Security+ (SY0-701) Practice Questions – Set 1 (1–100)

1. Which security principle ensures users have only the permissions needed to perform
their job duties?

A. Separation of duties
B. Least privilege
C. Job rotation
D. Mandatory vacation

Answer: B. Least privilege

Explanation: Least privilege grants users only the minimum permissions required to perform
their tasks. This limits the damage that can occur if an account is compromised.

2. Which type of malware encrypts files and demands payment for their release?

A. Trojan
B. Worm
C. Spyware
D. Ransomware

Answer: D. Ransomware

Explanation: Ransomware encrypts victim data and demands a ransom payment, usually in
cryptocurrency, for the decryption key.

3. Which authentication factor does a fingerprint represent?

A. Something you know

B. Something you have
C. Something you are
D. Somewhere you are

Answer: C. Something you are

Explanation: Biometrics such as fingerprints, facial recognition, and iris scans fall under
“something you are.”

4. Which protocol secures web traffic?

A. HTTP
B. FTP
C. HTTPS
D. Telnet

Answer: C. HTTPS

Explanation: HTTPS uses TLS to encrypt communications between clients and web servers.

5. Which type of control is a locked door?

A. Administrative
B. Detective
C. Physical
D. Technical

Answer: C. Physical

Explanation: Physical controls protect facilities and equipment from unauthorized physical
access.

6. Which attack uses fraudulent emails to trick users into revealing sensitive
information?

A. Smishing
B. Vishing
C. Phishing
D. Tailgating

Answer: C. Phishing

Explanation: Phishing attacks rely on deceptive emails to steal credentials or deliver

malware.

7. Symmetric encryption uses:

A. Public and private keys

B. One shared secret key
C. Hash values only
D. Certificates

Answer: B. One shared secret key

Explanation: Symmetric encryption uses the same key for encryption and decryption,
making it faster than asymmetric encryption.
8. Which component of the CIA Triad ensures data remains accurate and unaltered?

A. Confidentiality
B. Integrity
C. Availability
D. Accountability

Answer: B. Integrity

Explanation: Integrity protects data from unauthorized modification or destruction.

9. What is the primary purpose of a firewall?

A. Encrypt files
B. Filter network traffic
C. Detect malware signatures
D. Create backups

Answer: B. Filter network traffic

Explanation: Firewalls enforce security policies by allowing or blocking traffic based on

rules.

10. Which protocol provides secure remote command-line access?

A. Telnet
B. FTP
C. SSH
D. SNMP

Answer: C. SSH

Explanation: SSH encrypts remote administration sessions, unlike Telnet.

11. What does MFA stand for?

A. Managed File Access

B. Multi-Factor Authentication
C. Mandatory Firewall Authorization
D. Multi-Function Access

Answer: B. Multi-Factor Authentication

Explanation: MFA requires two or more authentication factors, significantly increasing
account security.

12. Which attack attempts every possible password combination?

A. Dictionary attack
B. Password spraying
C. Brute force attack
D. Replay attack

Answer: C. Brute force attack

Explanation: Brute force attacks systematically try all possible combinations until the
correct password is found.

13. Which tool captures and analyzes network packets?

A. Nessus
B. Nmap
C. Wireshark
D. Metasploit

Answer: C. Wireshark

Explanation: Wireshark is widely used for network troubleshooting and packet analysis.

14. Bell-LaPadula primarily focuses on:

A. Availability
B. Integrity
C. Confidentiality
D. Authentication

Answer: C. Confidentiality

Explanation: Bell-LaPadula prevents unauthorized disclosure of information.

15. Biba primarily focuses on:

A. Integrity
B. Confidentiality
C. Availability
D. Authentication

Answer: A. Integrity

Explanation: Biba prevents unauthorized modification of information.

16. Which control type discourages violations through fear of consequences?

A. Preventive
B. Detective
C. Deterrent
D. Corrective

Answer: C. Deterrent

Explanation: Examples include warning signs and security cameras.

17. Incremental backups save:

A. All files every time

B. Files changed since the last backup of any type
C. Files changed since the last full backup
D. Only deleted files

Answer: B. Files changed since the last backup of any type

Explanation: Incremental backups are efficient but restoration can take longer.

18. Differential backups save:

A. Files changed since the last full backup

B. All files every day
C. Only new files
D. Files changed since the last incremental backup

Answer: A. Files changed since the last full backup

Explanation: Differential backups grow larger over time but simplify restoration.

19. Non-repudiation ensures:

A. Confidentiality of data
B. Users cannot deny their actions
C. System availability
D. Network redundancy

Answer: B. Users cannot deny their actions

Explanation: Digital signatures commonly provide non-repudiation.

20. Which authentication factor is a smart card?

A. Something you know

B. Something you are
C. Something you have
D. Somewhere you are

Answer: C. Something you have

Explanation: Physical tokens and smart cards are possession factors.

21. SMS phishing is called:

A. Vishing
B. Smishing
C. Whaling
D. Pharming

Answer: B. Smishing

Explanation: Smishing uses text messages to deceive users.

22. Voice-based phishing is known as:

A. Smishing
B. Pharming
C. Vishing
D. Whaling

Answer: C. Vishing

Explanation: Vishing uses telephone calls to trick victims.

23. Which phishing attack targets executives?

A. Spear phishing
B. Whaling
C. Smishing
D. Baiting

Answer: B. Whaling

Explanation: Whaling targets high-profile individuals such as CEOs.

24. Unsanitized database input can lead to:

A. Cross-Site Scripting
B. SQL Injection
C. Buffer Overflow
D. Replay Attacks

Answer: B. SQL Injection

Explanation: Attackers manipulate database queries by injecting malicious SQL code.

25. Malicious scripts executed in a browser represent:

A. SQL Injection
B. Cross-Site Request Forgery
C. Cross-Site Scripting (XSS)
D. DNS Poisoning

Answer: C. Cross-Site Scripting (XSS)

Explanation: XSS attacks inject malicious scripts into trusted websites.

26. Separation of duties helps prevent:

A. Malware infections
B. Fraud and abuse
C. Network outages
D. Data encryption failures

Answer: B. Fraud and abuse

Explanation: Critical tasks require multiple individuals to complete.

27. Using multiple security layers is called:

A. Zero Trust
B. Defense in Depth
C. Segmentation
D. Need to Know

Answer: B. Defense in Depth

Explanation: Multiple overlapping controls increase overall security.

28. Mandatory Access Control (MAC) uses:

A. User discretion
B. Job roles
C. Security labels
D. Time restrictions

Answer: C. Security labels

Explanation: Access decisions are based on classifications like Secret or Top Secret.

29. Role-Based Access Control assigns permissions based on:

A. User preference
B. Security labels
C. Job responsibilities
D. Geographic location

Answer: C. Job responsibilities

Explanation: RBAC simplifies permission management.

30. Attribute-Based Access Control uses:

A. Job roles only

B. Security labels only
C. User-defined permissions
D. Multiple attributes such as location and department

Answer: D. Multiple attributes such as location and department

Explanation: ABAC provides highly flexible access decisions.

31. RADIUS is primarily used for:

A. Secure email
B. Centralized authentication
C. Web encryption
D. VPN tunneling

Answer: B. Centralized authentication

Explanation: RADIUS is commonly used for network authentication.

32. LDAP is used for:

A. Directory services
B. Email delivery
C. DNS resolution
D. Packet analysis

Answer: A. Directory services

Explanation: LDAP enables access to directory information.

33. HTTPS uses which port?

A. 80
B. 21
C. 443
D. 25

Answer: C. 443

Explanation: Port 443 is the standard port for HTTPS.

34. SSH uses which port?

A. 21
B. 22
C. 23
D. 443
Answer: B. 22

Explanation: Port 22 is assigned to SSH.

35. DNS primarily uses which port?

A. 25
B. 53
C. 80
D. 110

Answer: B. 53

Explanation: DNS uses port 53 for both UDP and TCP communications.

36. SMTP uses which port?

A. 25
B. 53
C. 80
D. 110

Answer: A. 25

Explanation: SMTP is used for sending email.

37. RDP uses which port?

A. 443
B. 22
C. 3389
D. 8080

Answer: C. 3389

Explanation: RDP provides remote desktop functionality.

38. Which technology creates secure tunnels over untrusted networks?

A. NAT
B. VLAN
C. VPN
D. DHCP

Answer: C. VPN

Explanation: VPNs encrypt data traveling over public networks.

39. Which protocol secures VPN communications?

A. SNMP
B. IPsec
C. FTP
D. Telnet

Answer: B. IPsec

Explanation: IPsec provides authentication and encryption for VPNs.

