys unrecoverable, which is the opposite of what is needed here.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — PKI: key escrow; key stretchingReport a problem with this question

33. 33. An administrator generates a key pair and submits a certificate signing request (CSR) to a certificate authority (CA). What does the CSR contain?

    • A.The signed certificate previously issued by the root CA
    • B.Both the public and private keys, so the CA can confirm they match
    • C.Only the private key, which the CA places into escrow
    • D.The public key plus identifying information about the requester✓ Answer

    The certificate lifecycle starts with generating a key pair locally; the CSR then carries the public key and subject/identity details to the CA. The private key never leaves the requesting system — sending it would destroy the trust model, since the whole point of a certificate is to bind an identity to a public key that only its holder can match. After validating the requester, the CA signs and issues the certificate.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Certificates: certificate signing request (CSR) generationReport a problem with this question

34. 34. A client must obtain the most current revocation status for one specific certificate at the moment it connects. Which method BEST meets this need?

    • A.Downloading the certificate revocation list (CRL) published periodically by the CA
    • B.Reading the validity dates in the certificate to see whether it has expired
    • C.Querying the Online Certificate Status Protocol (OCSP) responder for that single certificate✓ Answer
    • D.Recomputing the certificate's hash and comparing it with the CA's public key

    A CRL is a batch list the CA publishes on a schedule, so a certificate revoked minutes ago may not appear until the next publication and the file can grow large. OCSP asks the responder about one certificate in real time, returning a fresher answer at the cost of revealing to the CA which site the client is visiting. Expiration dates are a separate check and say nothing about revocation.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Certificates: certificate revocation lists (CRLs), OCSPReport a problem with this question

35. 35. A company hosts www.example.com, mail.example.com, and shop.example.com. Which single certificate covers all three with the least administrative overhead?

    • A.A self-signed certificate generated separately on each of the three servers
    • B.A code signing certificate issued to the company
    • C.A wildcard certificate issued for *.example.com✓ Answer
    • D.A wildcard certificate that also covers example.net and example.org

    A wildcard certificate secures unlimited first-level subdomains of one registered domain, so *.example.com covers all three hosts with a single certificate and one renewal. A wildcard cannot span different domain names — that requires a certificate listing each name in the subject alternative name field. Self-signed certificates would trigger trust warnings for external users, and code signing certificates sign software, not TLS sessions.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Certificates: wildcard, self-signed vs. third-partyReport a problem with this question

36. 36. Users of an internal web application receive a browser warning that the site's certificate is not trusted, even though the certificate has not expired and the hostname matches. What is the MOST likely cause?

    • A.The certificate is self-signed, or was issued by a CA whose root is not in the clients' trust store✓ Answer
    • B.The certificate was issued with a wildcard name
    • C.The server keeps the certificate's private key in local storage
    • D.The client's OCSP check returned a status of "good"

    Certificate validation walks the chain from the presented certificate through any intermediate CAs up to a root that is already installed in the operating system or browser trust store. If that chain does not terminate in a trusted root — the usual result of a self-signed certificate or a private internal CA whose root was never distributed — the client rejects it even though the dates and hostname are fine.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Certificates: root of trust, self-signed vs. third-partyReport a problem with this question

37. 37. A single corporate laptop must support full-disk encryption with keys bound to that specific machine and validated during boot. Which component is designed for this?

    • A.A Trusted Platform Module (TPM) on the laptop's system board✓ Answer
    • B.A certificate revocation list distributed to the laptop
    • C.An enterprise key management system (KMS) hosted in the cloud
    • D.A rack-mounted hardware security module (HSM) in the data center

    A TPM is a chip on one computer's system board that holds device-specific keys and measures boot components, which is exactly what full-disk encryption needs to release the volume key only on that unmodified machine. HSMs serve many servers with high-volume cryptographic operations, and a KMS centrally manages key lifecycle across an organization; neither is scoped to a single endpoint's boot process.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Tools: TPM, HSM, key management system, secure enclaveReport a problem with this question

38. 38. A payment processor must offload thousands of cryptographic operations per second and store the keys in tamper-resistant hardware shared by many application servers. Which solution is the BEST fit?

    • A.A hardware security module (HSM) appliance serving the server farm✓ Answer
    • B.The secure enclave inside an administrator's smartphone
    • C.Key escrow with an outside law firm holding the key material
    • D.A Trusted Platform Module (TPM) installed in one of the application servers

    An HSM is dedicated, tamper-resistant hardware built to generate and store keys and to perform high-volume cryptographic operations for many systems at once, which is why data centers and payment environments use it. A TPM protects only the single device it is soldered into, and a secure enclave is an isolated co-processor protecting keys inside one phone or laptop. Escrow addresses recoverability, not throughput.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Tools: TPM, HSM, key management system, secure enclaveReport a problem with this question

39. 39. A database table contains one column of national identification numbers; the remaining columns are not sensitive and applications must continue querying them normally. Which encryption level is MOST appropriate?

