CompTIA Security+ Security Architecture Practice Questions

Question 1

What is the PRIMARY purpose of RAID 1?

Accepted Answer

To provide fault tolerance through mirroring

Answer

To improve performance

Answer

To stripe data across multiple disks without parity

Answer

To combine multiple disks into one large volume

Question 2

Which control would BEST mitigate tailgating attacks?

Accepted Answer

Mantraps

Answer

Firewall rules

Answer

Antivirus software

Answer

Disk encryption

Question 3

What is the PRIMARY purpose of NAC (Network Access Control)?

Accepted Answer

To enforce security policies on devices before granting network access

Answer

To monitor network performance

Answer

To balance traffic across multiple servers

Answer

To encrypt all wireless communications

Question 4

What is the PRIMARY purpose of a firewall?

Accepted Answer

To filter network traffic based on rules

Answer

To prevent malware infections

Answer

To encrypt all communications

Answer

To authenticate users

Question 5

Which control would BEST protect against DDoS attacks?

Accepted Answer

Cloud-based mitigation services

Answer

Antivirus software

Answer

Full disk encryption

Answer

Password complexity requirements

Question 6

What is the PRIMARY purpose of a Faraday cage?

Accepted Answer

To block electromagnetic signals

Answer

To encrypt wireless communications

Answer

To filter network traffic

Answer

To authenticate users

Question 7

What is the PRIMARY purpose of TPM (Trusted Platform Module)?

Accepted Answer

To provide hardware-based security functions

Answer

To accelerate graphics processing

Answer

To increase network bandwidth

Answer

To compress storage requirements

Question 8

What is the PRIMARY purpose of a bastion host?

Accepted Answer

To serve as a hardened point of entry into a secure network

Answer

To store backup data

Answer

To encrypt all network traffic

Answer

To authenticate users

Question 9

What is the PRIMARY purpose of a jump box?

Accepted Answer

To provide controlled access to secure zones

Answer

To increase network speed

Answer

To encrypt all network traffic

Answer

To authenticate users

Question 10

What is the PRIMARY purpose of an air gap?

Accepted Answer

To physically isolate secure systems

Answer

To increase network speed

Answer

To encrypt network traffic

Answer

To authenticate users

Question 11

Which control would BEST protect against shoulder surfing?

Accepted Answer

Privacy filters

Answer

Disk encryption

Answer

MAC filtering

Answer

Antivirus software

Question 12

What is the PRIMARY purpose of a Faraday bag?

Accepted Answer

To prevent wireless signal emission from devices

Answer

To increase wireless signal strength

Answer

To encrypt wireless communications

Answer

To authenticate wireless devices

Question 13

What is the PRIMARY purpose of a proxy server?

Accepted Answer

To mediate and control network requests

Answer

To increase network speed

Answer

To encrypt all network traffic

Answer

To authenticate users

Question 14

Which control would BEST protect against tailgating?

Accepted Answer

Mantraps

Answer

Firewall rules

Answer

Disk encryption

Answer

Antivirus software

Question 15

What is the PRIMARY purpose of a VPN concentrator?

Accepted Answer

To terminate multiple VPN connections

Answer

To increase network speed

Answer

To encrypt all network traffic

Answer

To authenticate users

Question 16

What is the PRIMARY purpose of a next-generation firewall?

Accepted Answer

To provide application-aware filtering

Answer

To increase network speed

Answer

To encrypt all network traffic

Answer

To authenticate users

Question 17

What is the PRIMARY purpose of a demilitarized zone (DMZ)?

Accepted Answer

To isolate publicly accessible services

Answer

To increase network speed

Answer

To encrypt all network traffic

Answer

To authenticate users

Question 18

What is the PRIMARY purpose of a web application firewall?

Accepted Answer

To filter HTTP/HTTPS traffic

Answer

To increase network speed

Answer

To encrypt all network traffic

Answer

To authenticate users

Question 19

What is the PRIMARY risk of using WEP for wireless security?

Accepted Answer

Weak encryption vulnerable to cracking

Answer

Slower connection speeds

Answer

Incompatibility with modern devices

Answer

Higher power consumption

Question 20

What is the PRIMARY purpose of NAC (Network Access Control)?

Accepted Answer

Enforce security policies on endpoints

Answer

Block DDoS attacks

Answer

Encrypt VPN traffic

Answer

Filter spam emails

Question 21

Which protocol is used to securely manage network devices?

