44 Security Operations & Identity/Access Mgmt Practice Questions & Answers

1. 1. A security analyst reviewing the SIEM sees a single user account authenticate successfully from an IP address in Chicago and, eleven minutes later, from an IP address in Warsaw. Which indicator of malicious activity does this BEST describe?

   • A.Account lockout
   • B.Out-of-cycle logging
   • C.Impossible travel✓ Answer
   • D.Concurrent session usage

   Impossible travel is the indicator raised when the same identity authenticates from two locations separated by a distance that cannot be physically covered in the elapsed time, which implies the credentials are in more than one party's hands. Concurrent session usage flags simultaneous active sessions regardless of geography, out-of-cycle logging refers to log entries generated outside normal operational windows, and account lockout is a threshold-based indicator tied to repeated failed authentications.

   Source: CompTIA Security+ Objective 2.4 — Indicators: impossible travel, concurrent session usage, out-of-cycle logging, account lockoutReport a problem with this question

2. 2. An endpoint protection platform alerts that a file dropped into a user's download folder matches a malicious signature. Which automated alert response is the standard FIRST action?

   • A.Open a change request to update the antivirus engine
   • B.Quarantine the file so it cannot execute or spread✓ Answer
   • C.Tune the alert rule to suppress similar detections
   • D.Archive the endpoint logs for long-term retention

   Quarantine is the standard automated first response to a malicious-file detection because it neutralizes the threat immediately by moving the file to an isolated store where it cannot be executed or replicated, while preserving it for later analysis. Alert tuning is a fidelity activity performed after validation, archiving is a retention activity, and a change request delays containment without reducing the immediate risk.

   Source: CompTIA Security+ Objective 4.4 — Alert response and remediation/validation: quarantine, alert tuningReport a problem with this question

3. 3. A vulnerability scan of a production database server reports a critical flaw, but the platform team confirms the affected service was never installed on that host. How should the analyst classify and handle this result?

   • A.False negative — replace the scanner with an agentless solution
   • B.True positive — escalate for emergency patching
   • C.False negative — increase scan frequency on the host
   • D.False positive — document the confirmation and consider a credentialed scan to reduce recurrence✓ Answer

   A false positive is a finding the scanner reports that does not actually exist on the target, and confirmation is the analysis step that resolves it; credentialed scans authenticate to the host and read actual package and configuration data, so they produce far fewer false positives than banner or fingerprint inference. A false negative is the opposite error — a real vulnerability the scanner missed — and is not what occurred here.

   Source: CompTIA Security+ Objective 4.3 — Analysis: confirmation (false positive, false negative)Report a problem with this question

4. 4. Ransomware has begun encrypting files on several servers in one network segment. Following the incident response process, what should the team do immediately after detection and analysis confirm the activity?

   • A.Hold a lessons learned meeting to capture the root cause
   • B.Contain the incident by isolating the affected segment and disabling compromised accounts✓ Answer
   • C.Recover operations by restoring the encrypted data from backup
   • D.Eradicate the malware by reimaging every affected server

   Containment follows detection and analysis because its purpose is to stop the spread and limit damage while evidence is still intact; eradication cannot safely begin while the threat is still propagating, and recovery and lessons learned come later in the sequence. Isolating the segment and disabling compromised accounts removes the attacker's reach without destroying the artifacts needed for root cause analysis.

   Source: CompTIA Security+ Objective 4.8 — Incident response process: preparation, detection, analysis, containment, eradication, recovery, lessons learnedReport a problem with this question

5. 5. An organization needs to prove what data left the network during a suspected exfiltration event, including the contents of the transferred files. Which data source is required?

   • A.Firewall connection logs
   • B.NetFlow records
   • C.SNMP trap history
   • D.Full packet capture✓ Answer

   Only a full packet capture stores the payload of the traffic, which is what allows an investigator to reconstruct the actual content that was transferred. NetFlow, firewall logs and SNMP traps all record metadata — source and destination addresses, ports, byte counts, timestamps, device state — which can prove that a transfer occurred and how large it was, but never what was inside it.

   Source: CompTIA Security+ Objective 4.9 — Data sources: packet captures; Objective 4.4 — Tools: NetFlowReport a problem with this question

6. 6. A vendor has confirmed a serious flaw in an industrial control system component but will not release a patch for several months, and the system cannot be taken offline. What is the MOST appropriate response?

   • A.Apply compensating controls such as network segmentation and enhanced monitoring, and record a documented exception✓ Answer
   • B.Remove the component from the asset inventory so it stops appearing in scan reports
   • C.Mark the finding as a false positive because no remediation is available
   • D.Accept the risk informally and revisit it when the patch is released

   When patching is unavailable, the vulnerability management response is a compensating control that reduces exposure plus a formally documented exception or exemption so the residual risk has an owner and a review date. Informal acceptance leaves no accountability, removing the asset from inventory destroys the visibility that vulnerability management depends on, and a confirmed vendor-acknowledged flaw is by definition not a false positive.

   Source: CompTIA Security+ Objective 4.3 — Response and remediation: compensating controls, exceptions and exemptions, segmentationReport a problem with this question

7. 7. After a suspected intrusion on a workstation, a forensic examiner must acquire evidence. Which acquisition approach best preserves evidentiary value?