    • A.Partition-level encryption of the operating system volume
    • B.Full-disk encryption on the database server
    • C.Record- or field-level encryption applied to that column✓ Answer
    • D.Transport encryption between the application and the database

    Encryption should be scoped to the exposure you are trying to close. Record- or field-level encryption protects just the sensitive column while leaving the rest of the table queryable, and the data stays protected even from users who can read the database. Full-disk and partition encryption only protect media that is powered off or removed, and transport encryption protects data in motion, not the stored values.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Encryption levels: full-disk, partition, file, volume, database, recordReport a problem with this question

40. 40. A retailer replaces stored card numbers with randomly generated values that have no mathematical relationship to the originals and are mapped in a separate vault. Which technique is this, and what is its defining property?

    • A.Hashing — the replacement value is a one-way digest of the card number
    • B.Tokenization — no encryption algorithm or key is involved, and it removes systems from compliance scope✓ Answer
    • C.Masking — the replacement value shows the last four digits to support staff
    • D.Encryption — the replacement value can be reversed with the data encryption key

    Tokenization swaps sensitive data for an unrelated placeholder and keeps the mapping in a protected vault, so the token itself carries no recoverable information — there is no algorithm and no key to steal. Because the token is meaningless outside the vault, systems that handle only tokens fall outside the compliance scope that would apply to real card data, which is the main business driver for using it.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 1.4 — Obfuscation: steganography, tokenization, data maskingReport a problem with this question

41. 41. A clinic stores patient treatment records that are governed by a national health-privacy law. How should this information be categorized, and what does that categorization drive?

    • A.Non-human-readable data — because it is stored in a database
    • B.Trade secret — its value comes from being kept undisclosed indefinitely
    • C.Intellectual property — protection comes from patent and copyright registration
    • D.Regulated data — an external law dictates mandatory controls, retention, and breach notification✓ Answer

    Regulated data is any data whose handling is dictated by an outside law or standard, and that external mandate — not internal preference — sets the required controls, retention periods, and breach-notification duties. Trade secrets and intellectual property derive protection from secrecy or registration rather than statute, and human- versus non-human-readable describes the format of the data, not its legal obligations.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 3.3 Protecting data — Data types: regulated, trade secret, intellectual propertyReport a problem with this question

42. 42. Sensitive customer records are decrypted into memory while an application processes them. Which control BEST protects the data while it is in this state?

    • A.Nightly encrypted backups replicated to an offsite facility
    • B.Transport Layer Security (TLS) between the client and the application
    • C.Processing inside a secure enclave, with values tokenized or masked in memory✓ Answer
    • D.Full-disk encryption on the server's storage volumes

    Data in use is the hardest state to protect because the data must be in plaintext for the processor to work with it, so at-rest and in-transit controls simply do not apply. The defenses are hardware isolation such as a secure enclave, memory protection, strict access control, and reducing the sensitivity of what is loaded by tokenizing or masking values before they reach memory.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 3.3 Protecting data — Data states: data at rest, data in transit, data in useReport a problem with this question

43. 43. A national regulator requires that citizen records never be stored outside the country's borders. Which action BEST satisfies this requirement?

    • A.Hashing the records before replicating them to worldwide data centers
    • B.Adding real-time certificate revocation checking to the application's TLS configuration
    • C.Selecting cloud regions and data centers located inside that country and enforcing geographic restrictions✓ Answer
    • D.Increasing the encryption key length used on the existing storage systems

    This is a data sovereignty requirement: data is subject to the laws of the country where it physically resides, so the compliance answer is to control location, not to add more cryptography. Choosing in-country regions and enforcing geographic restrictions on storage and replication keeps the data within the legal boundary; stronger keys or hashing do nothing about where the bytes sit.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 3.3 Protecting data — Data sovereignty; geographic restrictionsReport a problem with this question

44. 44. An analyst must stop employees from emailing spreadsheets that contain customer card numbers to personal accounts. Which technology is designed for this purpose?

    • A.Hashing each outbound attachment so its integrity can be verified
    • B.Data loss prevention (DLP), which inspects content and blocks unauthorized transfers✓ Answer
    • C.Full-disk encryption deployed on every employee laptop
    • D.Key escrow of every employee's file encryption keys

    DLP inspects data at rest, in transit, and in use against content rules and blocks or quarantines transfers that match, which is why it is the control for stopping sensitive data from leaving the organization. Encryption is the complementary control: it protects the data if it does get out, but it does nothing to prevent an authorized user from sending it. Hashing and escrow address integrity and recoverability, not exfiltration.

    Source: CompTIA Security+ SY0-701 Exam Objectives, 3.3 Methods to secure data; 4.4/4.5 data loss prevention (DLP)Report a problem with this question

Practice questions based on the CompTIA Security+ SY0-701 exam objectives. This is an independent study tool, not affiliated with or endorsed by CompTIA, and does not grant certification. About Security+ →