CompTIA Security+ Operations & Incident Response Practice Questions

Question 1

What is the PRIMARY purpose of a honeypot?

Accepted Answer

To detect and analyze attack methods

Answer

To serve as a decoy production server

Answer

To automatically patch vulnerabilities

Answer

To encrypt all network traffic

Question 2

Which control would BEST protect against ransomware?

Accepted Answer

Regular backups

Answer

Strong passwords

Answer

MAC filtering

Answer

Redundant servers

Question 3

What does SIEM stand for?

Accepted Answer

Security Information and Event Management

Answer

Secure Internet Email Management

Answer

System Integrity and Encryption Module

Answer

Standardized Incident Evaluation Metrics

Question 4

Which backup type only copies changed data since the last full backup?

Accepted Answer

Differential

Answer

Full

Answer

Incremental

Answer

Snapshot

Question 5

What is the PRIMARY purpose of a disaster recovery plan?

Accepted Answer

To restore operations after a disruption

Answer

To prevent all security incidents

Answer

To monitor network traffic

Answer

To encrypt sensitive data

Question 6

What is the PRIMARY purpose of an IRP (Incident Response Plan)?

Accepted Answer

To provide a structured approach for handling security breaches

Answer

To prevent all security incidents

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data at rest

Question 7

Which type of assessment identifies security weaknesses without exploiting them?

Accepted Answer

Vulnerability scan

Answer

Penetration test

Answer

Red team exercise

Answer

Social engineering test

Question 8

Which control would BEST protect against phishing?

Accepted Answer

User awareness training

Answer

Firewall rules

Answer

Disk encryption

Answer

MAC filtering

Question 9

What is the PRIMARY purpose of a warm site for disaster recovery?

Accepted Answer

To provide partially configured recovery infrastructure

Answer

To provide immediate failover with current data

Answer

To serve as a complete replica of production

Answer

To store archived data

Question 10

Which control would BEST protect against insider threats?

Accepted Answer

User behavior analytics

Answer

Firewall rules

Answer

Disk encryption

Answer

MAC filtering

Question 11

What is the PRIMARY purpose of a data loss prevention (DLP) system?

Accepted Answer

To detect and prevent unauthorized data exfiltration

Answer

To prevent malware infections

Answer

To encrypt all network traffic

Answer

To authenticate remote users

Question 12

What is the PRIMARY purpose of a sandbox?

Accepted Answer

To isolate and analyze untrusted code

Answer

To increase processing speed

Answer

To encrypt network traffic

Answer

To authenticate users

Question 13

What is the PRIMARY purpose of a CSIRT (Computer Security Incident Response Team)?

Accepted Answer

To coordinate response to security breaches

Answer

To prevent all security incidents

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 14

What is the PRIMARY purpose of a hot site for disaster recovery?

Accepted Answer

To provide immediate failover with current data

Answer

To store archived data

Answer

To serve as a training environment

Answer

To test new software

Question 15

What is the PRIMARY purpose of a tabletop exercise?

Accepted Answer

To verbally walk through incident response scenarios

Answer

To physically test disaster recovery equipment

Answer

To encrypt sensitive data

Answer

To authenticate users

Question 16

What is the PRIMARY purpose of a chain of custody?

Accepted Answer

To document evidence handling procedures

Answer

To encrypt sensitive data

Answer

To monitor employee internet usage

Answer

To authenticate users

Question 17

What is the PRIMARY purpose of a security operations center (SOC)?

Accepted Answer

To monitor and respond to security events

Answer

To eliminate all security risks

Answer

To encrypt sensitive data

Answer

To authenticate users

Question 18

What is the PRIMARY purpose of a security assessment?

Accepted Answer

To evaluate security control effectiveness

Answer

To eliminate all security risks

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 19

What is the PRIMARY purpose of a penetration test?

Accepted Answer

To identify exploitable vulnerabilities

Answer

To eliminate all security risks

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 20

What is the main purpose of performing a Business Impact Analysis (BIA) as part of a business continuity plan?

Accepted Answer

To identify critical business functions and the impact of their disruption.

Answer

To identify all potential attackers and their motives.

Answer

To determine the financial cost of implementing security controls.

Answer

To select the most appropriate antivirus software for the organization.

Question 21

Which of the following is a common indicator of a compromised system?

Accepted Answer

Unexpected network traffic to unknown external IP addresses.

Answer

Faster than usual system performance.

Answer

Successful patching of all known vulnerabilities.

Answer

Decreased CPU utilization.

Question 22

Which stage of the incident response lifecycle involves determining the extent of the compromise and identifying affected systems?

Accepted Answer

Containment

Answer

Preparation

Answer

Identification

Answer

Eradication

Question 23

What is the primary goal of a Red Team exercise in cybersecurity?