   • A.Capture the most volatile data first, then image the disk using a write blocker and hash the image✓ Answer
   • B.Run antivirus removal first so the malware cannot alter the disk during imaging
   • C.Reboot the system into safe mode, then copy the suspicious files to a shared drive
   • D.Image the disk first and collect memory afterward if time permits

   Volatile evidence such as memory contents, running processes and network connections is lost the moment the system is powered off or rebooted, so it must be collected before non-volatile media; a write blocker prevents any modification of the source drive during imaging, and hashing the image establishes the integrity that makes the copy defensible. Rebooting, copying files by hand, or running removal tools all alter or destroy evidence.

   Source: CompTIA Security+ Objective 4.8 — Digital forensics: acquisition, preservation, reportingReport a problem with this question

8. 8. A company is retiring solid-state drives that held regulated customer data. The drives will be sold to a recycler. Which disposal method is appropriate?

   • A.Overwrite the free space on each drive with a single pass of random data
   • B.Cryptographic erase or a vendor-supported secure sanitize command, with a certificate of sanitization retained✓ Answer
   • C.Degauss each drive with a magnetic field generator
   • D.Delete the partitions and perform a quick format before shipment

   Degaussing manipulates magnetic domains and therefore has no effect on flash memory, and SSD wear leveling and over-provisioning mean partition deletion, quick format and free-space overwrites all leave recoverable data in cells the operating system cannot address. Cryptographic erase destroys the drive's encryption key so the remaining ciphertext is unrecoverable, and it sanitizes rather than destroys, which is what allows the media to be reused or resold; the certificate documents that sanitization occurred.

   Source: CompTIA Security+ Objective 4.2 — Disposal/decommissioning: sanitization, destruction, certificationReport a problem with this question

9. 9. A SOC reports that analysts are dismissing alerts without investigating because the queue is dominated by benign detections from a backup job. Which action BEST addresses the underlying problem?

   • A.Tune the alert rules so the known-benign backup behavior no longer generates alerts✓ Answer
   • B.Add a second SIEM data feed to provide more context on each alert
   • C.Increase the log retention period so dismissed alerts can be reviewed later
   • D.Lower the severity threshold so more events are captured for correlation

   Alert tuning is the activity that raises signal fidelity by suppressing or refining rules that fire on known-benign activity, and it is the direct remedy for alert fatigue because analysts disengage when the false-positive rate is high. Longer retention, more feeds and a lower threshold all increase the volume or cost of the queue without improving the ratio of actionable alerts.

   Source: CompTIA Security+ Objective 4.4 — Activities: alerting, alert response and remediation/validation (alert tuning)Report a problem with this question

10. 10. An organization's domain is being spoofed in phishing campaigns. The team has already published a record listing authorized sending IP addresses and configured message signing. What remains to be configured so receiving mail servers are told to reject unauthenticated mail claiming the domain?

    • A.A second SPF record covering the mail gateway
    • B.DNSSEC signing for the organization's zone
    • C.DKIM key rotation on the outbound gateway
    • D.DMARC with a reject policy✓ Answer

    SPF authorizes sending IP addresses and DKIM cryptographically signs the message, but neither tells a receiver what to do when a check fails or ties the result to the visible From domain — DMARC does both, publishing the alignment requirement, the policy (none, quarantine or reject) and the reporting address. DNSSEC protects DNS record integrity generally and does not govern message authentication decisions.

    Source: CompTIA Security+ Objective 4.5 — Email security: DMARC, DKIM, SPF, gatewayReport a problem with this question

11. 11. Authentication logs show a single failed login attempt against roughly 900 distinct accounts using the same common password, spread over several hours. What is occurring?

    • A.Credential replay
    • B.Password spraying✓ Answer
    • C.A birthday attack
    • D.Traditional brute force

    Password spraying tries one or a few common passwords across a large number of accounts precisely so that no single account accumulates enough failures to trigger a lockout threshold, which is why the pattern is wide and shallow. Brute force is the inverse — many password guesses against one account — credential replay reuses captured valid authentication material, and a birthday attack targets hash collisions rather than login attempts.

    Source: CompTIA Security+ Objective 2.4 — Password attacks: spraying, brute forceReport a problem with this question

12. 12. A development team wants to find insecure coding patterns such as unsanitized input handling before the application is ever executed. Which technique fits?

    • A.Package monitoring of third-party dependencies
    • B.An uncredentialed vulnerability scan of the web server
    • C.Dynamic analysis against the running application
    • D.Static application security analysis of the source code✓ Answer

    Static analysis inspects source or compiled code without running it, so it can flag source-level defects like missing input validation at the earliest and cheapest point in development. Dynamic analysis by definition requires a running instance and surfaces runtime and configuration flaws instead, package monitoring addresses supply-chain risk in dependencies, and an uncredentialed scan examines the exposed service rather than the code.

    Source: CompTIA Security+ Objective 4.3 — Identification methods: application security (static analysis, dynamic analysis, package monitoring)Report a problem with this question

13. 13. Which statement correctly distinguishes CVE from CVSS in a vulnerability management program?

