CompTIA Security+ Practice Questions: Security Operations

94 free, exam-style CompTIA Security+ (SY0-701) practice questions covering Security Operations. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.

🚀 Take the full CompTIA Security+ quiz 📘 CompTIA Security+ study guide

Q1. Which authentication protocol uses tickets and is resistant to replay attacks?

Explanation: Kerberos uses time-sensitive tickets to authenticate users and services while preventing replay attacks. Learn more.

Q2. Which cryptographic algorithm is asymmetric?

Explanation: RSA is an asymmetric algorithm that uses public/private key pairs, unlike symmetric algorithms like AES. Learn more.

Q3. What is the PRIMARY purpose of a honeypot?

Explanation: Honeypots are decoy systems designed to attract and study attackers' methods without exposing real systems. Learn more.

Q4. What does TLS primarily provide for network communications?

Explanation: Transport Layer Security (TLS) provides encryption for confidentiality and message integrity checks. Learn more.

Q5. What is the PRIMARY risk of using WEP for wireless security?

Explanation: WEP's encryption can be broken in minutes using readily available tools due to cryptographic weaknesses. Learn more.

Q6. Which protocol is used to securely manage network devices?

Explanation: SSH provides encrypted command-line access for secure remote device management. Learn more.

Q7. What is the PRIMARY purpose of hashing?

Explanation: Hashing creates fixed-size outputs (hashes) used to verify data integrity through checksums. Learn more.

Q8. Which control would BEST protect against ransomware?

Explanation: Regular, isolated backups allow recovery without paying ransom if systems are encrypted by ransomware. Learn more.

Q9. What does SIEM stand for?

Explanation: SIEM systems provide real-time analysis of security alerts from network devices and applications. Learn more.

Q10. What is the PRIMARY purpose of a digital certificate?

Explanation: Digital certificates bind cryptographic keys to identities and are verified by certificate authorities. Learn more.

Q11. Which port is typically used for secure web browsing?

Explanation: HTTPS (secure web traffic) uses TCP port 443 by default. Learn more.

Q12. Which backup type only copies changed data since the last full backup?

Explanation: Differential backups capture all changes made since the last full backup. Learn more.

Q13. What is the PRIMARY purpose of a disaster recovery plan?

Explanation: DR plans outline procedures for restoring systems and data after catastrophic events. Learn more.

Q14. Which authentication factor is 'something you are'?

Explanation: Biometrics like fingerprints represent 'something you are' in multi-factor authentication. Learn more.

Q15. What is the PRIMARY benefit of salting passwords?

Explanation: Salting adds random data to passwords before hashing, making precomputed attacks impractical. Learn more.

Q16. What is the PRIMARY purpose of an IRP (Incident Response Plan)?

Explanation: An IRP defines procedures for detecting, responding to, and recovering from security incidents. Learn more.

Q17. Which type of assessment identifies security weaknesses without exploiting them?

Explanation: Vulnerability scans identify potential weaknesses without attempting actual exploitation. Learn more.

Q18. Which encryption mode is used for wireless networks with WPA2?

Explanation: CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is used with WPA2. Learn more.

Q19. What is the PRIMARY purpose of a certificate revocation list (CRL)?

Explanation: CRLs contain certificates that have been revoked before their expiration date. Learn more.

Q20. Which protocol is used for secure email transmission?

Explanation: S/MIME provides encryption and digital signatures for secure email communication. Learn more.

Q21. What is the PRIMARY purpose of steganography?

Explanation: Steganography conceals information within other files like images or audio. Learn more.

Q22. Which control would BEST protect against phishing?

Explanation: Educating users to recognize phishing attempts is the most effective defense. Learn more.

Q23. Which authentication protocol is used for dial-up and VPN services?

Explanation: RADIUS provides centralized authentication for remote access services. Learn more.

Q24. Which control would BEST protect against SQL injection?

Explanation: Proper input validation and parameterized queries prevent SQL injection attacks. Learn more.

Q25. What is the PRIMARY purpose of a warm site for disaster recovery?

Explanation: Warm sites have infrastructure prepared but require data restoration and configuration. Learn more.

Q26. Which control would BEST protect against insider threats?

Explanation: Monitoring for anomalous user behavior helps detect potential insider threats. Learn more.

Q27. Which authentication protocol is used for single sign-on in web applications?

Explanation: SAML enables SSO by exchanging authentication data between identity providers and service providers. Learn more.

Q28. What is the PRIMARY purpose of a data loss prevention (DLP) system?