Accepted Answer

SSH

Answer

Telnet

Answer

SNMPv1

Answer

HTTP

Question 22

Which control would BEST protect against ransomware?

Accepted Answer

Offline backups

Answer

Email filtering

Answer

MAC filtering

Answer

Screen locks

Question 23

What is the PRIMARY purpose of a firewall?

Accepted Answer

Filter network traffic

Answer

Block malware

Answer

Encrypt emails

Answer

Manage passwords

Question 24

Which protocol is vulnerable to VLAN hopping attacks?

Accepted Answer

DTP

Answer

STP

Answer

VTP

Answer

RSTP

Question 25

Which control would BEST protect against DDoS attacks?

Accepted Answer

Load balancer with scrubbing

Answer

Antivirus

Answer

Disk encryption

Answer

Screen locks

Question 26

Which attack vector specifically targets vulnerabilities in web applications by injecting database queries?

Accepted Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Man-in-the-middle

Answer

DNS spoofing

Question 27

Which wireless security protocol is rendered ineffective due to its vulnerability to offline dictionary attacks?

Accepted Answer

WPS

Answer

WPA3

Answer

WPA2-Enterprise

Answer

WEP

Question 28

Which cloud deployment model shares infrastructure between organizations with similar compliance requirements?

Accepted Answer

Community cloud

Answer

Public cloud

Answer

Private cloud

Answer

Hybrid cloud

Question 29

Which network device operates at Layer 7 to filter traffic based on application-layer data?

Accepted Answer

Web application firewall

Answer

Switch

Answer

Router

Answer

Load balancer

Question 30

Which cloud service model provides development platforms without managing underlying infrastructure?

Accepted Answer

PaaS

Answer

IaaS

Answer

SaaS

Answer

FaaS

Question 31

Which RAID configuration provides both striping and dual parity fault tolerance?

Accepted Answer

RAID 6

Answer

RAID 0

Answer

RAID 1

Answer

RAID 5

Question 32

Which protocol secures VoIP communications through SRTP and ZRTP?

Accepted Answer

RTP

Answer

SIP

Answer

H.323

Answer

MGCP

Question 33

Which of the following is a primary benefit of implementing defense in depth as a security strategy?

Accepted Answer

It provides multiple layers of security controls, so if one fails, others may still protect assets.

Answer

It simplifies security management by using a single powerful control.

Answer

It focuses solely on perimeter security to block all external threats.

Answer

It guarantees that no security breaches will ever occur.

Question 34

Which security concept involves verifying a user's identity before granting access to resources, and then continuously monitoring their activity?

Accepted Answer

Zero Trust

Answer

Single Sign-On (SSO)

Answer

Federated Identity

Answer

Role-Based Access Control (RBAC)

Question 35

What is the primary purpose of an Intrusion Prevention System (IPS) compared to an Intrusion Detection System (IDS)?

Accepted Answer

An IPS can actively block or prevent malicious traffic, while an IDS primarily detects and alerts.

Answer

An IPS only logs suspicious activity, while an IDS actively blocks it.

Answer

An IPS focuses on host-based threats, while an IDS focuses on network-based threats.

Answer

An IPS uses signature-based detection, while an IDS uses anomaly-based detection.

Question 36

Which of the following is a common vulnerability associated with improperly configured S3 buckets in cloud environments?

Accepted Answer

Unintended public access leading to data exposure

Answer

SQL injection attacks

Answer

Denial-of-service due to traffic overload

Answer

Cross-site scripting (XSS) vulnerabilities

Question 37

Which of the following is a security concern specifically related to the Internet of Things (IoT) devices?

Accepted Answer

Default or hardcoded credentials and lack of patching.

Answer

Use of strong, unique passwords for administration.

Answer

Regular firmware updates provided by vendors.

Answer

Implementation of end-to-end encryption for communication.

Question 38

Which security solution acts as an intermediary between on-premises infrastructure and cloud applications to enforce security policies?

Accepted Answer

Cloud Access Security Broker (CASB)

Answer

Next-generation firewall (NGFW)

Answer

Security Information and Event Management (SIEM)

Answer

Virtual Private Network (VPN)

Question 39

Which mobile security strategy involves separating corporate data from personal data on a BYOD device?

Accepted Answer

Containerization

Answer

Geofencing

Answer

Rooting

Answer

Sideloading

Question 40

Which data center design feature optimizes cooling by managing airflow to prevent the mixing of cool intake air and hot exhaust air?