    • A.CVE is the unique identifier assigned to a specific flaw; CVSS is the numeric severity score assigned to it✓ Answer
    • B.CVE ranks vulnerabilities by exploitability; CVSS lists affected product versions
    • C.CVE is the severity score; CVSS is the vendor's patch identifier
    • D.Both are severity scores, but CVSS applies only to web applications

    CVE provides a catalog identifier so that every tool and vendor can refer to the same flaw unambiguously, while CVSS provides a scoring framework whose base, temporal and environmental metric groups produce a severity value on a 0.0 to 10.0 scale. Conflating the two is a common error: the identifier carries no severity information and the score carries no identity information.

    Source: CompTIA Security+ Objective 4.3 — Analysis: CVSS, CVE, vulnerability classificationReport a problem with this question

14. 14. An enterprise is deploying a new wireless network and wants to eliminate the offline dictionary attacks possible against a captured pre-shared key handshake. Which configuration achieves this?

    • A.WPA2 with MAC address filtering and a hidden SSID
    • B.WPA2 with a 20-character pre-shared key
    • C.WPA3, which uses Simultaneous Authentication of Equals✓ Answer
    • D.WPA2 with the pre-shared key rotated monthly

    WPA3 replaces the WPA2 four-way handshake with SAE, a password-authenticated key exchange that never exposes a value an attacker can test offline, so capturing the handshake yields nothing to crack. Longer or rotated pre-shared keys only raise the cost of the offline attack rather than removing it, and MAC filtering and SSID hiding are trivially defeated because both values are visible in unencrypted frames.

    Source: CompTIA Security+ Objective 4.1 — Wireless security settings: WPA3, cryptographic protocolsReport a problem with this question

15. 15. A security team wants to proactively search enterprise telemetry for signs of an adversary that no alert has fired on, working from a hypothesis about attacker behavior. What is this activity called?

    • A.Root cause analysis
    • B.Continuous vulnerability scanning
    • C.Threat hunting✓ Answer
    • D.A simulation exercise

    Threat hunting is proactive and hypothesis-driven: it assumes a compromise may already exist and searches data for evidence rather than waiting for a detection rule to fire, which is precisely what distinguishes it from alert-driven detection. Root cause analysis explains a known incident after the fact, a simulation is a preparedness test, and vulnerability scanning finds weaknesses rather than adversary activity.

    Source: CompTIA Security+ Objective 4.8 — Threat hunting; root cause analysis; testingReport a problem with this question

16. 16. Legal counsel notifies the security team that litigation is anticipated involving a specific business unit's email and file shares. What must the team do FIRST?

    • A.Issue a legal hold that suspends routine deletion and retention purges for the affected data✓ Answer
    • B.Begin e-discovery production of the relevant messages to opposing counsel
    • C.Archive the data to offline media and delete the online copies
    • D.Complete a chain of custody form for every mailbox in the business unit

    A legal hold is triggered by anticipated or pending litigation and its function is to suspend normal data destruction and retention schedules so potentially relevant information is preserved; without it, automated purges can destroy evidence and expose the organization to spoliation claims. E-discovery production comes later in the legal process, chain of custody documents handling of collected evidence, and deleting online copies is exactly the destruction the hold exists to prevent.

    Source: CompTIA Security+ Objective 4.8 — Digital forensics: legal hold, chain of custody, e-discovery, preservationReport a problem with this question

17. 17. An analyst needs to determine whether a specific user account successfully logged on to a Windows server at a given time and whether privileges were elevated. Which log source should be examined?

    • A.The IDS signature match log
    • B.NetFlow records for the server's subnet
    • C.The perimeter firewall log
    • D.The operating system security log on that server✓ Answer

    OS-specific security logs are the authoritative record of logon successes and failures, privilege use, and account and group changes on the host itself, because those events are generated by the local security subsystem. Firewall logs show only connection permit and deny decisions, IDS logs show signature or anomaly matches, and NetFlow shows traffic volume and endpoints — none of them can attribute an interactive logon to a named account.

    Source: CompTIA Security+ Objective 4.9 — Log data: OS-specific security logs, firewall logs, IDS/IPS logs, network logsReport a problem with this question

18. 18. A monitoring appliance is deployed to a network tap and configured to alert on signature matches but not to drop traffic. Which statement about this deployment is accurate?

    • A.It is functioning as an IDS, so it can detect an attack but cannot stop it in progress✓ Answer
    • B.It is functioning as a host-based firewall for the monitored segment
    • C.It performs data loss prevention by inspecting outbound content
    • D.It is functioning as an IPS, and a device failure would block all traffic

    A sensor on a tap or mirror port receives a copy of traffic rather than the traffic itself, so it can only observe and alert — that is the defining behavior of an IDS. An IPS must be placed inline, in the actual traffic path, in order to drop or reset connections, which is also why an inline device's failure mode (fail-open versus fail-closed) matters and a tap-based sensor's does not.

