CompTIA Security+ CompTIA Security+ Practice Test 2025

The correct answer is (b) Spear phishing. This is a targeted phishing attack directed at a specific individual within an organization. The attacker has crafted the email to appear as though it comes from the company's own IT department, using a lookalike domain (replacing the letter 'i' with the number '1') to deceive the recipient. Unlike generic phishing, spear phishing targets specific people and uses contextual information about the organization to increase credibility. Vishing refers to voice-based phishing conducted over phone calls. Whaling specifically targets high-level executives. Tailgating is a physical security attack involving following an authorized person through a secured door.

The correct answer is (a) Symmetric encryption (AES-256). Symmetric encryption algorithms such as AES-256 use a single shared key for both encryption and decryption. They are significantly faster than asymmetric algorithms and are therefore ideal for encrypting large volumes of data at rest. Asymmetric encryption (RSA) uses a key pair (public and private) and is computationally expensive, making it impractical for bulk data encryption. Hashing (SHA-256) is a one-way function that produces a fixed-size digest and cannot be reversed to recover the original data, so it is not an encryption method. Digital signatures use asymmetric cryptography to verify authenticity and integrity, not to encrypt data at rest.

The correct answer is (c) A time-based one-time password (TOTP) from an authenticator app. MFA requires factors from at least two different categories: something you know, something you have, and something you are. A password is 'something you know.' A TOTP generated by an authenticator app on a registered device represents 'something you have,' because it requires possession of the device running the authenticator. A security question and a PIN are both 'something you know,' which is the same category as the password and would not constitute true multi-factor authentication. A username is an identifier, not an authentication factor at all.

The correct answer is (b) The traffic will be denied by rule 2. Firewall rules are evaluated in order from top to bottom, and the first matching rule is applied. Rule 1 allows port 443 traffic only from the 10.0.1.0/24 subnet. Since the source host 10.0.2.50 is not in the 10.0.1.0/24 subnet, rule 1 does not match. Rule 2 then matches because it denies TCP traffic from ANY source to ANY destination on port 443, and the packet is dropped. Rules 3 and 4 are never evaluated because rule 2 already matched. The traffic would not be allowed by rule 3 because rule 3 applies to port 80, not port 443.

The correct answer is (c) Containment. The NIST SP 800-61 incident response lifecycle consists of four phases: (1) Preparation, (2) Detection and Analysis, (3) Containment, Eradication, and Recovery, and (4) Post-Incident Activity. Since the team has already detected the incident and analyzed it to identify the scope (completing the Detection and Analysis phase), the next step is Containment. Containment involves isolating the affected systems to prevent the incident from spreading further, such as disconnecting the compromised workstation from the network. Eradication (removing the malware) and recovery (restoring systems) come after containment. Lessons learned is part of the Post-Incident Activity phase, which occurs after the incident has been fully resolved.

The correct answer is (d) Requiring continuous verification of every access request using identity, device posture, and contextual signals. Zero trust architecture operates on the principle of 'never trust, always verify.' This means that every access request must be authenticated and authorized based on multiple signals, including user identity, device health and compliance, location, and the sensitivity of the resource being accessed. This verification is continuous, not just at the initial login. Granting full network access after VPN authentication contradicts zero trust because it implicitly trusts the user after a single verification step. Allowing unrestricted access within the corporate LAN is the traditional perimeter-based model that zero trust explicitly replaces. Using a single firewall at the perimeter is also a perimeter-based approach that assumes internal traffic is trustworthy.

The correct answer is (a) It is a Critical severity vulnerability that can be exploited remotely with no authentication or user interaction. CVSS (Common Vulnerability Scoring System) v3.1 scores range from 0.0 to 10.0 and are categorized as: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). A score of 9.8 falls into the Critical category. The metrics further describe the exploitability: Attack Vector of Network means it can be exploited remotely over the network. Attack Complexity of Low means there are no special conditions required. Privileges Required of None means no authentication is needed. User Interaction of None means no user action is required for exploitation. This combination represents the most dangerous type of vulnerability: one that can be trivially exploited remotely by any attacker.

The correct answer is (b) HIPAA (Health Insurance Portability and Accountability Act). HIPAA is the primary U.S. federal law that governs the protection of electronic protected health information (ePHI). The HIPAA Security Rule specifically requires covered entities and their business associates to implement administrative safeguards (policies, procedures, workforce training), physical safeguards (facility access controls, workstation security), and technical safeguards (access controls, audit controls, encryption). PCI DSS (Payment Card Industry Data Security Standard) applies to organizations that process, store, or transmit credit card data, not health information. SOX (Sarbanes-Oxley Act) deals with financial reporting and corporate governance for publicly traded companies. GDPR (General Data Protection Regulation) is a European Union regulation for personal data privacy and does not specifically mandate the three safeguard categories described in the question.

The correct answer is (c) $100,000. In quantitative risk assessment, the Annualized Loss Expectancy (ALE) is calculated using the formula: ALE = SLE x ARO. First, calculate the Single Loss Expectancy (SLE): SLE = Asset Value x Exposure Factor =$500,000 x 0.40 = $200,000. This means each time the threat materializes, the organization expects to lose$200,000. Then, calculate the ALE: ALE = SLE x ARO = $200,000 x 0.5 =$100,000. The ARO of 0.5 means the threat is expected to occur once every two years on average. Therefore, the annualized expected loss from this particular threat is $100,000 per year. This figure helps the organization determine how much it is cost-effective to spend on countermeasures to mitigate this risk.

The correct answer is (b) The query returns all rows from the products table; this is an Injection vulnerability (OWASP A03:2021). When the attacker enters the malicious input, the resulting SQL query becomes: SELECT * FROM products WHERE name = '' OR '1'='1' --';. The single quote closes the original string literal, and OR '1'='1' is a condition that is always true, causing the query to return every row in the products table. The -- comments out any remaining SQL, preventing syntax errors. This is a classic SQL injection attack. In the OWASP Top 10 (2021), this falls under A03:2021 - Injection. The vulnerability exists because the application concatenates user input directly into the SQL query without parameterization or input validation. The proper mitigation is to use parameterized queries (prepared statements) or an ORM that handles input escaping.