40. A DoS attack attempts to:

A. Steal credentials
B. Prevent system availability
C. Modify databases
D. Encrypt files

Answer: B. Prevent system availability

Explanation: DoS attacks overwhelm systems with requests.

41. A Distributed Denial-of-Service (DDoS) attack differs from a DoS attack because it:

A. Uses only one attacking system

B. Encrypts network traffic
C. Uses multiple compromised systems to launch the attack
D. Only targets web servers

Answer: C. Uses multiple compromised systems to launch the attack

Explanation: DDoS attacks leverage many infected devices (botnets) to overwhelm a target,
making them harder to mitigate than single-source DoS attacks.
42. Which wireless attack involves setting up a rogue access point that mimics a
legitimate network?

A. Bluesnarfing
B. Evil Twin
C. Bluejacking
D. Wardriving

Answer: B. Evil Twin

Explanation: An Evil Twin attack tricks users into connecting to a malicious wireless access
point, allowing attackers to intercept traffic.

43. Which wireless security protocol is currently considered the most secure?

A. WEP
B. WPA
C. WPA2
D. WPA3

Answer: D. WPA3

Explanation: WPA3 provides stronger encryption and improved protection against brute-
force attacks compared to earlier protocols.

44. Which wireless security protocol is considered obsolete and insecure?

A. WPA3
B. WPA2-AES
C. WPA
D. WEP

Answer: D. WEP

Explanation: WEP uses weak encryption algorithms that can be cracked relatively easily.

45. Which tool is commonly used to identify open ports and services?

A. Wireshark
B. Nessus
C. Nmap
D. John the Ripper

Answer: C. Nmap
Explanation: Nmap is a network scanning tool used to discover hosts, services, and open
ports.

46. Which hashing algorithm is generally considered secure?

A. MD5
B. SHA-1
C. SHA-256
D. CRC32

Answer: C. SHA-256

Explanation: SHA-256 is part of the SHA-2 family and is widely used because of its
resistance to collision attacks.

47. What is the primary purpose of hashing?

A. Encrypt data for confidentiality

B. Verify data integrity
C. Compress files
D. Hide data

Answer: B. Verify data integrity

Explanation: Hashing generates a fixed-size value used to detect unauthorized modifications

to data.

48. Which cryptographic system uses a public and private key pair?

A. Symmetric encryption
B. Asymmetric encryption
C. Hashing
D. Tokenization

Answer: B. Asymmetric encryption

Explanation: Asymmetric encryption uses a public key for encryption and a private key for
decryption.

49. Which certificate format is Base64 encoded and commonly used with web servers?
A. DER
B. PEM
C. CER
D. PKCS#12

Answer: B. PEM

Explanation: PEM certificates are ASCII encoded and are commonly used in Apache and
Nginx environments.

50. Which attack captures valid authentication data and reuses it later?

A. SQL Injection
B. Replay Attack
C. Buffer Overflow
D. Rootkit

Answer: B. Replay Attack

Explanation: Replay attacks occur when attackers capture valid transmissions and resend
them to gain unauthorized access.

51. Which vulnerability occurs when a program writes data beyond allocated memory
boundaries?

A. SQL Injection
B. Buffer Overflow
C. Cross-Site Scripting
D. CSRF

Answer: B. Buffer Overflow

Explanation: Buffer overflows can allow attackers to execute arbitrary code or crash
applications.

52. Which malware disguises itself as legitimate software?

A. Worm
B. Trojan
C. Spyware
D. Ransomware

Answer: B. Trojan
Explanation: Trojans trick users into installing malicious software by appearing legitimate.

53. Which malware can self-replicate without user interaction?

A. Virus
B. Trojan
C. Worm
D. Rootkit

Answer: C. Worm

Explanation: Worms spread automatically across networks by exploiting vulnerabilities.

54. Which malware type is designed to hide its existence while maintaining privileged
access?

A. Adware
B. Spyware
C. Rootkit
D. Worm

Answer: C. Rootkit

Explanation: Rootkits provide stealthy privileged access and are difficult to detect.

55. Which malware secretly gathers information about a user’s activities?

A. Spyware
B. Worm
C. Trojan
D. Logic Bomb

Answer: A. Spyware

Explanation: Spyware monitors user actions and collects sensitive information.

56. What is a zero-day vulnerability?

A. A vulnerability with no available patch

B. A vulnerability that has existed for years
C. A backup failure
D. An expired certificate
Answer: A. A vulnerability with no available patch

Explanation: Zero-day vulnerabilities are unknown or unpatched flaws that attackers can
exploit before fixes are available.

57. Which penetration testing approach provides no prior knowledge of the target
environment?

A. White Box
B. Gray Box
C. Black Box
D. Transparent Box

Answer: C. Black Box

Explanation: Black-box testing simulates an external attacker with no internal information.

58. Which penetration testing approach provides full knowledge of the target
environment?

A. Black Box
B. White Box
C. Gray Box
D. External Box

Answer: B. White Box

Explanation: White-box testing provides testers with complete access to system information.

59. Which testing approach provides limited information to testers?

A. White Box
B. Black Box
C. Gray Box
D. Open Box

Answer: C. Gray Box

Explanation: Gray-box testing balances realism and efficiency by providing partial

information.

60. Which activity identifies vulnerabilities without exploiting them?

A. Red Team Exercise
B. Vulnerability Scanning
C. Social Engineering
D. Threat Hunting

Answer: B. Vulnerability Scanning

Explanation: Vulnerability scans identify known weaknesses so organizations can remediate

them.

61. Which tool is commonly used for vulnerability scanning?

A. Nmap
B. Wireshark
C. Nessus
D. tcpdump

Answer: C. Nessus

Explanation: Nessus is a widely used vulnerability assessment tool.

62. What is the primary purpose of a SIEM solution?

A. Encrypt data
B. Aggregate and analyze security logs
C. Replace firewalls
D. Create backups

Answer: B. Aggregate and analyze security logs

Explanation: SIEM solutions provide centralized visibility into security events.

63. What does EDR stand for?

A. Enterprise Detection Resource

B. Endpoint Detection and Response
C. External Data Recovery
D. Enhanced Disaster Recovery

Answer: B. Endpoint Detection and Response

Explanation: EDR tools monitor endpoints for suspicious activities and assist with incident
response.
64. Which control type restores systems after a security incident?

A. Preventive
B. Detective
C. Corrective
D. Deterrent

Answer: C. Corrective

Explanation: Corrective controls minimize the impact of incidents and restore normal
operations.

65. Which control identifies security incidents after they occur?

A. Detective
B. Preventive
C. Corrective
D. Compensating

Answer: A. Detective

Explanation: Detective controls include IDS, monitoring systems, and security audits.

66. What is the purpose of a honeypot?

A. Prevent malware infections

B. Attract attackers for monitoring and analysis
C. Store encrypted backups
D. Authenticate users

Answer: B. Attract attackers for monitoring and analysis

Explanation: Honeypots are decoy systems used to study attacker behavior.

67. Which attack exploits human psychology rather than technical vulnerabilities?

A. Social Engineering
B. SQL Injection
C. DDoS
D. Buffer Overflow

Answer: A. Social Engineering

Explanation: Social engineering manipulates people into revealing sensitive information.

68. Which attack involves following an authorized individual into a restricted area?

A. Shoulder Surfing
B. Tailgating
C. Vishing
D. Baiting

Answer: B. Tailgating

Explanation: Tailgating exploits trust to gain physical access without authorization.

69. Which attack involves observing someone enter credentials?

A. Shoulder Surfing
B. Smishing
C. Whaling
D. Pharming

Answer: A. Shoulder Surfing

Explanation: Attackers visually observe victims entering passwords or PINs.

70. Which social engineering tactic involves creating a fabricated scenario to gain trust?

A. Baiting
B. Pretexting
C. Smishing
D. Impersonation

Answer: B. Pretexting

Explanation: Pretexting relies on believable stories to obtain information.

71. Which attack leaves infected USB drives in public places?

A. Tailgating
B. Vishing
C. Baiting
D. Smishing
Answer: C. Baiting

Explanation: Attackers exploit human curiosity by offering something enticing.

72. What does AUP stand for?

A. Access User Procedure

B. Acceptable Use Policy
C. Authorized User Protection
D. Authentication Usage Plan

Answer: B. Acceptable Use Policy

Explanation: An AUP outlines acceptable behaviors when using company systems.

73. Which agreement prevents parties from disclosing confidential information?

A. SLA
B. MOU
C. NDA
D. AUP

Answer: C. NDA

Explanation: Non-Disclosure Agreements protect sensitive information from unauthorized

disclosure.

74. What does SLA stand for?

A. Security Level Assessment

B. Service Level Agreement
C. Standard Logging Agreement
D. Security License Authorization

Answer: B. Service Level Agreement

Explanation: SLAs define expected service performance and responsibilities.