Accepted Answer

To simulate real-world adversary tactics to test the effectiveness of security defenses.

Answer

To test the organization's backup and recovery procedures.

Answer

To assess compliance with industry regulations and standards.

Answer

To train employees on how to identify phishing emails.

Question 24

Which type of security assessment involves attempting to actively exploit vulnerabilities to gain unauthorized access, similar to what a real attacker would do?

Accepted Answer

Penetration test

Answer

Vulnerability scan

Answer

Security audit

Answer

Risk assessment

Question 25

Which standard is used to represent threat intelligence information in a structured format for automated sharing?

Accepted Answer

STIX

Answer

TAXII

Answer

OpenID

Answer

SAML

Question 26

A security team wants to automate the response to common phishing alerts to reduce analyst fatigue. Which tool is BEST suited for this purpose?

Accepted Answer

SOAR

Answer

SIEM

Answer

EDR

Answer

HIDS

Question 27

In the context of digital forensics, which of the following data sources has the highest order of volatility and should be collected first?

Accepted Answer

CPU registers and cache

Answer

Hard drive data

Answer

Archived backup tapes

Answer

System logs on a remote server

Question 28

Which threat hunting model uses four core features (Adversary, Capability, Infrastructure, and Victim) to analyze security incidents?

Accepted Answer

Diamond Model of Intrusion Analysis

Answer

Cyber Kill Chain

Answer

MITRE ATT&CK

Answer

STRIDE

Question 29

Which monitoring tool aggregates logs and correlates security events?

Accepted Answer

SIEM

Answer

UPS

Answer

KVM

Answer

NAT

Question 30

What is the primary purpose of a playbook in incident response?

Accepted Answer

Define repeatable steps for responding to a scenario

Answer

Store user passwords

Answer

Replace all policies

Answer

Disable evidence collection

Question 31

Which control helps ensure logs from different systems can be accurately correlated?

Accepted Answer

Time synchronization

Answer

Longer usernames

Answer

Printer pooling

Answer

MAC filtering only

Question 32

Which incident response action should occur before wiping an infected system when evidence is needed?

Accepted Answer

Collect and preserve relevant evidence

Answer

Disable all logging

Answer

Delete suspicious files only

Answer

Reconnect it to production

CompTIA Security+ Practice Questions: Operations & Incident Response

Q1. What is the PRIMARY purpose of a honeypot?

Q2. Which control would BEST protect against ransomware?

Q3. What does SIEM stand for?

Q4. Which backup type only copies changed data since the last full backup?

Q5. What is the PRIMARY purpose of a disaster recovery plan?

Q6. What is the PRIMARY purpose of an IRP (Incident Response Plan)?

Q7. Which type of assessment identifies security weaknesses without exploiting them?

Q8. Which control would BEST protect against phishing?

Q9. What is the PRIMARY purpose of a warm site for disaster recovery?

Q10. Which control would BEST protect against insider threats?

Q11. What is the PRIMARY purpose of a data loss prevention (DLP) system?

Q12. What is the PRIMARY purpose of a sandbox?

Q13. What is the PRIMARY purpose of a CSIRT (Computer Security Incident Response Team)?

Q14. What is the PRIMARY purpose of a hot site for disaster recovery?

Q15. What is the PRIMARY purpose of a tabletop exercise?

Q16. What is the PRIMARY purpose of a chain of custody?

Q17. What is the PRIMARY purpose of a security operations center (SOC)?

Q18. What is the PRIMARY purpose of a security assessment?

Q19. What is the PRIMARY purpose of a penetration test?

Q20. What is the main purpose of performing a Business Impact Analysis (BIA) as part of a business continuity plan?

Q21. Which of the following is a common indicator of a compromised system?

Q22. Which stage of the incident response lifecycle involves determining the extent of the compromise and identifying affected systems?

Q23. What is the primary goal of a Red Team exercise in cybersecurity?

Q24. Which type of security assessment involves attempting to actively exploit vulnerabilities to gain unauthorized access, similar to what a real attacker would do?

Q25. Which standard is used to represent threat intelligence information in a structured format for automated sharing?

Q26. A security team wants to automate the response to common phishing alerts to reduce analyst fatigue. Which tool is BEST suited for this purpose?

Q27. In the context of digital forensics, which of the following data sources has the highest order of volatility and should be collected first?

Q28. Which threat hunting model uses four core features (Adversary, Capability, Infrastructure, and Victim) to analyze security incidents?

Q29. Which monitoring tool aggregates logs and correlates security events?

Q30. What is the primary purpose of a playbook in incident response?

Q31. Which control helps ensure logs from different systems can be accurately correlated?

Q32. Which incident response action should occur before wiping an infected system when evidence is needed?

More CompTIA Security+ practice topics