    Source: CompTIA Security+ Objective 4.5 — IDS/IPS; Objective 3.1 — Device attributes: active vs. passive, inline vs. tap/monitorReport a problem with this question

19. 19. A hardening standard is being written for newly provisioned application servers. Which set of measures BEST reflects standard host hardening?

    • A.Disable unnecessary ports and services, remove unneeded software, change default credentials, and enable a host-based firewall and endpoint protection✓ Answer
    • B.Enable every available logging facility, install all optional vendor packages, and grant administrators local logon rights
    • C.Install a second antivirus product alongside the first for defense in depth
    • D.Place the servers behind the perimeter firewall and rely on network segmentation alone

    Hardening reduces the attack surface of the host itself, so the canonical measures are removing what is not needed — services, ports, software — replacing default credentials, and adding local enforcement through a host-based firewall and endpoint protection. Installing optional packages expands the attack surface, perimeter controls do nothing against threats already inside the segment, and running two antivirus engines commonly causes conflicts rather than added protection.

    Source: CompTIA Security+ Objective 2.5 — Hardening techniques; Objective 4.1 — Secure baselines, hardening targetsReport a problem with this question

20. 20. Following remediation of a batch of high-severity findings, the vulnerability management lead must close out the cycle. What is required before the findings can be reported as resolved?

    • A.Update the risk register with the residual risk rating
    • B.Rescan or otherwise verify the affected systems to validate that the remediation worked✓ Answer
    • C.Wait for the next scheduled quarterly scan window
    • D.Notify the vendor that its patch was deployed successfully

    Validation of remediation through rescanning, verification or audit is a required stage of the vulnerability management lifecycle because a patch can fail to apply, be rolled back, or be reverted by a rebuild, and only re-testing proves the exposure is actually gone. Reporting a finding closed on the strength of a deployment record rather than evidence leaves an unverified gap in the environment.

    Source: CompTIA Security+ Objective 4.3 — Validation of remediation: rescanning, audit, verification; reportingReport a problem with this question

21. 21. A company allows employees to use personally owned phones for corporate email. Which statement accurately describes the security trade-off of this model compared with corporate-owned, personally enabled devices?

    • A.It lowers hardware cost but gives the organization the least control over device configuration and data, making containerization through MDM essential✓ Answer
    • B.It removes the need for mobile device management because the employee owns the endpoint
    • C.It gives the organization full control over the operating system image and app inventory on each device
    • D.It guarantees that corporate data can be remotely wiped without affecting personal data

    In a bring-your-own-device model the employee owns and controls the hardware, so the organization cannot dictate the OS image, installed apps or personal data handling, and its enforcement is limited to whatever an MDM container can wrap around corporate data. Full image control is characteristic of corporate-owned deployments, MDM becomes more necessary rather than less, and selective wipe is a capability that must be configured, not an inherent guarantee of the model.

    Source: CompTIA Security+ Objective 4.1 — Mobile solutions: MDM, deployment models (BYOD, COPE, CYOD)Report a problem with this question

22. 22. A security manager wants to test whether the incident response plan's decision-making and escalation paths hold up, at minimal cost and with no impact on production systems. Which exercise should be scheduled?

    • A.A full failover test to the alternate site
    • B.An unannounced penetration test
    • C.A tabletop exercise✓ Answer
    • D.A live simulation with injected malware on a production segment

    A tabletop exercise is discussion-based: participants walk through a scenario verbally against the plan, so it exercises roles, decisions and escalation without touching any system, which makes it the lowest-cost and lowest-risk option. Simulations inject live activity, failover tests move real workloads, and a penetration test evaluates technical exposure rather than the response plan's decision paths.

    Source: CompTIA Security+ Objective 4.8 — Testing: tabletop exercise, simulationReport a problem with this question

23. 23. An employee is terminated at 3:00 p.m. Legal has placed a litigation hold on that department's records, and the employee's mailbox contains project data other staff still need. What is the BEST immediate action for the user's account?

    • A.Reset the password and leave the account enabled so the manager can sign in as the former employee
    • B.Disable the account immediately and reclaim tokens, keys and badges, leaving the data intact✓ Answer
    • C.Leave the account active until the next scheduled quarterly access review
    • D.Delete the account and its mailbox at once so the credentials can never be misused

    De-provisioning practice is to disable, not delete: disabling revokes authentication instantly while preserving the account's data, mailbox and audit trail, which a litigation hold legally requires. Deletion can orphan or destroy that evidence, and letting a manager log in as the former user destroys accountability and non-repudiation. Waiting for a review leaves standing access open during the highest-risk window.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — provisioning/de-provisioning user accounts (offboarding)Report a problem with this question

24. 24. An audit at a financial services firm finds that an analyst who moved through three departments in five years still holds all the entitlements from every prior role. Each grant was properly approved at the time. Which control BEST addresses the underlying problem?