75. Which process ensures critical business operations continue during disruptions?

A. Disaster Recovery
B. Incident Response
C. Business Continuity
D. Threat Hunting

Answer: C. Business Continuity

Explanation: Business continuity planning focuses on maintaining essential operations.

76. Which plan focuses specifically on restoring IT systems after a disaster?

A. Incident Response Plan

B. Business Continuity Plan
C. Disaster Recovery Plan
D. Change Management Plan

Answer: C. Disaster Recovery Plan

Explanation: Disaster recovery plans address the restoration of systems and data.

77. Which incident response phase involves identifying and analyzing threats?

A. Preparation
B. Recovery
C. Detection and Analysis
D. Lessons Learned

Answer: C. Detection and Analysis

Explanation: This phase confirms incidents and determines their scope and severity.

78. During which incident response phase are systems restored to normal operation?

A. Containment
B. Recovery
C. Preparation
D. Detection

Answer: B. Recovery

Explanation: Recovery focuses on returning systems to production safely.

79. Which incident response phase removes the root cause of an incident?
A. Eradication
B. Preparation
C. Recovery
D. Detection

Answer: A. Eradication

Explanation: Eradication eliminates malware, compromised accounts, or vulnerabilities.

80. What is typically the final phase of the incident response lifecycle?

A. Recovery
B. Containment
C. Lessons Learned
D. Detection

Answer: C. Lessons Learned

Explanation: Organizations review incidents to improve future security processes.

81. What is the primary purpose of data classification?

A. Increase network performance

B. Determine backup schedules
C. Categorize data based on sensitivity and value
D. Encrypt all company data

Answer: C. Categorize data based on sensitivity and value

Explanation: Data classification helps organizations apply appropriate security controls

based on how sensitive or critical the data is. Common classifications include Public,
Internal, Confidential, and Restricted.

82. Which data classification label is generally considered the highest sensitivity level?

A. Public
B. Internal Use Only
C. Confidential
D. Top Secret

Answer: D. Top Secret

Explanation: Top Secret data represents information that would cause severe damage if
disclosed without authorization. Organizations may use different labels, but Top Secret is
commonly the highest level.

83. What does DLP stand for?

A. Data Loss Prevention

B. Distributed Logging Platform
C. Digital Layer Protection
D. Dynamic Login Protocol

Answer: A. Data Loss Prevention

Explanation: DLP solutions monitor, detect, and prevent unauthorized transmission or

exposure of sensitive data.

84. Which technique replaces sensitive data with non-sensitive substitute values?

A. Hashing
B. Encryption
C. Tokenization
D. Salting

Answer: C. Tokenization

Explanation: Tokenization substitutes sensitive data with tokens while maintaining the
ability to reference the original data securely.

85. Which technique hides portions of sensitive information, such as displaying only the
last four digits of a credit card number?

A. Tokenization
B. Data Masking
C. Hashing
D. Obfuscation

Answer: B. Data Masking

Explanation: Data masking obscures sensitive information while allowing users to work
with realistic-looking data.

86. What is the primary purpose of network segmentation?

A. Increase internet speed
B. Reduce storage requirements
C. Limit attacker movement between systems
D. Improve wireless coverage

Answer: C. Limit attacker movement between systems

Explanation: Network segmentation divides networks into smaller sections, reducing the
impact of breaches and limiting lateral movement.

87. Which security model assumes no user or device should be trusted automatically?

A. Defense in Depth
B. Least Privilege
C. Zero Trust
D. Separation of Duties

Answer: C. Zero Trust

Explanation: Zero Trust follows the principle of “never trust, always verify,” requiring
continuous validation of access requests.

88. Which cloud deployment model provides services to the general public over the
internet?

A. Private Cloud
B. Hybrid Cloud
C. Public Cloud
D. Community Cloud

Answer: C. Public Cloud

Explanation: Public cloud services are offered by third-party providers and shared among
multiple customers.

89. Which cloud deployment model combines private and public cloud environments?

A. Public Cloud
B. Hybrid Cloud
C. Community Cloud
D. Dedicated Cloud

Answer: B. Hybrid Cloud

Explanation: Hybrid clouds allow organizations to leverage both private and public cloud
resources.

90. Which cloud service model delivers fully functional applications to end users?

A. IaaS
B. PaaS
C. SaaS
D. FaaS

Answer: C. SaaS

Explanation: Software as a Service provides users with complete applications managed by

the cloud provider.

91. Which cloud service model provides virtualized computing infrastructure?

A. SaaS
B. PaaS
C. IaaS
D. XaaS

Answer: C. IaaS

Explanation: Infrastructure as a Service provides virtual machines, storage, and networking

resources.

92. Which cloud service model provides a platform for application development and
deployment?

A. IaaS
B. PaaS
C. SaaS
D. SECaaS

Answer: B. PaaS

Explanation: Platform as a Service provides development frameworks, operating systems,

and runtime environments.

93. What does CASB stand for?

A. Cloud Access Security Broker
B. Centralized Authentication Security Baseline
C. Cloud Authorization Service Bridge
D. Cyber Access Security Buffer

Answer: A. Cloud Access Security Broker

Explanation: CASBs provide visibility and enforcement of security policies across cloud
services.

94. Which protocol is commonly used for Single Sign-On (SSO) in enterprise
environments?

A. LDAP
B. SAML
C. SSH
D. SNMP

Answer: B. SAML

Explanation: Security Assertion Markup Language (SAML) enables authentication and

authorization data exchange between identity providers and service providers.

95. Which protocol is commonly used for delegated authorization?

A. Kerberos
B. OAuth
C. RADIUS
D. TACACS+

Answer: B. OAuth

Explanation: OAuth allows applications to access resources on behalf of users without

exposing passwords.

96. Which authentication protocol builds on OAuth 2.0 to provide identity information?

A. Kerberos
B. LDAP
C. OpenID Connect
D. TACACS+

Answer: C. OpenID Connect

Explanation: OpenID Connect adds authentication capabilities to OAuth 2.0.

97. Which authentication protocol uses tickets to verify identities?

A. SAML
B. Kerberos
C. RADIUS
D. LDAP

Answer: B. Kerberos

Explanation: Kerberos uses tickets issued by a Key Distribution Center (KDC) to

authenticate users securely.

98. Which protocol provides Authentication, Authorization, and Accounting (AAA)

services and is commonly used for administrative access to network devices?

A. LDAP
B. SSH
C. TACACS+
D. FTP

Answer: C. TACACS+

Explanation: TACACS+ separates authentication, authorization, and accounting functions,

making it ideal for managing network devices.

99. What is the primary goal of risk mitigation?

A. Eliminate all risk permanently

B. Ignore low-priority risks
C. Reduce the likelihood or impact of identified risks
D. Transfer all risk to third parties

Answer: C. Reduce the likelihood or impact of identified risks

Explanation: Risk mitigation implements controls that decrease the probability of an event
occurring or minimize its impact.

100. Which risk response strategy involves purchasing cyber insurance?

A. Acceptance
B. Mitigation
C. Avoidance
D. Transfer

Answer: D. Transfer

Explanation: Risk transfer shifts the financial impact of a risk to another party, such as
through insurance policies or outsourcing agreements.
Security+ (SY0-701) Practice Questions – Set 2
(Questions 101–120)
101. Which type of encryption uses two mathematically related keys?

A. Symmetric encryption
B. Stream encryption
C. Asymmetric encryption
D. Block encryption

Answer: C. Asymmetric encryption

Explanation: Asymmetric encryption uses a public key and a private key. The public key
encrypts data, while the private key decrypts it. RSA and ECC are common examples.

102. Which key in asymmetric encryption can be freely distributed?

A. Session key
B. Private key
C. Shared key
D. Public key

Answer: D. Public key

Explanation: The public key is designed to be shared openly. The private key must remain
confidential.

103. Which key must remain secret in a public key infrastructure (PKI)?

A. Public key
B. Session key
C. Private key
D. Recovery key

Answer: C. Private key

Explanation: The security of asymmetric cryptography depends on protecting the private

key from unauthorized access.

104. What is the primary purpose of a digital signature?

A. Encrypt files
B. Verify authenticity and integrity
C. Compress data
D. Increase availability
Answer: B. Verify authenticity and integrity

Explanation: Digital signatures confirm that data has not been altered and verify the identity
of the sender.

105. Which PKI component is responsible for issuing digital certificates?

A. Registration Authority (RA)

B. Certificate Authority (CA)
C. Key Escrow Agent
D. Recovery Authority

Answer: B. Certificate Authority (CA)

Explanation: The CA validates identities and issues digital certificates that bind identities to
public keys.

