Q1. Which authentication protocol uses tickets and is resistant to replay attacks?
- A.PAP
- B.CHAP
- C.Kerberos✓ Correct
- D.RADIUS
Explanation: Kerberos uses time-stamped tickets to prevent credential reuse. Learn more.
CompTIA Security+ Practice Questions: General Security Concepts
25 free, exam-style CompTIA Security+ (SY0-701) practice questions covering General Security Concepts. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.
Q2. Which cryptographic algorithm is asymmetric?
- A.AES
- B.SHA-256
- C.RSA✓ Correct
- D.HMAC
Explanation: RSA uses public/private key pairs, making it an asymmetric algorithm. Learn more.
Q3. Which control would BEST mitigate tailgating attacks?
- A.Antivirus software
- B.Mantrap with biometrics✓ Correct
- C.Network segmentation
- D.Email filtering
Explanation: Mantraps prevent unauthorized physical entry via dual-door systems with authentication. Learn more.
Q4. What does TLS primarily provide for network communications?
- A.Bandwidth throttling
- B.Encryption and integrity✓ Correct
- C.MAC address filtering
- D.Quality of Service (QoS)
Explanation: TLS encrypts data in transit and verifies its integrity via hashing. Learn more.
Q5. Which principle ensures users have only the access needed for their job?
- A.Least privilege✓ Correct
- B.Defense in depth
- C.Separation of duties
- D.Non-repudiation
Explanation: Least privilege minimizes attack surfaces by restricting unnecessary permissions. Learn more.
Q6. What is the PRIMARY purpose of hashing?
- A.Encrypt data for transmission
- B.Verify data integrity✓ Correct
- C.Compress files
- D.Authenticate users
Explanation: Hashing generates fixed-size fingerprints to detect data tampering. Learn more.
Q7. What is the PRIMARY purpose of a digital certificate?
- A.Store encryption keys
- B.Verify identity of entities✓ Correct
- C.Compress data
- D.Filter spam
Explanation: Digital certificates bind public keys to identities via CA signatures. Learn more.
Q8. Which authentication factor is 'something you are'?
- A.Password
- B.Smart card
- C.Fingerprint✓ Correct
- D.Security question
Explanation: Biometrics (e.g., fingerprints) represent inherence factors. Learn more.
Q9. What is the PRIMARY benefit of salting passwords?
- A.Speeds up hashing
- B.Prevents rainbow table attacks✓ Correct
- C.Reduces storage needs
- D.Eliminates need for hashing
Explanation: Unique salts force attackers to recompute rainbow tables for each password. Learn more.
Q10. When implementing full-disk encryption, which component securely stores encryption keys in hardware?
- A.HSM
- B.TPM✓ Correct
- C.RAID controller
- D.UEFI firmware
Explanation: Trusted Platform Modules (TPMs) store encryption keys in tamper-resistant hardware. Learn more.
Q11. Which biometric factor has the highest false acceptance rate (FAR) among common authentication methods?
- A.Iris recognition
- B.Fingerprint scanning
- C.Voice recognition
- D.Facial recognition✓ Correct
Explanation: Facial recognition systems are more susceptible to false positives compared to iris/fingerprint scans. Learn more.
Q12. Which physical security control prevents electromagnetic eavesdropping on network cabling?
- A.Faraday cage
- B.TEMPEST shielding✓ Correct
- C.Mantrap
- D.Bollards
Explanation: TEMPEST standards govern shielding against compromising emanations. Learn more.
Q13. Which authentication protocol uses challenge-response with non-repeating values?
- A.PAP
- B.CHAP✓ Correct
- C.EAP
- D.RADIUS
Explanation: Challenge-Handshake Authentication Protocol (CHAP) prevents replay attacks with unique challenges. Learn more.
Q14. Which control type is a security awareness training program?
- A.Administrative✓ Correct
- B.Physical
- C.Corrective hardware
- D.Cryptographic primitive
Explanation: Training is an administrative control because it uses policy and process to influence user behavior. Learn more.
Q15. Which concept requires users to receive only the permissions needed for their role?
- A.Least privilege✓ Correct
- B.Open authorization
- C.Implicit trust
- D.Privilege sharing
Explanation: Least privilege reduces risk by limiting access rights to what is necessary. Learn more.
Q16. Which cryptographic function provides integrity but is not reversible?
- A.Hashing✓ Correct
- B.Symmetric encryption
- C.Asymmetric decryption
- D.Key escrow
Explanation: A hash function produces a fixed-length digest and is designed to be one-way. Learn more.
Q17. Which physical security control prevents two people from entering a secure area on one authentication?
- A.Mantrap✓ Correct
- B.Firewall
- C.WAF
- D.Honeypot
Explanation: A mantrap uses two controlled doors or similar controls to reduce tailgating and piggybacking. Learn more.
Q18. Which authentication method uses a physical key that supports phishing-resistant public key cryptography?
- A.FIDO2 security key✓ Correct
- B.SMS code only
- C.Password hint
- D.Security question
Explanation: FIDO2 security keys use public key cryptography and are resistant to many phishing attacks. Learn more.
Q19. Which type of control is a bollard outside a building entrance?
- A.Physical preventive✓ Correct
- B.Technical detective
- C.Administrative corrective
- D.Cryptographic compensating
Explanation: Bollards physically prevent vehicles from reaching protected areas. Learn more.
Q20. Which cryptographic process proves a message came from the claimed sender and was not changed?
- A.Digital signing✓ Correct
- B.Compression
- C.Tokenization only
- D.Steganography only
Explanation: Digital signatures provide integrity, authentication, and non-repudiation when properly implemented. Learn more.
Q21. Which control provides temporary elevated access only for approved tasks?
- A.Just-in-time privilege✓ Correct
- B.Shared administrator password
- C.Permanent root access
- D.Anonymous login
Explanation: Just-in-time access reduces standing privileges by granting elevation only when needed. Learn more.
Q22. Which cryptographic concept ensures that a sender cannot deny having sent a message?
- A.Confidentiality
- B.Non-repudiation✓ Correct
- C.Availability
- D.Obfuscation
Explanation: Non-repudiation, often achieved through digital signatures, provides proof of the origin and integrity of data, preventing the sender from later denying they sent it. Learn more.
Q23. What is the purpose of salting a password before hashing it?
- A.To make the password shorter
- B.To prevent rainbow table attacks by adding unique random data✓ Correct
- C.To encrypt the password instead of hashing it
- D.To compress the password for storage
Explanation: A salt is random data added to a password before hashing, ensuring that identical passwords produce different hashes and defeating precomputed rainbow table attacks. Learn more.
Q24. What does the CIA triad in information security stand for?
- A.Confidentiality, Integrity, Availability✓ Correct
- B.Control, Inspection, Authorization
- C.Certification, Identification, Access
- D.Confidentiality, Inspection, Authentication
Explanation: The CIA triad — Confidentiality, Integrity, and Availability — forms the foundational model for evaluating and designing information security controls and policies. Learn more.
Q25. What is the primary purpose of a digital certificate in a public key infrastructure (PKI)?
- A.Compress data for faster transmission
- B.Bind a public key to a verified identity✓ Correct
- C.Encrypt data using symmetric keys only
- D.Store user passwords in plaintext
Explanation: A digital certificate, issued by a trusted certificate authority, binds a public key to a verified identity, enabling parties to trust that the public key genuinely belongs to the claimed owner. Learn more.