    • A.Deleting and recreating the user's account every time the employee transfers departments
    • B.Recurring access recertification in which resource owners attest that each entitlement is still required✓ Answer
    • C.Increasing the minimum password length and shortening the maximum password age
    • D.Requiring multifactor authentication on all three departmental applications

    This is privilege creep: authorization accumulates because transfers add rights without removing the old ones. Attestation — a periodic, documented review in which the data or resource owner signs off that access is still appropriate — is the control that detects and removes the excess. MFA and password rules strengthen authentication (proving who the user is) and do nothing about excessive authorization, and deleting the account on every transfer destroys history without preventing re-accumulation.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — permission assignments and implications, attestationReport a problem with this question

25. 25. A university research portal must be usable by scientists employed at partner institutions. The requirement states that partner staff authenticate with their own institution's credentials and that the university must not create, store, or reset accounts for them. Which approach BEST meets the requirement?

    • A.Guest accounts created in the local directory with time-of-day restrictions applied
    • B.One shared service account issued per partner institution, with the password rotated monthly
    • C.Federation, so the portal trusts authentication assertions issued by each partner's identity provider✓ Answer
    • D.LDAPS on the internal directory so partner staff can bind to it securely over the internet

    Federation establishes a trust relationship in which each partner's identity provider authenticates its own users and asserts that identity to the relying service provider, so no duplicate accounts, passwords or resets exist at the university. Guest accounts violate the stated constraint, shared service accounts destroy individual accountability, and exposing a directory protocol to partners still requires locally held credentials.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — federation, single sign-on (SSO), interoperabilityReport a problem with this question

26. 26. A hospital is integrating a browser-based third-party scheduling application with its existing enterprise identity provider. The application must receive a digitally signed statement proving which clinician has already been authenticated, so staff sign in once and are not prompted again. Which standard BEST meets this requirement?

    • A.LDAP
    • B.OAuth 2.0
    • C.RADIUS
    • D.SAML✓ Answer

    SAML is the XML-based standard that carries a signed authentication assertion from an identity provider to a service provider, which is exactly the browser-based enterprise SSO pattern described. OAuth 2.0 is an authorization framework: it issues access tokens that delegate access to resources and by itself proves nothing about who the user is (OpenID Connect is the identity layer added on top of OAuth for that purpose). LDAP is a directory access and lookup protocol, and RADIUS is a centralized AAA protocol for network access, not browser SSO.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — SAML, OAuth, single sign-on (SSO); OpenID Connect as the identity layer over OAuth 2.0Report a problem with this question

27. 27. A manufacturer requires that no account of any kind — operator, engineer, or administrator — be able to log into plant control systems between 22:00 and 05:00, when automated maintenance runs. The restriction is enforced by the system itself and applies uniformly to everyone. Which access control model is described?

    • A.Discretionary access control
    • B.Rule-based access control✓ Answer
    • C.Mandatory access control
    • D.Role-based access control

    Rule-based access control applies system-enforced conditional rules — such as time-of-day restrictions or firewall ACLs — identically to all subjects regardless of who they are. Role-based control would vary the outcome by job role, which the scenario explicitly rules out; the two share the abbreviation RBAC and are a deliberate exam trap. Discretionary control lets the resource owner set permissions, and mandatory control decides access by comparing security labels to clearances.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — access controls: rule-based, role-based, time-of-day restrictionsReport a problem with this question

28. 28. A defense contractor must permit access to a design repository only when the requester belongs to the Engineering department, is using a company-managed device that passed a posture check, is connecting from a corporate IP range, and is doing so during business hours. All four conditions must be evaluated at each request. Which access control model BEST satisfies this?

    • A.Role-based access control (RBAC)
    • B.Mandatory access control (MAC)
    • C.Discretionary access control (DAC)
    • D.Attribute-based access control (ABAC)✓ Answer

    ABAC evaluates a policy over multiple attributes of the subject, the device, the resource and the environment at the moment of the request, which is the only model in the list that can combine department, device posture, network location and time in a single decision. RBAC keys the decision to job role alone, DAC leaves it to the resource owner's discretion, and MAC decides by comparing classification labels to user clearances.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — access controls: attribute-based, role-based, discretionary, mandatoryReport a problem with this question

29. 29. To satisfy a cyber-insurance questionnaire that requires multifactor authentication on the customer portal, a firm configures login to require a password, then a 6-digit PIN, and finally a security question. What should an assessor conclude?

    • A.The requirement is met, because three separate credentials exceed the two required for MFA
    • B.The requirement is not met, because MFA is only satisfied by a biometric factor
    • C.The requirement is not met, because all three credentials are the same factor: something you know✓ Answer
    • D.The requirement is met, provided the PIN is regenerated every 30 days

    Multifactor authentication requires credentials from at least two different factor categories — something you know, something you have, something you are (plus attributes such as somewhere you are). A password, a PIN and a security answer are all knowledge, so a single phishing or database compromise defeats all three at once; adding more of the same factor adds steps, not factors. Biometrics is one valid implementation but is not the only one, since a hardware token or security key also supplies a distinct factor.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — multifactor authentication: factors (something you know / have / are) vs implementationsReport a problem with this question

30. 30. A company suffers two related incidents: attackers port employees' phone numbers to their own SIM cards and intercept one-time codes, and separately flood users with repeated push approval prompts until someone taps Approve. Which change BEST reduces both risks?