106. What is the purpose of a Certificate Revocation List (CRL)?

A. Store private keys

B. List invalid or revoked certificates
C. Generate certificates
D. Encrypt communications

Answer: B. List invalid or revoked certificates

Explanation: CRLs allow systems to verify whether a certificate should no longer be trusted
before its expiration date.

107. Which protocol provides real-time certificate status checking?

A. LDAP
B. OCSP
C. SNMP
D. SFTP

Answer: B. OCSP

Explanation: Online Certificate Status Protocol (OCSP) provides up-to-date certificate

validation information.

108. Which hashing algorithm is currently considered secure and widely used?

A. MD5
B. SHA-1
C. SHA-256
D. CRC32

Answer: C. SHA-256

Explanation: SHA-256 belongs to the SHA-2 family and is resistant to known collision
attacks.

109. Which encryption algorithm is considered outdated and insecure?

A. AES
B. RSA
C. DES
D. ECC

Answer: C. DES

Explanation: DES uses a 56-bit key, making it vulnerable to brute-force attacks.

110. What does AES stand for?

A. Advanced Encryption Standard

B. Automated Encryption System
C. Advanced Enterprise Security
D. Authenticated Encryption Standard

Answer: A. Advanced Encryption Standard

Explanation: AES is the current standard for symmetric encryption and replaced DES.

111. Which AES key size offers the strongest security?

A. 56-bit
B. 128-bit
C. 192-bit
D. 256-bit

Answer: D. 256-bit

Explanation: Larger key sizes provide greater resistance against brute-force attacks.

112. Which algorithm is a symmetric encryption algorithm?

A. RSA
B. ECC
C. AES
D. DSA

Answer: C. AES

Explanation: AES uses the same key for encryption and decryption.

113. Which algorithm is an asymmetric encryption algorithm?

A. AES
B. Blowfish
C. Twofish
D. RSA

Answer: D. RSA

Explanation: RSA uses a public/private key pair for secure communications.

114. Which algorithm provides strong security with smaller key sizes?

A. DES
B. ECC
C. RC4
D. 3DES

Answer: B. ECC

Explanation: Elliptic Curve Cryptography offers equivalent security to RSA using much
smaller keys.

115. What is the purpose of adding a salt to passwords before hashing?

A. Reduce password length

B. Prevent replay attacks
C. Protect against rainbow table attacks
D. Encrypt passwords

Answer: C. Protect against rainbow table attacks

Explanation: Salting makes identical passwords produce different hash values, defeating
precomputed attacks.
116. What is the purpose of a nonce in cryptographic operations?

A. Generate certificates
B. Prevent replay attacks
C. Store keys
D. Hash passwords

Answer: B. Prevent replay attacks

Explanation: A nonce is a unique value used only once, preventing attackers from reusing
captured communications.

117. Which attack involves intercepting communication between two parties?

A. Brute force attack

B. Buffer overflow attack
C. On-path attack
D. Logic bomb

Answer: C. On-path attack

Explanation: On-path (formerly Man-in-the-Middle) attacks allow attackers to intercept and

potentially alter communications.

118. Which attack manipulates DNS records to redirect users to malicious websites?

A. ARP spoofing
B. SQL injection
C. DNS poisoning
D. Cross-site scripting

Answer: C. DNS poisoning

Explanation: DNS poisoning corrupts DNS caches to redirect users to fraudulent websites.

119. Which protocol secures DNS communications using digital signatures?

A. DNSSEC
B. IPsec
C. SSH
D. TLS

Answer: A. DNSSEC

Explanation: DNSSEC ensures the authenticity and integrity of DNS responses.

120. Which attack manipulates ARP messages to intercept local network traffic?

A. ARP spoofing
B. Smishing
C. SQL injection
D. Pharming

Answer: A. ARP spoofing

Explanation: ARP spoofing associates an attacker’s MAC address with another device’s IP
address to intercept communications.

121. Which vulnerability occurs when the timing of events can be manipulated by an
attacker?

A. SQL Injection
B. Cross-Site Scripting
C. Race Condition
D. Buffer Overflow

Answer: C. Race Condition

Explanation: Race conditions occur when multiple processes access shared resources
simultaneously, allowing attackers to exploit timing differences to gain unauthorized access
or alter data.

122. Which vulnerability is caused by improper validation of user-supplied input?

A. Weak encryption
B. Improper Input Handling
C. Poor logging practices
D. Network segmentation failure

Answer: B. Improper Input Handling

Explanation: Failing to validate input can lead to vulnerabilities such as SQL injection,
command injection, and cross-site scripting attacks.

123. What is the primary purpose of fuzz testing?

A. Monitor network traffic

B. Identify software vulnerabilities using unexpected inputs
C. Encrypt sensitive information
D. Validate user credentials
Answer: B. Identify software vulnerabilities using unexpected inputs

Explanation: Fuzzing sends random or malformed data to applications to identify crashes

and coding weaknesses.

124. Which testing method uses random inputs to identify vulnerabilities?

A. Regression Testing
B. Unit Testing
C. Fuzz Testing
D. Penetration Testing

Answer: C. Fuzz Testing

Explanation: Fuzz testing helps identify vulnerabilities caused by improper handling of

unexpected data.

125. What is the purpose of secure code reviews?

A. Increase application speed

B. Identify security flaws in source code
C. Generate encryption keys
D. Improve user interfaces

Answer: B. Identify security flaws in source code

Explanation: Code reviews help developers identify vulnerabilities before applications are
deployed.

126. Which development approach integrates security throughout the software development
lifecycle?

A. Agile
B. Waterfall
C. DevSecOps
D. ITIL

Answer: C. DevSecOps

Explanation: DevSecOps incorporates security practices into development and operations

from the beginning of the development process.
127. During which SDLC phase are security requirements typically identified?

A. Testing
B. Deployment
C. Requirements Gathering
D. Maintenance

Answer: C. Requirements Gathering

Explanation: Identifying security requirements early reduces costly fixes later in the
development process.

128. Which environment is typically used by developers to build applications?

A. Production
B. Staging
C. Development
D. Disaster Recovery

Answer: C. Development

Explanation: Development environments are used for coding and initial testing before
moving applications to later stages.

129. Which environment most closely resembles production and is used for final testing?

A. Sandbox
B. Development
C. Staging
D. Backup

Answer: C. Staging

Explanation: Staging environments mirror production to identify issues before deployment.

130. Which security technique isolates applications to prevent them from affecting the host
system?

A. Tokenization
B. Sandboxing
C. Segmentation
D. Obfuscation

Answer: B. Sandboxing
Explanation: Sandboxing limits application access to system resources, reducing the impact
of malicious code.

131. What is the primary purpose of virtualization?

A. Encrypt data
B. Run multiple virtual systems on a single physical host
C. Improve DNS resolution
D. Eliminate malware

Answer: B. Run multiple virtual systems on a single physical host

Explanation: Virtualization improves resource utilization and isolation by hosting multiple

virtual machines.

132. Which technology packages applications with their dependencies into isolated units?

A. RAID
B. PKI
C. Containerization
D. Segmentation

Answer: C. Containerization

Explanation: Containers provide lightweight isolation and portability across environments.

133. Which platform is commonly used for container orchestration?

A. Docker
B. Kubernetes
C. Nessus
D. Wireshark

Answer: B. Kubernetes

Explanation: Kubernetes automates deployment, scaling, and management of containerized

applications.

134. What is the primary purpose of a DMZ (Demilitarized Zone)?

A. Store backups
B. Isolate public-facing services from internal networks
C. Replace firewalls
D. Encrypt network traffic
Answer: B. Isolate public-facing services from internal networks

Explanation: A DMZ limits exposure of internal systems by placing public services in a

separate network segment.

135. Which device distributes incoming traffic across multiple servers?

A. Router
B. Firewall
C. IDS
D. Load Balancer

Answer: D. Load Balancer

Explanation: Load balancers improve availability and performance by distributing

workloads efficiently.

136. Which network device forwards traffic between different networks?

A. Hub
B. Switch
C. Router
D. Bridge

Answer: C. Router

Explanation: Routers operate at Layer 3 and direct packets between networks using IP
addresses.

137. Which device forwards frames within a LAN based on MAC addresses?

A. Router
B. Switch
C. Firewall
D. Modem

Answer: B. Switch

Explanation: Switches operate at Layer 2 and improve efficiency by forwarding traffic only
where needed.

138. What does IDS stand for?

A. Internet Detection Service

B. Intrusion Detection System
C. Identity Defense Solution
D. Internal Data Scanner

Answer: B. Intrusion Detection System

Explanation: IDS solutions monitor network or host activity and generate alerts when
suspicious behavior is detected.