Explanation: DLP systems monitor and control data transfers to prevent sensitive information leaks. Learn more.

Q29. Which cryptographic concept ensures a message hasn't been altered?

Explanation: Integrity mechanisms like hashes and digital signatures detect message tampering. Learn more.

Q30. Which control would BEST protect against brute force attacks?

Explanation: Account lockouts after failed attempts prevent systematic password guessing. Learn more.

Q31. Which protocol is used for secure file transfer?

Explanation: SFTP provides secure file transfer over SSH encrypted channels. Learn more.

Q32. What is the PRIMARY purpose of a sandbox?

Explanation: Sandboxes provide isolated environments for safely executing suspicious programs. Learn more.

Q33. What is the PRIMARY purpose of a CSIRT (Computer Security Incident Response Team)?

Explanation: CSIRTs are specialized groups that handle security incident investigation and response. Learn more.

Q34. Which control would BEST protect against ARP spoofing?

Explanation: Dynamic ARP inspection validates ARP packets to prevent spoofing attacks. Learn more.

Q35. What is the PRIMARY purpose of a hot site for disaster recovery?

Explanation: Hot sites maintain real-time data synchronization for near-instantaneous failover. Learn more.

Q36. Which protocol is used for secure directory services?

Explanation: LDAPS provides encrypted LDAP directory service access over SSL/TLS. Learn more.

Q37. Which control would BEST protect against cross-site scripting (XSS)?

Explanation: Proper input handling and output encoding neutralize XSS attack vectors. Learn more.

Q38. Which cryptographic algorithm is used for digital signatures?

Explanation: RSA can create digital signatures by encrypting hashes with private keys. Learn more.

Q39. What is the PRIMARY purpose of a tabletop exercise?

Explanation: Tabletop exercises validate plans through discussion-based scenario testing. Learn more.

Q40. Which protocol is used for secure time synchronization?

Explanation: Network Time Security (NTS) provides authenticated time synchronization. Learn more.

Q41. What is the PRIMARY purpose of a chain of custody?

Explanation: Chain of custody maintains evidentiary integrity for legal proceedings. Learn more.

Q42. Which control would BEST protect against rainbow table attacks?

Explanation: Salting passwords makes precomputed hash tables ineffective. Learn more.

Q43. What is the PRIMARY purpose of a security operations center (SOC)?

Explanation: SOCs provide continuous security monitoring and incident response capabilities. Learn more.

Q44. Which protocol is used for secure remote command execution?

Explanation: SSH provides encrypted command-line access to remote systems. Learn more.

Q45. Which control would BEST protect against MAC spoofing?

Explanation: Switch port security can limit MAC addresses per port to prevent spoofing. Learn more.

Q46. What is the PRIMARY purpose of a security assessment?

Explanation: Assessments systematically evaluate how well security controls meet requirements. Learn more.

Q47. Which protocol is used for secure VoIP communications?

Explanation: Secure Real-time Transport Protocol encrypts VoIP media streams. Learn more.

Q48. Which control would BEST protect against DNS spoofing?

Explanation: DNSSEC adds cryptographic authentication to DNS responses. Learn more.

Q49. What is the PRIMARY purpose of a penetration test?

Explanation: Penetration tests simulate attacks to find security weaknesses. Learn more.

Q50. Which protocol is used for secure DNS queries?

Explanation: DNS over HTTPS encrypts DNS queries within HTTPS sessions. Learn more.

Q51. What does SIEM stand for?

Explanation: SIEM systems aggregate and analyze logs for threat detection. Learn more.

Q52. Which port is typically used for secure web browsing?

Explanation: HTTPS uses TCP port 443 for encrypted web traffic. Learn more.

Q53. Which backup type only copies changed data since the last full backup?

Explanation: Incremental backups save only new/changed files since the last backup of any type. Learn more.

Q54. What is the PRIMARY purpose of a disaster recovery plan?

Explanation: DR plans outline procedures to recover IT systems post-disaster. Learn more.

Q55. What is the PRIMARY purpose of an IRP (Incident Response Plan)?

Explanation: IRPs define roles, procedures, and communication during security incidents. Learn more.

Q56. Which protocol should replace SNMPv2 for secure network device monitoring?

Explanation: SNMPv3 adds encryption and authentication missing in earlier versions. Learn more.

Q57. Which disaster recovery site configuration has all systems pre-installed but requires data restoration?

Explanation: Warm sites balance cost and recovery time with preconfigured hardware but need data sync. Learn more.