    • A.Lengthen the one-time code from six digits to eight digits
    • B.Deliver the same one-time codes by automated voice call instead of SMS
    • C.Issue FIDO2 hardware security keys and require them as the second factor✓ Answer
    • D.Shorten the password expiration interval to 30 days for all users

    Both attacks target a transmitted secret or a blind approval: SIM swapping steals codes sent out of band, and push-bombing exploits a prompt the user can accept without context. A FIDO2 security key performs origin-bound public-key authentication, so there is no code to intercept and no prompt that can be approved for an attacker's session, which is why it is the phishing-resistant implementation. Voice delivery shares SMS's telecom weaknesses, longer codes do not stop interception, and password rotation addresses neither attack.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — MFA implementations: security keys, hard/soft tokens, biometrics; risks of SMS-based one-time codesReport a problem with this question

31. 31. A build pipeline deploys to production using an administrator password stored in a configuration file, which has not been rotated in two years. Which privileged access management improvement BEST removes the standing risk?

    • A.Require an engineer to type the administrator password manually at the start of every deployment
    • B.Keep the stored password but rotate it quarterly and restrict which engineers can read the file
    • C.Have the pipeline request short-lived ephemeral credentials from a vault at run time, expiring automatically when the job ends✓ Answer
    • D.Move the administrator password into an encrypted spreadsheet shared with the whole build team

    Ephemeral, just-in-time credentials issued by a vault eliminate standing privilege: the secret exists only for the duration of the job, is unique per run, and cannot be reused if the configuration is later exposed. Rotating a stored static secret shortens the exposure window but leaves a long-lived credential in a file, and manual entry or a shared spreadsheet reintroduces a human-known shared password that breaks accountability and cannot scale to automation.

    Source: CompTIA Security+ exam objectives, 4.6 Identity and Access Management — privileged access management tools: just-in-time permissions, password vaulting, ephemeral credentialsReport a problem with this question

32. 32. A cloud platform team wants engineers to be blocked automatically at deployment time from creating storage buckets that are publicly readable, rather than having the misconfiguration found weeks later in a review. Which automation and orchestration use case does this describe?

    • A.Continuous integration and testing
    • B.Escalation
    • C.Guard rails✓ Answer
    • D.Ticket creation

    Guard rails are automated policy checks embedded in the deployment path that evaluate a requested action against policy and block or correct it before it takes effect, which is preventive rather than detective. Ticket creation and escalation are workflow automations that react after something is flagged, and continuous integration and testing validate code quality and builds rather than enforcing a security configuration policy at provisioning time.

    Source: CompTIA Security+ exam objectives, 4.7 Automation and orchestration — use cases: guard rails, ticket creation, escalationReport a problem with this question

33. 33. Over two years, a small security team built one in-house orchestration platform that now provisions all accounts, applies all system baselines, and opens all tickets. It has no documentation, and the two engineers who wrote it have resigned. Which consideration should the risk assessment raise FIRST?

    • A.The platform delivers faster reaction time to security events
    • B.The platform is now a single point of failure carrying technical debt and unclear ongoing supportability✓ Answer
    • C.The platform acts as a workforce multiplier for a small team
    • D.The platform enforces standard infrastructure configurations across systems

    The question asks for a risk, and the other three options are recognized benefits of automation. Concentrating provisioning, baselines and ticketing in one undocumented system means its failure halts every dependent process, while the loss of its only maintainers converts convenience into technical debt and a supportability problem — the downside considerations that accompany automation alongside complexity and cost.

    Source: CompTIA Security+ exam objectives, 4.7 Automation and orchestration — other considerations: complexity, cost, single point of failure, technical debt, ongoing supportabilityReport a problem with this question

34. 34. After automating onboarding and server builds, a three-person security team supports twice as many users without adding headcount, and every new server is deployed from the same hardened template with identical settings. Which pair of benefits BEST describes these two outcomes, in order?

    • A.Guard rails, and ticket creation
    • B.Continuous integration, and escalation
    • C.Technical debt, and complexity
    • D.Workforce multiplier, and enforcing baselines✓ Answer

    A workforce multiplier is automation that lets the same staff cover substantially more work, and enforcing baselines (standard infrastructure configurations) is automation that makes every deployed system match an approved secure build. The other pairs are miscategorized: guard rails, ticket creation, continuous integration and escalation are use cases rather than benefits, and technical debt and complexity are downside considerations.

    Source: CompTIA Security+ exam objectives, 4.7 Automation and orchestration — benefits: workforce multiplier, enforcing baselines, standard infrastructure configurationsReport a problem with this question

35. 35. A security officer publishes three documents: (1) a mandatory statement that all company data must be protected in proportion to its classification; (2) a mandatory requirement that data at rest be encrypted with AES-256; (3) a numbered set of steps a technician follows to encrypt a laptop. In order, what are these three documents?

    • A.Policy, procedure, guideline
    • B.Standard, policy, guideline
    • C.Guideline, procedure, policy
    • D.Policy, standard, procedure✓ Answer

    Governance documents form a hierarchy by specificity and enforceability: a policy is the high-level mandatory statement of intent (what and why), a standard is the mandatory specific requirement that implements it (such as a named algorithm or minimum length), and a procedure is the mandatory step-by-step instruction for carrying it out. A guideline, by contrast, is recommended rather than mandatory, which is why it cannot describe any of the three items here.