139. What does IPS stand for?

A. Intrusion Prevention System

B. Internet Protection Service
C. Internal Prevention Standard
D. Identity Protection Solution

Answer: A. Intrusion Prevention System

Explanation: IPS solutions actively detect and block malicious traffic automatically.

140. What is the primary difference between an IDS and an IPS?

A. IDS blocks traffic; IPS only monitors

B. IDS monitors and alerts; IPS can block malicious activity
C. IDS encrypts traffic; IPS decrypts traffic
D. There is no difference

Answer: B. IDS monitors and alerts; IPS can block malicious activity

Explanation: IDS provides visibility into threats, while IPS adds active prevention
capabilities by stopping malicious traffic.

141. Which type of firewall tracks the state of active network connections?

A. Packet-filtering firewall
B. Stateless firewall
C. Stateful firewall
D. Proxy firewall

Answer: C. Stateful firewall

Explanation: Stateful firewalls monitor the state of active connections and make filtering
decisions based on the context of the traffic, providing better security than simple packet
filtering.
142. Which firewall type acts as an intermediary between clients and servers?

A. Stateful firewall
B. Packet-filtering firewall
C. Proxy firewall
D. Circuit-level firewall

Answer: C. Proxy firewall

Explanation: Proxy firewalls terminate incoming connections and establish new ones on
behalf of clients, hiding internal systems from external networks.

143. What does NAC stand for?

A. Network Access Control

B. Network Authentication Center
C. Network Authorization Channel
D. Network Application Configuration

Answer: A. Network Access Control

Explanation: NAC solutions enforce security policies before allowing devices to connect to
the network.

144. What is the primary purpose of Network Access Control (NAC)?

A. Encrypt network traffic

B. Monitor logs
C. Restrict network access based on security policies
D. Perform vulnerability scans

Answer: C. Restrict network access based on security policies

Explanation: NAC ensures only compliant and authorized devices can access organizational
resources.

145. What is the purpose of an Access Control List (ACL)?

A. Manage backups
B. Define rules that permit or deny traffic
C. Encrypt data transmissions
D. Generate authentication tokens

Answer: B. Define rules that permit or deny traffic

Explanation: ACLs control network traffic by specifying which users or systems can access
resources.

146. Which wireless frequency band generally provides the greatest range?

A. 5 GHz
B. 6 GHz
C. 2.4 GHz
D. 60 GHz

Answer: C. 2.4 GHz

Explanation: The 2.4 GHz band travels farther and penetrates walls more effectively than
higher frequencies, though it is more susceptible to interference.

147. Which wireless frequency band typically offers higher speeds and less interference?

A. 900 MHz
B. 2.4 GHz
C. 5 GHz
D. 433 MHz

Answer: C. 5 GHz

Explanation: The 5 GHz band provides higher throughput and experiences less congestion
than the 2.4 GHz band.

148. Which Bluetooth attack involves sending unsolicited messages to nearby devices?

A. Bluesnarfing
B. Bluejacking
C. Evil Twin
D. Bluespoofing

Answer: B. Bluejacking

Explanation: Bluejacking is the act of sending unsolicited messages to Bluetooth-enabled

devices, typically for annoyance rather than data theft.

149. Which Bluetooth attack involves unauthorized access to data on a device?

A. Bluejacking
B. Bluesnarfing
C. Evil Twin
D. Smishing
Answer: B. Bluesnarfing

Explanation: Bluesnarfing allows attackers to steal contacts, messages, and other sensitive
information from vulnerable Bluetooth devices.

150. What is the primary objective of security awareness training?

A. Eliminate all cyber threats

B. Improve network performance
C. Reduce human-related security risks
D. Replace technical controls

Answer: C. Reduce human-related security risks

Explanation: Security awareness training educates employees about threats such as phishing
and social engineering to reduce successful attacks.

151. What is the first phase of the incident response process?

A. Detection and Analysis

B. Recovery
C. Preparation
D. Containment

Answer: C. Preparation

Explanation: Preparation involves developing policies, training staff, and implementing

tools necessary to respond effectively to incidents.

152. During which incident response phase are affected systems isolated to limit damage?

A. Recovery
B. Preparation
C. Containment
D. Lessons Learned

Answer: C. Containment

Explanation: Containment aims to prevent the spread of an incident while preserving

evidence.

153. Which forensic concept ensures evidence remains unaltered and properly documented?

A. Chain of Custody
B. Data Masking
C. Tokenization
D. Data Classification

Answer: A. Chain of Custody

Explanation: Chain of custody documents who handled evidence and when, preserving its
integrity for legal proceedings.

154. What is the primary purpose of chain of custody documentation?

A. Store backup records

B. Track evidence handling and ownership
C. Monitor network traffic
D. Classify information assets

Answer: B. Track evidence handling and ownership

Explanation: Proper chain of custody ensures evidence is admissible and has not been
tampered with.

155. What is the purpose of forensic imaging?

A. Compress digital evidence

B. Create an exact copy of digital evidence
C. Encrypt storage media
D. Improve system performance

Answer: B. Create an exact copy of digital evidence

Explanation: Forensic imaging preserves original evidence by allowing investigators to

work on a duplicate copy.

156. Before analyzing a compromised hard drive, investigators should first:

A. Reinstall the operating system

B. Update antivirus software
C. Create a forensic image
D. Delete temporary files

Answer: C. Create a forensic image

Explanation: Investigators should preserve the original evidence and conduct analysis on a
copy to maintain integrity.
157. Which type of evidence is lost when a system loses power?

A. Archived logs
B. Backup files
C. Volatile memory (RAM)
D. Printed reports

Answer: C. Volatile memory (RAM)

Explanation: Volatile memory contains temporary information that disappears when power
is removed.

158. Which tool is commonly used for memory analysis in digital forensics?

A. Nmap
B. Wireshark
C. Volatility
D. Nessus

Answer: C. Volatility

Explanation: Volatility is an open-source framework used to analyze memory dumps during

forensic investigations.

159. What is the primary purpose of security logging?

A. Improve system performance

B. Record events for monitoring and investigations
C. Encrypt sensitive data
D. Increase storage efficiency

Answer: B. Record events for monitoring and investigations

Explanation: Logs provide valuable information for detecting incidents, troubleshooting

issues, and supporting forensic investigations.

160. Which type of logs commonly records authentication successes and failures?

A. Application logs
B. System logs
C. Security logs
D. Network logs

Answer: C. Security logs

Explanation: Security logs capture events related to authentication, authorization, and other
security-relevant activities.

161. Which type of log primarily records firewall activity and network traffic events?

A. Application logs
B. Security logs
C. Network logs
D. System logs

Answer: C. Network logs

Explanation: Network logs capture information about traffic flow, firewall decisions, and
communication events between systems, making them essential for identifying suspicious
activity.

162. What is the primary purpose of audit logs?

A. Improve network performance

B. Track system resource usage
C. Provide accountability and traceability of actions
D. Encrypt sensitive information

Answer: C. Provide accountability and traceability of actions

Explanation: Audit logs record who performed specific actions and when they occurred,
supporting compliance and forensic investigations.

163. What does RTO stand for?

A. Recovery Testing Objective

B. Recovery Time Objective
C. Resource Tolerance Objective
D. Response Time Operation

Answer: B. Recovery Time Objective

Explanation: RTO defines the maximum acceptable amount of downtime after a disruption
before operations must be restored.

164. What does RPO stand for?

A. Recovery Point Objective

B. Recovery Process Objective
C. Resource Protection Objective
D. Response Point Operation

Answer: A. Recovery Point Objective

Explanation: RPO defines the maximum acceptable amount of data loss measured in time.

165. Which metric determines the maximum amount of acceptable downtime?

A. MTTD
B. MTTR
C. RPO
D. RTO

Answer: D. RTO

Explanation: RTO focuses on how quickly systems must be restored after an outage.

166. Which metric determines the maximum acceptable amount of data loss?

A. RPO
B. RTO
C. MTTR
D. ALE

Answer: A. RPO

Explanation: RPO helps organizations determine how frequently backups should occur.

167. Which disaster recovery site provides the fastest restoration capability?

A. Cold Site
B. Warm Site
C. Hot Site
D. Alternate Site

Answer: C. Hot Site

Explanation: Hot sites contain fully operational systems and up-to-date data, allowing for
rapid recovery.
168. Which recovery site contains hardware but requires data restoration before becoming
operational?

A. Cold Site
B. Warm Site
C. Hot Site
D. Mobile Site

Answer: B. Warm Site

Explanation: Warm sites offer a balance between cost and recovery speed.

169. Which recovery site provides facilities but little or no equipment?

A. Hot Site
B. Warm Site
C. Cold Site
D. Mirrored Site

Answer: C. Cold Site

Explanation: Cold sites are inexpensive but require significant time to become operational.

