Security+ Practice Exam.
Free practice test — 33 verified questions, instant feedback.

Answer: B
Non-repudiation combines integrity and authentication (typically via digital signatures) so the sender cannot deny having sent the message. Confidentiality only protects against disclosure, availability ensures access to systems/data, and obfuscation merely hides data's meaning without providing proof of origin or authorship.

Answer: B
Defense in depth layers multiple independent controls so that failure of one does not expose the whole environment. Security through obscurity relies on secrecy rather than layered controls, least functionality is about disabling unneeded services/ports, and fail-open design intentionally permits access on failure, which is the opposite of this scenario.

Answer: A
Separation of duties splits critical tasks between multiple people to prevent a single person from committing fraud unilaterally. Job rotation and mandatory vacation are detective controls that expose fraud over time by moving people between roles or forcing absence, and least privilege limits the access a single account has rather than dividing a process across roles.

Answer: A
Phishing uses a fraudulent message, typically email, that impersonates a trusted entity to trick the victim into entering credentials on a fake site. Pretexting involves a fabricated scenario used in a direct social engineering conversation rather than a spoofed website, tailgating is physically following someone through a secured door, and a watering hole attack compromises a legitimate site the victim is expected to visit rather than sending a direct impersonation email.

Answer: B
Concatenating unvalidated user input directly into a SQL statement lets an attacker alter the query's logic, which is the definition of SQL injection; the fix is parameterized queries or prepared statements. Cross-site scripting injects script into pages viewed by other users, buffer overflow involves writing past allocated memory bounds, and a race condition exploits timing between concurrent operations, none of which describes unsafely built SQL strings.

Answer: B
High-volume queries to random-looking subdomains are a classic indicator of DNS tunneling used by malware to exfiltrate data or receive commands from a command-and-control server, since DNS is often allowed outbound even when other channels are restricted. DHCP renewal, software updates, and CDN lookups do not generate high-volume randomized subdomain queries to a single unfamiliar domain.

Answer: A
Privilege escalation is gaining higher-level permissions than originally granted, exactly as described. Lateral movement and pivoting involve moving to other hosts or network segments rather than escalating rights on the same machine, and footprinting is early reconnaissance performed before any access is gained.

Answer: A
Double extortion combines encryption with data theft and the threat of public leak, adding a second layer of pressure beyond just withholding decryption. Typosquatting involves registering misspelled domain names, credential stuffing reuses breached credentials at scale, and business email compromise is a targeted social-engineering fraud scheme, none of which match the encrypt-plus-leak-threat pattern described.

Answer: A
A zero-day is a vulnerability that is unknown to the vendor or unpatched, meaning defenders have had zero days to prepare a fix. It is not a known-exploited vulnerability unless active exploitation is confirmed, it is not a false positive since the flaw is real, and a compensating control is a mitigation technique, not a category of vulnerability.

Answer: A
An evil twin is a rogue access point impersonating a legitimate SSID to lure victims into connecting so traffic can be intercepted. Bluejacking targets Bluetooth devices with unsolicited messages, ARP poisoning manipulates layer-2 address tables on an existing network rather than impersonating an SSID, and a deauthentication flood alone only disconnects clients without impersonating the network.

Answer: A
A signed rules-of-engagement agreement defining scope and boundaries is the hallmark of authorized penetration testing, regardless of whether the tester has prior system knowledge (white-box) or not (black-box). An advanced persistent threat is an unauthorized, often nation-state-affiliated long-term intrusion; hacktivism is unauthorized activity motivated by ideology; and insider threat activity originates from a trusted person acting outside authorized bounds.

Answer: A
Hardening is the process of reducing a system's attack surface by disabling unnecessary services, closing unused ports, and removing default accounts. Fuzzing is a testing technique that feeds malformed input to find bugs, threat hunting is proactively searching for signs of compromise, and steganography hides data within other files, none of which describe reducing exposed attack surface.

Answer: A
Segmentation with a controlled boundary isolates sensitive OT/ICS systems from the general corporate network while permitting tightly controlled, monitored data flow across a well-defined chokepoint. A flat network provides no isolation, a full mesh VPN would multiply direct paths between all systems rather than restrict them, and removing firewalls between zones eliminates the very boundary the scenario requires.

Answer: A
Zero trust assumes no implicit trust for any user, device, or service regardless of network location, requiring continuous verification of every request, which matches the gateway enforcing authentication/authorization on every call. An implicit trust model is the opposite, assuming internal traffic is safe; perimeter-only security relies solely on a network edge boundary; and an air-gapped network is physically isolated with no connectivity at all, which does not match a cloud API gateway design.

Answer: A
Tokenization substitutes sensitive data with a non-sensitive token that has no exploitable value outside the secure vault that maps it back to the original, which is exactly the recurring-billing scenario described. Unsalted hashing is not reversible so it cannot be mapped back for legitimate reuse, display-only masking still leaves the real number stored elsewhere, and encrypting the whole database still stores the actual card number, just protected differently, rather than replacing it with a token.

Answer: A
Planning for failover to a secondary site with minimal data loss and downtime is core to resilience and recovery architecture, encompassing high availability, replication, and disaster recovery. Data classification concerns labeling data sensitivity, least privilege concerns access rights scoping, and vulnerability scanning identifies weaknesses rather than ensuring continued operation after an outage.