    Source: CompTIA Security+ exam objectives, 5.1 Security governance — policies, standards, procedures, guidelinesReport a problem with this question

36. 36. A retailer collects customer contact data and decides both why the data is collected and how it will be used. It engages an email-marketing vendor that sends campaigns strictly according to the retailer's written instructions and is contractually barred from using the data for its own purposes. Which roles apply?

    • A.The retailer is the data controller and the vendor is the data processor✓ Answer
    • B.Both organizations are data controllers because both handle the data
    • C.The retailer is the data custodian and the vendor is the data owner
    • D.The retailer is the data processor and the vendor is the data controller

    The controller is the party that determines the purposes and the means of processing, and the processor acts only on the controller's documented instructions with no independent use of the data — which is exactly the split described. Because the controller sets the purpose, accountability to the data subject stays with the retailer even though the vendor performs the work; a custodian, by contrast, is the technical handler inside an organization and an owner is the accountable senior manager, neither of which matches a contracted third party.

    Source: CompTIA Security+ exam objectives, 5.1 Security governance — roles and responsibilities (owner, controller, processor, custodian/steward); 5.4 privacy: controller vs processorReport a problem with this question

37. 37. A distribution center's conveyor control system is valued at $400,000. Flood modeling estimates that a flood would destroy 50% of that value, and historical records show a flood of that severity occurs about once every four years. What is the annualized loss expectancy (ALE)?

    • A.$800,000
    • B.$100,000
    • C.$200,000
    • D.$50,000✓ Answer

    Single loss expectancy is asset value times exposure factor, so SLE = $400,000 x 0.50 = $200,000. The annualized rate of occurrence expresses the frequency per year, so once every four years is an ARO of 0.25, not 4. ALE = SLE x ARO = $200,000 x 0.25 = $50,000; answering $200,000 mistakes the SLE for the ALE, and $800,000 comes from multiplying by 4 instead of dividing.

    Source: Quantitative risk analysis formulas: SLE = AV x EF; ALE = SLE x ARO — CompTIA Security+ exam objectives, 5.2 Risk management process (quantitative risk analysis)Report a problem with this question

38. 38. A risk register entry for laptop theft records an annualized loss expectancy of $60,000, based on 24 thefts per year. A proposed full-disk encryption and asset-tracking program would cost $45,000 per year and is expected to eliminate the loss. What is the single loss expectancy, and is the control justified?

    • A.SLE is $1,440,000; implement the control, because the loss is enormous
    • B.SLE is $2,500; reject the control, because its cost far exceeds the loss from a single theft
    • C.SLE is $2,500; implement the control, because its annual cost is less than the annualized loss it prevents✓ Answer
    • D.SLE is $60,000; reject the control, because cost and loss are effectively equal

    Because ALE = SLE x ARO, the stem can be inverted: SLE = ALE / ARO = $60,000 / 24 = $2,500. A control is financially justified when its annualized cost is less than the annualized loss it removes, so $45,000 per year against a $60,000 ALE yields roughly $15,000 of expected annual benefit. Comparing the control's annual cost to a single loss expectancy is the classic error, since the control prevents all 24 events per year, not one.

    Source: Quantitative risk analysis: ALE = SLE x ARO (inverted as SLE = ALE / ARO); cost-benefit rule that annual control cost should be below ALE — CompTIA Security+ exam objectives, 5.2 Risk management processReport a problem with this question

39. 39. A board of directors declares that the organization will pursue an expansionary posture toward new markets and is willing to take on a broadly higher level of risk to grow. Separately, the risk committee sets a documented limit stating that no individual project may carry more than a defined level of unmitigated exposure before it must be escalated to the board. Which terms describe the two statements?

    • A.The broad posture is the risk tolerance; the documented limit is the risk appetite
    • B.The broad posture is a key risk indicator; the documented limit is the risk register
    • C.Both statements express risk appetite, since both come from governance bodies
    • D.The broad posture is the risk appetite; the documented limit is the risk tolerance or threshold✓ Answer

    Risk appetite is the strategic, qualitative amount of risk an organization is willing to pursue in order to meet objectives, expressed as expansionary, conservative or neutral, and it is set first by senior governance. Risk tolerance is the acceptable variance around that appetite — the operational threshold at which a specific risk must be escalated or treated. A key risk indicator is a metric that warns when a threshold is being approached, and the risk register is the document that records risks, owners and thresholds rather than a limit itself.

    Source: CompTIA Security+ exam objectives, 5.2 Risk management process — risk appetite (expansionary, conservative, neutral), risk tolerance, risk threshold, key risk indicators, risk registerReport a problem with this question

40. 40. A business impact analysis concludes that the billing system must be restored to service within 4 hours of an outage and that the business can tolerate losing no more than 15 minutes of committed transactions. How should these two figures be classified, and what does the 15-minute figure primarily drive?