170. What is the purpose of a Business Impact Analysis (BIA)?

A. Identify malware infections

B. Evaluate firewall effectiveness
C. Determine the impact of disruptions on business operations
D. Monitor user activity

Answer: C. Determine the impact of disruptions on business operations

Explanation: A BIA identifies critical functions and helps establish recovery priorities.

171. Which process identifies critical business functions and their dependencies?

A. Vulnerability Assessment
B. Penetration Testing
C. Business Impact Analysis
D. Threat Hunting

Answer: C. Business Impact Analysis

Explanation: BIAs help organizations understand operational risks and prioritize recovery
efforts.
172. Which risk assessment approach uses numerical values and financial estimates?

A. Qualitative Risk Analysis

B. Quantitative Risk Analysis
C. Baseline Assessment
D. Gap Analysis

Answer: B. Quantitative Risk Analysis

Explanation: Quantitative analysis uses measurable data, such as monetary values, to assess
risk.

173. Which risk assessment approach categorizes risks as High, Medium, or Low?

A. Quantitative Analysis
B. Qualitative Analysis
C. Cost-Benefit Analysis
D. Trend Analysis

Answer: B. Qualitative Analysis

Explanation: Qualitative analysis uses subjective measures to prioritize risks when exact
financial values are unavailable.

174. Which formula is used to calculate Annual Loss Expectancy (ALE)?

A. ALE = AV × EF
B. ALE = SLE × ARO
C. ALE = RTO × RPO
D. ALE = ARO ÷ SLE

Answer: B. ALE = SLE × ARO

Explanation: ALE estimates expected annual financial loss by multiplying Single Loss
Expectancy (SLE) by Annual Rate of Occurrence (ARO).

175. What does SLE stand for?

A. Security Loss Estimate

B. Single Loss Expectancy
C. System Log Evaluation
D. Security Level Exposure

Answer: B. Single Loss Expectancy

Explanation: SLE represents the monetary loss expected from a single occurrence of a risk
event.

176. What does ARO stand for?

A. Annual Rate of Occurrence

B. Authorized Recovery Objective
C. Asset Risk Overview
D. Access Recovery Operation

Answer: A. Annual Rate of Occurrence

Explanation: ARO estimates how often a specific threat is expected to occur annually.

177. Which risk response strategy involves accepting the risk without implementing
additional controls?

A. Mitigation
B. Transfer
C. Avoidance
D. Acceptance

Answer: D. Acceptance

Explanation: Organizations may accept risks when the cost of mitigation exceeds the
potential impact.

178. Which risk response strategy eliminates activities that create the risk?

A. Mitigation
B. Avoidance
C. Transfer
D. Acceptance

Answer: B. Avoidance

Explanation: Avoidance removes the source of risk entirely, such as discontinuing a risky
business process.

179. Which administrative control requires employees to take time away from their duties to
uncover fraud?

A. Job Rotation
B. Separation of Duties
C. Mandatory Vacations
D. Least Privilege

Answer: C. Mandatory Vacations

Explanation: Mandatory vacations can reveal fraudulent activities that require continuous
involvement by a malicious employee.

180. Which type of control includes policies, procedures, and security awareness training?

A. Physical Controls
B. Technical Controls
C. Administrative Controls
D. Detective Controls

Answer: C. Administrative Controls

Explanation: Administrative controls govern organizational security through policies,

standards, procedures, and training programs.

181. Which cybersecurity framework is widely used for managing and improving
organizational security programs?

A. PCI DSS
B. NIST Cybersecurity Framework (CSF)
C. HIPAA
D. GDPR

Answer: B. NIST Cybersecurity Framework (CSF)

Explanation: The NIST CSF provides a flexible approach to managing cybersecurity risks
through five core functions: Identify, Protect, Detect, Respond, and Recover.

182. Which regulation is designed to protect healthcare information in the United States?

A. PCI DSS
B. SOX
C. HIPAA
D. GDPR

Answer: C. HIPAA

Explanation: The Health Insurance Portability and Accountability Act (HIPAA) establishes
standards for protecting patient health information (PHI).
183. Which standard applies to organizations that process, store, or transmit payment card
information?

A. HIPAA
B. GDPR
C. PCI DSS
D. SOX

Answer: C. PCI DSS

Explanation: The Payment Card Industry Data Security Standard (PCI DSS) defines security
requirements for handling payment card data.

184. Which regulation focuses on protecting the personal data and privacy of individuals in
the European Union?

A. HIPAA
B. SOX
C. GDPR
D. FERPA

Answer: C. GDPR

Explanation: The General Data Protection Regulation (GDPR) establishes strict rules
regarding the collection, processing, and protection of EU citizens’ personal data.

185. Which regulation primarily addresses financial reporting and internal controls for
publicly traded companies?

A. HIPAA
B. GDPR
C. PCI DSS
D. SOX

Answer: D. SOX

Explanation: The Sarbanes-Oxley Act (SOX) was enacted to improve corporate

accountability and financial reporting integrity.

186. What is the primary purpose of a data retention policy?

A. Improve network performance

B. Define how long information should be stored
C. Increase storage capacity
D. Encrypt archived data
Answer: B. Define how long information should be stored

Explanation: Data retention policies ensure that information is kept only as long as
necessary to satisfy business, legal, and regulatory requirements.

187. What is the primary purpose of a data destruction policy?

A. Improve backup performance

B. Define secure disposal procedures for sensitive data
C. Increase data availability
D. Simplify data classification

Answer: B. Define secure disposal procedures for sensitive data

Explanation: Proper data destruction prevents unauthorized recovery of sensitive

information when it is no longer needed.

188. Which method physically destroys storage media to prevent data recovery?

A. Data wiping
B. Degaussing
C. Shredding
D. Encryption

Answer: C. Shredding

Explanation: Shredding physically destroys storage devices, making data recovery

impossible.

189. Which data sanitization method uses strong magnetic fields to erase information from
magnetic media?

A. Data wiping
B. Tokenization
C. Degaussing
D. Masking

Answer: C. Degaussing

Explanation: Degaussing disrupts the magnetic fields used to store data, rendering the media
unusable.
190. Which data sanitization method overwrites existing information with new data patterns?

A. Data wiping
B. Degaussing
C. Shredding
D. Encryption

Answer: A. Data wiping

Explanation: Data wiping securely overwrites stored information to prevent recovery while
allowing media reuse.

191. What is the primary purpose of change management?

A. Eliminate all system modifications

B. Ensure changes are reviewed, approved, and documented
C. Increase network bandwidth
D. Replace incident response procedures

Answer: B. Ensure changes are reviewed, approved, and documented

Explanation: Change management reduces the risk of unintended disruptions caused by

system modifications.

192. Which process ensures that proposed system changes are evaluated before
implementation?

A. Vulnerability Management
B. Change Management
C. Threat Hunting
D. Incident Response

Answer: B. Change Management

Explanation: Change management provides a structured process for assessing the impact
and risk of changes.

193. What is the purpose of asset management?

A. Monitor employee performance

B. Identify, track, and manage organizational assets
C. Replace disaster recovery planning
D. Improve wireless coverage

Answer: B. Identify, track, and manage organizational assets

Explanation: Asset management helps organizations understand what resources they own
and protect.

194. Which process verifies that systems comply with organizational policies and regulatory
requirements?

A. Penetration Testing
B. Compliance Auditing
C. Fuzz Testing
D. Threat Hunting

Answer: B. Compliance Auditing

Explanation: Compliance audits evaluate whether security controls meet established

standards and regulations.

195. What is the primary purpose of penetration testing?

A. Identify vulnerabilities through simulated attacks

B. Monitor system logs
C. Replace vulnerability scanning
D. Encrypt communications

Answer: A. Identify vulnerabilities through simulated attacks

Explanation: Penetration testing actively exploits weaknesses to evaluate an organization’s

security posture.

196. Threat hunting is best described as:

A. Responding only to automated alerts

B. Proactively searching for hidden threats within an environment
C. Performing system backups
D. Conducting regulatory audits

Answer: B. Proactively searching for hidden threats within an environment

Explanation: Threat hunting involves actively investigating networks and systems to identify
adversaries that have evaded traditional detection methods.

197. Which team is primarily responsible for defending systems and responding to incidents?

A. Red Team
B. Blue Team
C. Purple Team
D. White Team

Answer: B. Blue Team

Explanation: Blue teams focus on defensive security operations, monitoring, and incident
response.

198. Which team simulates attacks to evaluate an organization’s defenses?

A. Blue Team
B. Purple Team
C. Red Team
D. Green Team

Answer: C. Red Team

Explanation: Red teams emulate real-world adversaries to test security controls and identify
weaknesses.