Accepted Answer

Hot and cold aisles

Answer

Faraday cage

Answer

Fire suppression system

Answer

Mantrap

Question 41

What is the term for a hardware-based root of trust that ensures a system boots using only software that is trusted by the Original Equipment Manufacturer (OEM)?

Accepted Answer

Secure Boot

Answer

Full Disk Encryption

Answer

BIOS Password

Answer

Unified Extensible Firmware Interface (UEFI)

Question 42

Which security architecture model converges networking and security as a service capabilities (like CASB, FWaaS, and ZTNA) into a unified cloud-native service?

Accepted Answer

SASE (Secure Access Service Edge)

Answer

SIEM (Security Information and Event Management)

Answer

SOAR (Security Orchestration, Automation, and Response)

Answer

VPN (Virtual Private Network)

Question 43

Which application security testing method analyzes source code for vulnerabilities without executing the program?

Accepted Answer

SAST (Static Application Security Testing)

Answer

DAST (Dynamic Application Security Testing)

Answer

Fuzzing

Answer

Penetration Testing

Question 44

What computing model processes data near the source of data generation (e.g., IoT sensors) rather than in a centralized cloud, to reduce latency?

Accepted Answer

Edge computing

Answer

Serverless computing

Answer

Mainframe computing

Answer

Grid computing

Question 45

Which security architecture places public-facing servers between external and internal firewalls?

Accepted Answer

DMZ

Answer

Flat LAN

Answer

Localhost

Answer

Honeynet only

Question 46

Which data protection method replaces sensitive values with non-sensitive substitutes stored in a mapping system?

Accepted Answer

Tokenization

Answer

Hashing only

Answer

Compression

Answer

Steganography

Question 47

Which security model requires verification regardless of network location?

Accepted Answer

Zero Trust

Answer

Trust but never verify

Answer

Open perimeter

Answer

Single flat VLAN

Question 48

Which cloud model gives the customer the most responsibility for operating system security?

Accepted Answer

IaaS

Answer

SaaS

Answer

Managed email only

Answer

Public DNS

Question 49

Which data state is protected by TLS during a web session?

Accepted Answer

Data in transit

Answer

Data at rest

Answer

Data in archive only

Answer

Data disposal

Question 50

Which data classification is usually the most restrictive?

Accepted Answer

Restricted

Answer

Public

Answer

Internal

Answer

Unclassified

Question 51

Which security principle assumes breach and limits lateral movement through segmentation and verification?

Accepted Answer

Zero Trust

Answer

Single perimeter trust

Answer

Open guest network

Answer

Password reuse

Question 52

Which security control monitors and blocks unauthorized sensitive data transfers?

Accepted Answer

DLP

Answer

UPS

Answer

NTP

Answer

KVM

Question 53

Which cloud security issue occurs when a storage bucket allows public read access unintentionally?

Accepted Answer

Misconfiguration

Answer

Hash collision

Answer

RF interference

Answer

Memory leak only

Question 54

Which network security control filters traffic between network segments based on predefined rules regarding source, destination, and port?

Accepted Answer

Firewall

Answer

Switch

Answer

Access point

Answer

Repeater

Question 55

Which cloud security concept refers to the division of security duties between the cloud provider and the customer?

Accepted Answer

Shared responsibility model

Answer

Data sovereignty

Answer

Multi-tenancy

Answer

Elasticity

Question 56

What is the main purpose of network segmentation as a security control?

Accepted Answer

Limit the spread of an attack by isolating network zones

Answer

Increase overall network speed

Answer

Reduce the number of IP addresses needed

Answer

Eliminate the need for firewalls

Question 57

Which wireless attack involves setting up a fraudulent access point with the same SSID as a legitimate network to intercept user traffic?

Accepted Answer

Evil twin attack

Answer

Jamming attack

Answer

WPS brute force

Answer

Bluesnarfing

Question 58

What is the primary function of a data loss prevention (DLP) solution?

Accepted Answer

Monitor and block unauthorized transmission of sensitive data

Answer

Automatically back up all data hourly

Answer

Compress data to save storage space

Answer

Balance load across multiple servers

CompTIA Security+ Practice Questions: Security Architecture

Q1. What is the PRIMARY purpose of RAID 1?

Q2. Which control would BEST mitigate tailgating attacks?

Q3. What is the PRIMARY purpose of NAC (Network Access Control)?