Q58. Which Windows feature prevents pass-the-hash attacks by isolating credential processes?

Explanation: Credential Guard uses virtualization-based security to protect NTLM/LSA secrets. Learn more.

Q59. Which Linux command displays active network connections and listening ports?

Explanation: netstat -tulpn shows TCP/UDP connections and associated processes. Learn more.

Q60. Which Windows log contains events related to user authentication attempts?

Explanation: Event ID 4624 (success) and 4625 (failure) track logon attempts in the Security log. Learn more.

Q61. Which tool intercepts and logs network traffic for analysis?

Explanation: Wireshark captures packets in promiscuous mode for protocol analysis. Learn more.

Q62. What is the main purpose of performing a Business Impact Analysis (BIA) as part of a business continuity plan?

Explanation: A BIA identifies an organization's critical processes and resources and quantifies the potential impact (financial, operational, reputational) if those functions are disrupted. This helps prioritize recovery efforts. Learn more.

Q63. Which of the following is an example of 'something you have' in multi-factor authentication (MFA)?

Explanation: MFA combines two or more different types of authentication factors. 'Something you have' refers to a physical object like a smart card, hardware token, or mobile phone (for OTP apps). Learn more.

Q64. A company wants to ensure that sensitive data stored on laptops is protected even if a laptop is lost or stolen. Which of the following controls would be MOST effective?

Explanation: Full-disk encryption encrypts all data on the hard drive. If the laptop is lost or stolen, the data remains unreadable without the correct decryption key or password, protecting data at rest. Learn more.

Q65. In cryptography, what is the purpose of a 'salt' when hashing passwords?

Explanation: A salt is random data added to each password before it's hashed. This ensures that even if two users have the same password, their stored hashes will be different, rendering precomputed rainbow tables ineffective. Learn more.

Q66. What is the primary purpose of using a VPN (Virtual Private Network)?

Explanation: VPNs establish an encrypted tunnel between a client device and a VPN server, allowing users to securely access private networks or browse the internet with enhanced privacy and security, especially over public Wi-Fi. Learn more.

Q67. Which of the following is a key component of a Public Key Infrastructure (PKI) responsible for issuing and revoking digital certificates?

Explanation: The Certificate Authority (CA) is the trusted entity in a PKI that issues, manages, revokes, and renews digital certificates, which bind public keys to identities. Learn more.

Q68. Which of the following is a common indicator of a compromised system?

Explanation: Unusual outbound network connections, especially to known malicious IPs or unusual ports, can indicate that a system has been compromised and is communicating with a command-and-control server or exfiltrating data. Learn more.

Q69. What is the primary purpose of data masking or tokenization?

Explanation: Data masking (or obfuscation/tokenization) replaces real, sensitive data with structurally similar but fake data. This allows developers or testers to work with realistic datasets in non-production environments without exposing actual sensitive information. Learn more.

Q70. Which stage of the incident response lifecycle involves determining the extent of the compromise and identifying affected systems?

Explanation: During the Containment phase (which often overlaps with Identification and Analysis), responders work to limit the scope and magnitude of the incident, prevent further damage, and identify all affected systems. Learn more.

Q71. A security team is implementing controls to prevent unauthorized software from running on endpoints. Which technology would be MOST effective for this?

Explanation: Application whitelisting (or allowlisting) allows only explicitly approved applications to run on a system, effectively blocking all other software, including malware or unauthorized tools. Learn more.

Q72. Which of the following is a characteristic of symmetric encryption?

Explanation: Symmetric encryption algorithms (like AES) use a single, shared secret key for both encrypting and decrypting data. It is generally faster than asymmetric encryption and suitable for bulk data encryption. Learn more.

Q73. What is the primary goal of a Red Team exercise in cybersecurity?

Explanation: Red Team exercises involve a dedicated team emulating the tactics, techniques, and procedures (TTPs) of real-world attackers to rigorously test an organization's detection and response capabilities, as well as overall security posture. Learn more.

Q74. Which of the following protocols is commonly used to provide centralized authentication, authorization, and accounting (AAA) for network access?

Explanation: RADIUS (Remote Authentication Dial-In User Service) is a networking protocol that provides centralized AAA management for users who connect and use a network service, commonly used for VPNs, wireless networks, and dial-up access. Learn more.

Q75. Which type of security assessment involves attempting to actively exploit vulnerabilities to gain unauthorized access, similar to what a real attacker would do?