199. Which team facilitates collaboration between offensive and defensive security
personnel?

A. Red Team
B. Blue Team
C. Purple Team
D. White Team

Answer: C. Purple Team

Explanation: Purple teams combine insights from red and blue teams to improve overall
security effectiveness.

200. An administrator discovers that employees have excessive access permissions beyond
their job requirements. Which security principle should be implemented to address this issue?

A. Mandatory Vacations
B. Job Rotation
C. Least Privilege
D. Data Masking

Answer: C. Least Privilege

Explanation: The principle of least privilege ensures users receive only the permissions
necessary to perform their job duties, reducing the risk
Security+ (SY0-701) Practice Questions – Set 3
(Questions 201–220)
201. An employee reports that all files on their workstation have become inaccessible and a
note demands cryptocurrency payment. What type of malware is MOST likely responsible?

A. Worm
B. Spyware
C. Trojan
D. Ransomware

Answer: D. Ransomware

Explanation: Ransomware encrypts a victim’s files and demands payment for the decryption
key. Organizations should isolate affected systems immediately and restore data from
backups when possible.

202. Which security control BEST prevents users from installing unauthorized applications?

A. Antivirus software
B. Application allow listing
C. DLP solution
D. Network segmentation

Answer: B. Application allow listing

Explanation: Application allow listing permits only approved applications to run, preventing
unauthorized or malicious software execution.

203. Which authentication method generates a unique code that changes periodically?

A. Password history
B. TOTP
C. Kerberos
D. LDAP

Answer: B. TOTP

Explanation: Time-based One-Time Passwords (TOTP) generate short-lived authentication

codes commonly used in MFA implementations.
204. A company wants to prevent employees from reusing previous passwords. Which
control should be implemented?

A. Password complexity requirements

B. Password history enforcement
C. Account lockout policies
D. Password expiration policies

Answer: B. Password history enforcement

Explanation: Password history prevents users from reusing recently used passwords,
encouraging stronger password practices.

205. Which attack uses a small number of commonly used passwords against many accounts?

A. Dictionary attack
B. Brute-force attack
C. Password spraying
D. Credential stuffing

Answer: C. Password spraying

Explanation: Password spraying avoids account lockouts by trying a few common

passwords across multiple accounts.

206. Which attack uses stolen username and password combinations from previous breaches?

A. Password spraying
B. Credential stuffing
C. Brute force
D. Replay attack

Answer: B. Credential stuffing

Explanation: Credential stuffing exploits password reuse by attempting previously

compromised credentials on different services.

207. Which control limits the number of consecutive failed login attempts?

A. Password history
B. Password complexity
C. Account lockout
D. Single Sign-On

Answer: C. Account lockout

Explanation: Account lockout policies reduce the effectiveness of brute-force attacks by
temporarily disabling accounts after repeated failures.

208. Which security principle grants access only when it is necessary for job responsibilities?

A. Need to Know
B. Separation of Duties
C. Due Care
D. Job Rotation

Answer: A. Need to Know

Explanation: Need to Know restricts access to information required for an individual’s

specific duties.

209. Due diligence primarily refers to:

A. Implementing security controls

B. Investigating and understanding risks before making decisions
C. Accepting organizational risk
D. Delegating security responsibilities

Answer: B. Investigating and understanding risks before making decisions

Explanation: Due diligence involves assessing risks and gathering information to make
informed decisions.

210. Due care refers to:

A. Identifying security risks

B. Taking reasonable actions to reduce identified risks
C. Outsourcing risk management
D. Conducting penetration tests

Answer: B. Taking reasonable actions to reduce identified risks

Explanation: Due care means implementing appropriate safeguards to protect organizational

assets.

211. Which security practice BEST limits lateral movement of attackers in IoT
environments?

A. Strong passwords only

B. Network segmentation
C. Antivirus installation
D. Increased bandwidth

Answer: B. Network segmentation

Explanation: Segmentation isolates IoT devices from critical systems, limiting attacker
movement after compromise.

212. What is a common security concern associated with IoT devices?

A. Excessive processing power

B. Weak default credentials and configurations
C. Excessive storage capacity
D. High bandwidth requirements

Answer: B. Weak default credentials and configurations

Explanation: Many IoT devices ship with default passwords and lack robust security
controls.

213. Which technology verifies the integrity of the boot process?

A. TPM
B. Secure Boot
C. RAID
D. DLP

Answer: B. Secure Boot

Explanation: Secure Boot ensures that only trusted software is loaded during startup.

214. What does TPM stand for?

A. Trusted Platform Module

B. Threat Prevention Mechanism
C. Total Protection Management
D. Transaction Processing Module

Answer: A. Trusted Platform Module

Explanation: A TPM securely stores cryptographic keys and supports hardware-based

security functions.
215. What is the primary purpose of a Trusted Platform Module (TPM)?

A. Improve network throughput

B. Securely store cryptographic keys
C. Replace antivirus software
D. Monitor system logs

Answer: B. Securely store cryptographic keys

Explanation: TPMs provide hardware-backed protection for encryption keys and

authentication secrets.

216. Which technology encrypts the entire contents of a storage device?

A. DLP
B. Full Disk Encryption (FDE)
C. Tokenization
D. RAID

Answer: B. Full Disk Encryption (FDE)

Explanation: FDE protects data stored on a device, especially if the device is lost or stolen.

217. Which control BEST protects data on a lost laptop?

A. Antivirus software
B. Full Disk Encryption
C. Patch management
D. Network segmentation

Answer: B. Full Disk Encryption

Explanation: FDE ensures that data remains inaccessible without proper authentication.

218. Which process ensures systems receive updates that address security vulnerabilities?

A. Vulnerability scanning
B. Patch management
C. Threat hunting
D. Data classification

Answer: B. Patch management

Explanation: Patch management reduces exposure by applying vendor-released security

updates promptly.
219. What is the purpose of a secure baseline configuration?

A. Increase internet speed

B. Define approved system settings and configurations
C. Replace backups
D. Eliminate the need for firewalls

Answer: B. Define approved system settings and configurations

Explanation: Baselines establish standardized configurations to reduce vulnerabilities and

configuration drift.

220. Which concept describes the ability of systems to continue operating despite attacks or
failures?

A. Availability
B. Integrity
C. Resilience
D. Confidentiality

Answer: C. Resilience

Explanation: Resilience refers to an organization’s ability to withstand, recover from, and

adapt to adverse conditions.

221. Which assessment type verifies that systems comply with internal policies and external
regulations?

A. Penetration testing
B. Vulnerability scanning
C. Compliance assessment
D. Threat hunting

Answer: C. Compliance assessment

Explanation: Compliance assessments determine whether systems and processes meet

regulatory requirements and organizational policies. Examples include PCI DSS and HIPAA
audits.

222. What is a compensating control?

A. A control that eliminates all risk

B. A temporary control that provides equivalent protection when the preferred control cannot
be implemented
C. A control that only detects attacks
D. A physical security control

Answer: B. A temporary control that provides equivalent protection when the preferred
control cannot be implemented

Explanation: Compensating controls provide alternative safeguards when primary controls

are not feasible due to technical or business constraints.

223. Which security principle denies all access unless explicitly permitted?

A. Need to Know
B. Separation of Duties
C. Implicit Deny
D. Due Care

Answer: C. Implicit Deny

Explanation: Implicit deny ensures that access is blocked by default and only granted
through specific authorization.

224. What is the purpose of geofencing in cybersecurity?

A. Encrypt network traffic

B. Restrict access based on geographic location
C. Monitor wireless signals
D. Manage backups

Answer: B. Restrict access based on geographic location

Explanation: Geofencing uses location-based rules to allow or deny access from specific
regions.

225. Which authentication factor category does GPS location belong to?

A. Something you know

B. Something you have
C. Somewhere you are
D. Something you are

Answer: C. Somewhere you are

Explanation: Location-based authentication uses geographic position as an authentication

factor.
226. Which biometric authentication method analyzes typing patterns?

A. Fingerprint recognition
B. Facial recognition
C. Keystroke dynamics
D. Retina scanning

Answer: C. Keystroke dynamics

Explanation: Keystroke dynamics examine typing rhythm and patterns as a behavioral

biometric.

227. Which biometric technology analyzes blood vessel patterns?

A. Fingerprint scanning
B. Vein recognition
C. Voice recognition
D. Iris recognition

Answer: B. Vein recognition

Explanation: Vein recognition uses infrared light to identify unique vein patterns beneath the
skin.