Answer: A
An HSM is a dedicated, tamper-resistant hardware device built to generate, store, and manage cryptographic keys securely, isolating key material from general-purpose servers. A load balancer distributes traffic across servers, a jump server is a hardened intermediary for administrative access, and a proxy server relays and can filter client requests, none of which are purpose-built for cryptographic key custody.

Answer: A
Determining whether an alert represents a true positive versus benign activity is part of the detection and analysis phase, which occurs before any response action is taken. Eradication removes confirmed malicious artifacts after an incident is validated, lessons learned occurs after the incident closes, and containment limits spread only after malicious activity has been confirmed, all of which come after the triage step described.

Answer: A
Isolating an infected host to stop lateral spread while preserving evidence is the definition of containment. Preparation happens before an incident occurs and involves building capability and plans, post-incident reporting occurs after the incident is resolved, and identification is simply recognizing that an incident occurred, which is distinct from actively isolating the host.

Answer: A
The order of volatility for digital forensics begins with the most transient data (CPU registers/cache), followed by RAM, then local disk storage, and finally offline backups or archival media, which persist the longest. The other options reverse or scramble this sequence, which would risk losing the most fragile evidence before it is captured, violating proper forensic procedure.

Answer: A
Chain of custody is the chronological documentation showing who collected, handled, and analyzed evidence, ensuring its integrity and admissibility. Data minimization limits the amount of personal data collected/retained, a legal hold suspends normal data destruction when litigation is anticipated, and non-repudiation proves the origin of a message rather than tracking evidence handling.

Answer: A
Correlating login timestamps and geolocation across systems to flag physically implausible travel between logins is a classic SIEM use case for impossible travel detection, useful for spotting compromised credentials. DLP inspects data content for policy violations, static application security testing analyzes source code for flaws before runtime, and vulnerability scanning identifies unpatched weaknesses, none of which involve correlating authentication geolocation and timing.

Answer: A
An IPS sits inline with traffic and can actively block or drop packets matching malicious signatures or behavior, unlike a passive IDS which only alerts without intervening. A vulnerability scanner assesses systems for weaknesses rather than inspecting live traffic, and a plain packet sniffer captures traffic for analysis but has no enforcement capability.

Answer: A
NAC solutions perform posture assessment, checking device compliance such as patch level and antivirus status, before granting or restricting network access, exactly matching the scenario. A stateless packet filter only inspects header fields without evaluating device health, a CDN caches and distributes content rather than gating network admission, and a spam filter screens email content and is unrelated to device posture checks.

Answer: A
Risk-based prioritization weighs exploitability, exposure (e.g., internet-facing), and business context alongside a base severity score to decide what to remediate first, rather than relying on severity alone. Alphabetical patching ignores risk entirely, ignoring anything below a fixed CVSS threshold discards context like active exploitation, and waiting for an audit finding is reactive rather than a structured prioritization method.

Answer: A
Audit logs capture who accessed which records and when, and periodic review of those logs allows detection of unauthorized or unnecessary access after the fact. Full-disk encryption protects data at rest from offline theft but doesn't record who viewed live records, rate limiting only throttles authentication attempts, and time synchronization ensures accurate timestamps but by itself does not detect inappropriate access.

Answer: A
A risk appetite or tolerance statement formally documents the level of risk an organization's leadership is willing to accept, guiding decisions about which risks require further mitigation. An incident response playbook details technical response steps, a network diagram documents topology, and a change management ticket records a specific proposed change, none of which capture organizational risk tolerance.

Answer: A
Requiring questionnaires and independent audit evidence (such as a SOC 2 report) before onboarding a vendor is core to third-party/vendor risk management, assessing supply chain risk before granting access or trust. Business continuity planning addresses maintaining operations during disruptions, change management governs internal system modifications, and asset inventory management tracks organizational assets, none of which describe vetting an external vendor's security posture.

Answer: A
Change management formalizes the review, approval, testing, and rollback planning required before implementing changes to reduce the risk of unintended outages or security gaps. Data classification labels information by sensitivity, penetration testing simulates attacks to find weaknesses, and onboarding covers bringing new employees or systems into the organization, none of which describe the structured change-approval workflow described.

Answer: A
Identifying which regional or national laws (such as GDPR for EU residents) govern data handling based on data subject location is a matter of regulatory and jurisdictional compliance. A business impact analysis assesses the operational effect of disruptions, vulnerability scanning cadence concerns technical testing frequency, and awareness training frequency concerns employee education scheduling, none of which relate to determining applicable data protection law.

Answer: A
RTO defines the maximum acceptable duration of downtime after a disruption before unacceptable business impact occurs, directly informing decisions about redundancy and failover investment. MTBF measures average time between failures of a component, ALE estimates yearly expected monetary loss from a risk, and SLE estimates the monetary loss from a single occurrence of a risk event, none of which define an acceptable downtime duration.

Answer: A
Defining data owners, custodians, and classification labels as part of formal policy is data governance, a component of security program management and oversight. Cryptographic key exchange concerns securely establishing shared keys between parties, wireless network configuration concerns radio-based network setup, and malware analysis examines malicious code behavior, none of which involve assigning organizational data roles and classification policy.

Answer: A
Reconciling differing national encryption export laws before deploying a feature across jurisdictions is a legal and regulatory compliance consideration tied to where the company operates. Physical security controls address facility protections, endpoint detection and response concerns host-based threat monitoring, and password complexity policy governs authentication requirements, none of which relate to cross-border legal restrictions on cryptography.