Q4. What is the PRIMARY purpose of a firewall?

Q5. Which control would BEST protect against DDoS attacks?

Q6. What is the PRIMARY purpose of a Faraday cage?

Q7. What is the PRIMARY purpose of TPM (Trusted Platform Module)?

Q8. What is the PRIMARY purpose of a bastion host?

Q9. What is the PRIMARY purpose of a jump box?

Q10. What is the PRIMARY purpose of an air gap?

Q11. Which control would BEST protect against shoulder surfing?

Q12. What is the PRIMARY purpose of a Faraday bag?

Q13. What is the PRIMARY purpose of a proxy server?

Q14. Which control would BEST protect against tailgating?

Q15. What is the PRIMARY purpose of a VPN concentrator?

Q16. What is the PRIMARY purpose of a next-generation firewall?

Q17. What is the PRIMARY purpose of a demilitarized zone (DMZ)?

Q18. What is the PRIMARY purpose of a web application firewall?

Q19. What is the PRIMARY risk of using WEP for wireless security?

Q20. What is the PRIMARY purpose of NAC (Network Access Control)?

Q21. Which protocol is used to securely manage network devices?

Q22. Which control would BEST protect against ransomware?

Q23. What is the PRIMARY purpose of a firewall?

Q24. Which protocol is vulnerable to VLAN hopping attacks?

Q25. Which control would BEST protect against DDoS attacks?

Q26. Which attack vector specifically targets vulnerabilities in web applications by injecting database queries?

Q27. Which wireless security protocol is rendered ineffective due to its vulnerability to offline dictionary attacks?

Q28. Which cloud deployment model shares infrastructure between organizations with similar compliance requirements?

Q29. Which network device operates at Layer 7 to filter traffic based on application-layer data?

Q30. Which cloud service model provides development platforms without managing underlying infrastructure?

Q31. Which RAID configuration provides both striping and dual parity fault tolerance?

Q32. Which protocol secures VoIP communications through SRTP and ZRTP?

Q33. Which of the following is a primary benefit of implementing defense in depth as a security strategy?

Q34. Which security concept involves verifying a user's identity before granting access to resources, and then continuously monitoring their activity?

Q35. What is the primary purpose of an Intrusion Prevention System (IPS) compared to an Intrusion Detection System (IDS)?

Q36. Which of the following is a common vulnerability associated with improperly configured S3 buckets in cloud environments?

Q37. Which of the following is a security concern specifically related to the Internet of Things (IoT) devices?

Q38. Which security solution acts as an intermediary between on-premises infrastructure and cloud applications to enforce security policies?

Q39. Which mobile security strategy involves separating corporate data from personal data on a BYOD device?

Q40. Which data center design feature optimizes cooling by managing airflow to prevent the mixing of cool intake air and hot exhaust air?

Q41. What is the term for a hardware-based root of trust that ensures a system boots using only software that is trusted by the Original Equipment Manufacturer (OEM)?

Q42. Which security architecture model converges networking and security as a service capabilities (like CASB, FWaaS, and ZTNA) into a unified cloud-native service?

Q43. Which application security testing method analyzes source code for vulnerabilities without executing the program?

Q44. What computing model processes data near the source of data generation (e.g., IoT sensors) rather than in a centralized cloud, to reduce latency?

Q45. Which security architecture places public-facing servers between external and internal firewalls?

Q46. Which data protection method replaces sensitive values with non-sensitive substitutes stored in a mapping system?

Q47. Which security model requires verification regardless of network location?

Q48. Which cloud model gives the customer the most responsibility for operating system security?

Q49. Which data state is protected by TLS during a web session?

Q50. Which data classification is usually the most restrictive?

Q51. Which security principle assumes breach and limits lateral movement through segmentation and verification?

Q52. Which security control monitors and blocks unauthorized sensitive data transfers?

Q53. Which cloud security issue occurs when a storage bucket allows public read access unintentionally?

Q54. Which network security control filters traffic between network segments based on predefined rules regarding source, destination, and port?

Q55. Which cloud security concept refers to the division of security duties between the cloud provider and the customer?

Q56. What is the main purpose of network segmentation as a security control?

Q57. Which wireless attack involves setting up a fraudulent access point with the same SSID as a legitimate network to intercept user traffic?

Q58. What is the primary function of a data loss prevention (DLP) solution?

More CompTIA Security+ practice topics