    • A.4 hours is the RPO and 15 minutes is the RTO, which sets on-call staffing levels
    • B.4 hours is the MTTR and 15 minutes is the MTBF, both measured from vendor statistics
    • C.Both figures are MTBF values used to report system reliability to the board
    • D.4 hours is the RTO and 15 minutes is the RPO, which sets how frequently backups or replication must run✓ Answer

    The recovery time objective is the maximum tolerable time to restore service, and the recovery point objective is the maximum tolerable amount of data loss expressed as time, so the backup or replication interval must be no longer than the RPO. Both are business-set targets produced by the BIA, whereas mean time to repair and mean time between failures are measured statistics describing maintainability and reliability of a system rather than requirements the business chooses.

    Source: CompTIA Security+ exam objectives, 5.2 Risk management process — business impact analysis: RTO, RPO, MTTR, MTBFReport a problem with this question

41. 41. A company already has a signed master service agreement with a consultancy covering liability, confidentiality and payment terms for the ongoing relationship. It now needs to document the deliverables, milestones and six-week timeline for one specific assessment engagement. Which document should be executed?

    • A.A memorandum of understanding describing the intended assessment
    • B.A second, separate MSA covering only this engagement
    • C.A statement of work or work order executed under the existing MSA✓ Answer
    • D.A business partnership agreement defining each party's ownership stake

    A master service agreement is the umbrella contract that sets the legal terms once for an ongoing relationship, and each specific engagement is then defined by a statement of work or work order that lists scope, deliverables, milestones and schedule under those terms. Issuing a second MSA duplicates the legal framework unnecessarily, an MOU only expresses intent and is generally not binding, and a BPA governs the terms between business partners such as ownership stake and decision authority.

    Source: CompTIA Security+ exam objectives, 5.3 Third-party risk assessment and management — agreement types: MSA, SOW/WO, MOU, BPAReport a problem with this question

42. 42. Two municipal agencies sign a brief document stating their shared intention to exchange threat information and cooperate on incidents. The document contains no measurable performance commitments and explicitly states that it creates no legally enforceable obligations. Which agreement type is this?

    • A.A master service agreement (MSA)
    • B.A service level agreement (SLA)
    • C.A non-disclosure agreement (NDA)
    • D.A memorandum of understanding (MOU)✓ Answer

    An MOU is a broad, informal statement of intent between parties that is generally not legally binding, which matches a document with no metrics and an explicit disclaimer of enforceability. An SLA is defined by measurable service commitments such as uptime percentages or response windows, an MSA is a binding umbrella contract for an ongoing commercial relationship, and an NDA governs the protection of confidential information rather than a cooperative intent.

    Source: CompTIA Security+ exam objectives, 5.3 Third-party risk assessment and management — agreement types: MOU, MOA, SLA, MSA, NDAReport a problem with this question

43. 43. A bank is finalizing terms with a payment-processing vendor. Bank leadership wants the ability to send its own assessors on-site to inspect the vendor's security controls at any point during the relationship. What should the bank do, and when?

    • A.Rely on the vendor's published security web page and request an on-site visit only after an incident
    • B.Negotiate a right-to-audit clause into the contract before it is signed✓ Answer
    • C.Add the audit request to the internal risk register and revisit it at contract renewal
    • D.Send a security questionnaire after go-live and treat the vendor's answers as audit evidence

    A right-to-audit clause is a contractual grant: without it in the signed agreement, the vendor has no obligation to admit the customer's assessors, and asking after signature depends entirely on goodwill. Negotiating it before signing is part of pre-contract due diligence, the investigation of a prospective third party, and it is what makes later ongoing vendor monitoring enforceable. A questionnaire is self-reported evidence rather than an audit, and deferring the request leaves the bank with no inspection rights for the whole contract term.

    Source: CompTIA Security+ exam objectives, 5.3 Third-party risk assessment and management — vendor assessment: right-to-audit clause, independent assessments, due diligence, ongoing monitoringReport a problem with this question

44. 44. A retailer hires an outside firm to simulate an external attacker. The testers are given only the company's name — no network diagrams, IP ranges, or accounts — and they begin by gathering WHOIS records, public DNS data, and employee names from social media without sending any traffic to the retailer's systems. How is this engagement BEST described?

    • A.A defensive (blue team) exercise using passive reconnaissance
    • B.A partially known environment test beginning with active port scanning
    • C.An unknown environment penetration test beginning with passive reconnaissance✓ Answer
    • D.A known environment penetration test beginning with active reconnaissance

    An unknown environment test gives the testers no inside information, which is what makes it a realistic simulation of an external attacker; a known environment test supplies full documentation and a partially known test supplies some. Passive reconnaissance gathers open-source information such as WHOIS, DNS and social media without interacting directly with the target, so it generates no traffic the defenders can detect, whereas active reconnaissance means direct probing such as port scans or banner grabbing. A blue team exercise is the defensive side, not the simulated attacker.

    Source: CompTIA Security+ exam objectives, 5.5 Audits and assessments — penetration testing: known, partially known, and unknown environments; passive vs active reconnaissanceReport a problem with this question

Practice questions based on the CompTIA Security+ SY0-701 exam objectives. This is an independent study tool, not affiliated with or endorsed by CompTIA, and does not grant certification. About Security+ →