Explanation: A penetration test (pen test) simulates an attack on a computer system, network, or web application to find security weaknesses that an attacker could exploit. It goes beyond just identifying vulnerabilities by attempting to exploit them. Learn more.

Q76. Which of the following data states is protected by technologies like TLS/SSL and VPNs?

Explanation: Data in transit (or data in motion) is data that is actively moving from one location to another, such as across the internet or through a private network. TLS/SSL and VPNs are designed to encrypt this data to protect it from eavesdropping or modification during transmission. Learn more.

Q77. Which cryptographic algorithm is most efficient for mobile devices and IoT due to low processing power requirements?

Explanation: ECC provides the same level of security as RSA but with much smaller key sizes, making it ideal for resource-constrained devices. Learn more.

Q78. Which standard is used to represent threat intelligence information in a structured format for automated sharing?

Explanation: STIX (Structured Threat Information Expression) is the language/format used to describe threats, while TAXII is the protocol used to transmit that data. Learn more.

Q79. Which protocol is primarily used for authorization (access delegation) rather than authentication?

Explanation: OAuth is an open standard for access delegation, allowing users to grant websites or applications access to their information on other websites without giving them the passwords. Learn more.

Q80. Which cryptographic property ensures that a compromised private key does not compromise past session keys?

Explanation: Perfect Forward Secrecy (PFS) ensures that session keys are unique and ephemeral, so even if the long-term private key is stolen, past sessions cannot be decrypted. Learn more.

Q81. A security team wants to automate the response to common phishing alerts to reduce analyst fatigue. Which tool is BEST suited for this purpose?

Explanation: SOAR (Security Orchestration, Automation, and Response) platforms allow organizations to define incident analysis and response procedures (playbooks) in a digital workflow format. Learn more.

Q82. In the context of digital forensics, which of the following data sources has the highest order of volatility and should be collected first?

Explanation: The order of volatility dictates that the most fleeting data must be captured first. CPU registers and cache are the most volatile, followed by RAM. Learn more.

Q83. Which technology uses a distributed, decentralized ledger to ensure data integrity and immutability without a central authority?

Explanation: Blockchain is a distributed ledger technology where transactions are recorded in blocks that are cryptographically linked, making the data immutable and tamper-evident. Learn more.

Q84. Which threat hunting model uses four core features (Adversary, Capability, Infrastructure, and Victim) to analyze security incidents?

Explanation: The Diamond Model of Intrusion Analysis emphasizes the relationships between the Adversary, Capability, Infrastructure, and Victim to understand malicious activity. Learn more.

Q85. Which email control helps receiving servers verify that mail is authorized by the sending domain policy?

Explanation: DMARC builds on SPF and DKIM to tell receivers how to handle messages that fail authentication checks. Learn more.

Q86. Which monitoring tool aggregates logs and correlates security events?

Explanation: Security information and event management systems collect, normalize, and correlate logs for alerting and investigation. Learn more.

Q87. What is the primary purpose of a playbook in incident response?

Explanation: Playbooks document repeatable response actions, roles, escalation paths, and decision points. Learn more.

Q88. Which control verifies that software updates came from the trusted publisher and were not altered?

Explanation: Digital signatures provide authenticity and integrity for software packages and updates. Learn more.

Q89. Which control helps ensure logs from different systems can be accurately correlated?

Explanation: Synchronized clocks allow analysts to build accurate event timelines across systems. Learn more.

Q90. Which incident response action should occur before wiping an infected system when evidence is needed?

Explanation: Evidence should be preserved before destructive remediation if investigation or legal requirements apply. Learn more.

Q91. Which control can detect known malicious file hashes on endpoints?

Explanation: EDR products can monitor endpoint activity and detect known malicious files or behaviors. Learn more.

Q92. What is the primary purpose of a security information and event management (SIEM) system?

Explanation: A SIEM collects, aggregates, and correlates log and event data from across an organization's systems, enabling security teams to detect anomalies and respond to incidents in real time. Learn more.

Q93. Which type of penetration test provides the testing team with full knowledge of the network architecture, source code, and credentials in advance?

Explanation: A white-box (or clear-box) penetration test gives testers complete knowledge of the target environment, including source code and architecture, allowing for a thorough and efficient assessment. Learn more.

Q94. Which incident response phase involves removing the cause of the incident and restoring affected systems to normal operation?

Explanation: The eradication and recovery phase removes the root cause of an incident, such as malware, and restores affected systems to a known-good, operational state. Learn more.

More CompTIA Security+ practice topics