228. What is the primary purpose of Multi-Factor Authentication (MFA)?

A. Reduce password length requirements

B. Use multiple independent authentication factors to improve security
C. Replace encryption technologies
D. Eliminate account lockouts

Answer: B. Use multiple independent authentication factors to improve security

Explanation: MFA requires users to provide evidence from different authentication

categories, reducing the likelihood of unauthorized access.

229. Which attack attempts to exhaust system resources by flooding a service with traffic?

A. SQL Injection
B. DDoS attack
C. Smishing
D. Tailgating

Answer: B. DDoS attack

Explanation: Distributed Denial-of-Service attacks use numerous systems to overwhelm
targets and disrupt availability.

230. Which backup type copies all selected data every time it runs?

A. Incremental backup
B. Differential backup
C. Full backup
D. Snapshot backup

Answer: C. Full backup

Explanation: Full backups provide complete copies of data but require the most storage and
time.

231. Which RAID level provides striping without redundancy?

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 10

Answer: A. RAID 0

Explanation: RAID 0 improves performance through striping but provides no fault

tolerance.

232. Which RAID level provides disk mirroring?

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 6

Answer: B. RAID 1

Explanation: RAID 1 duplicates data across disks, providing redundancy in case of drive
failure.

233. Which RAID level uses distributed parity and requires a minimum of three disks?

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 10
Answer: C. RAID 5

Explanation: RAID 5 offers a balance between performance, storage efficiency, and fault
tolerance.

234. Which RAID level combines striping and mirroring?

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 10

Answer: D. RAID 10

Explanation: RAID 10 provides both performance improvements and redundancy by

combining RAID 0 and RAID 1.

235. Which DNS record maps a hostname to an IPv4 address?

A. AAAA
B. MX
C. PTR
D. A

Answer: D. A

Explanation: An A record resolves a domain name to an IPv4 address.

236. Which DNS record maps a hostname to an IPv6 address?

A. A
B. MX
C. AAAA
D. PTR

Answer: C. AAAA

Explanation: AAAA records perform the same function as A records but for IPv6 addresses.

237. Which DNS record specifies mail servers responsible for receiving email?

A. TXT
B. PTR
C. MX
D. CNAME
Answer: C. MX

Explanation: Mail Exchange (MX) records identify the mail servers responsible for handling
email for a domain.

238. Which DNS record is commonly used for reverse DNS lookups?

A. A
B. MX
C. PTR
D. TXT

Answer: C. PTR

Explanation: PTR records map IP addresses back to hostnames, often used in email
validation.

239. Which email security technology uses cryptographic signatures to validate message
authenticity?

A. SPF
B. DKIM
C. DMARC
D. TLS

Answer: B. DKIM

Explanation: DomainKeys Identified Mail (DKIM) adds digital signatures to email

messages to verify they originated from authorized servers.

240. Which email security technology specifies which mail servers are authorized to send
email on behalf of a domain?

A. SPF
B. DKIM
C. DMARC
D. S/MIME

Answer: A. SPF

Explanation: Sender Policy Framework (SPF) helps prevent email spoofing by identifying
authorized sending servers.
241. Which email security standard uses SPF and DKIM results to determine how to handle
suspicious messages?

A. SMTP
B. DMARC
C. S/MIME
D. DNSSEC

Answer: B. DMARC

Explanation: Domain-based Message Authentication, Reporting, and Conformance

(DMARC) builds on SPF and DKIM to instruct mail servers how to handle unauthenticated
emails and provides reporting capabilities.

242. What is the primary purpose of threat intelligence?

A. Encrypt network communications

B. Provide actionable information about current and emerging threats
C. Replace antivirus software
D. Eliminate all vulnerabilities

Answer: B. Provide actionable information about current and emerging threats

Explanation: Threat intelligence helps organizations understand attacker tactics, techniques,

and procedures (TTPs) to improve defenses and decision-making.

243. What does IOC stand for?

A. Internal Operations Center

B. Indicator of Compromise
C. Incident Operations Control
D. Information Oversight Committee

Answer: B. Indicator of Compromise

Explanation: IOCs are artifacts such as malicious IP addresses, file hashes, or domain names
that indicate potential security incidents.

244. In cybersecurity, what does TTP stand for?

A. Threat Testing Procedure

B. Tactical Threat Prevention
C. Tactics, Techniques, and Procedures
D. Technical Transfer Process

Answer: C. Tactics, Techniques, and Procedures

Explanation: TTPs describe how threat actors operate, including their behaviors and
methods during attacks.

245. Which framework is commonly used to map adversary behaviors and attack techniques?

A. COBIT
B. PCI DSS
C. MITRE ATT&CK
D. ITIL

Answer: C. MITRE ATT&CK

Explanation: MITRE ATT&CK is a knowledge base of adversary tactics and techniques

used to improve detection and defense capabilities.

246. Which type of Indicator of Compromise is an IP address associated with malicious

activity?

A. Behavioral indicator
B. Atomic indicator
C. Computed indicator
D. Sequential indicator

Answer: B. Atomic indicator

Explanation: Atomic indicators include individual artifacts such as IP addresses, file hashes,
or domain names that can be directly observed.

247. What is the primary objective of threat hunting?

A. Wait for SIEM alerts

B. Proactively identify hidden threats within an environment
C. Perform backups
D. Conduct compliance audits

Answer: B. Proactively identify hidden threats within an environment

Explanation: Threat hunting actively searches for indicators of malicious activity that may
have evaded automated detection tools.

248. Which type of malware remains dormant until a specific condition triggers it?

A. Worm
B. Rootkit
C. Logic Bomb
D. Spyware

Answer: C. Logic Bomb

Explanation: Logic bombs activate when predefined conditions are met, such as a specific
date or user action.

249. Which attack redirects users to malicious websites even when they enter the correct
URL?

A. Smishing
B. Vishing
C. Pharming
D. Tailgating

Answer: C. Pharming

Explanation: Pharming manipulates DNS resolution processes to redirect users to fraudulent

websites.

250. What is the purpose of code obfuscation?

A. Improve application performance

B. Make code more difficult to understand and reverse engineer
C. Encrypt network communications
D. Replace application testing

Answer: B. Make code more difficult to understand and reverse engineer

Explanation: Obfuscation complicates code analysis, making it harder for attackers to

understand or modify applications.

251. What is the primary purpose of a jump server?

A. Provide backup services

B. Serve as a controlled access point for administrative tasks
C. Encrypt storage devices
D. Monitor network performance

Answer: B. Serve as a controlled access point for administrative tasks

Explanation: Jump servers provide a secure intermediary for administrators accessing

sensitive systems.
252. Which security strategy divides networks into smaller isolated segments?

A. Tokenization
B. Segmentation
C. Obfuscation
D. Hashing

Answer: B. Segmentation

Explanation: Segmentation limits the spread of attacks and improves access control.

253. Which security model assumes that no entity should be trusted by default?

A. Defense in Depth
B. Zero Trust
C. Least Privilege
D. Separation of Duties

Answer: B. Zero Trust

Explanation: Zero Trust continuously verifies users and devices before granting access.

254. Which cloud deployment model is dedicated exclusively to a single organization?

A. Public Cloud
B. Hybrid Cloud
C. Community Cloud
D. Private Cloud

Answer: D. Private Cloud

Explanation: Private clouds provide greater control and customization but often require
higher costs.

255. What is the primary purpose of a CASB (Cloud Access Security Broker)?

A. Replace firewalls
B. Enforce security policies across cloud environments
C. Provide VPN connectivity
D. Manage certificates

Answer: B. Enforce security policies across cloud environments

Explanation: CASBs provide visibility, compliance enforcement, and data protection for
cloud services.
256. Which testing approach verifies that updates do not introduce unintended issues?

A. Fuzz Testing
B. Penetration Testing
C. Regression Testing
D. Stress Testing

Answer: C. Regression Testing

Explanation: Regression testing ensures that previously functioning features continue to

operate correctly after modifications.

257. Which phase of change management evaluates the risks and impact of proposed
modifications?

A. Approval
B. Assessment
C. Implementation
D. Documentation

Answer: B. Assessment

Explanation: Assessment determines whether proposed changes could negatively affect

systems or operations.

258. Why is separation of environments important in application development?

A. It improves network speed

B. It reduces the risk of production disruptions
C. It eliminates vulnerabilities
D. It replaces disaster recovery plans

Answer: B. It reduces the risk of production disruptions

Explanation: Maintaining separate development, testing, and production environments

prevents accidental impacts on live systems.

259. Which forensic principle helps ensure digital evidence is admissible in legal
proceedings?

A. Encryption
B. Chain of Custody
C. Segmentation
D. Tokenization
Answer: B. Chain of Custody

Explanation: Chain of custody documents how evidence was collected, handled, and
transferred to maintain integrity.

260. Malware has been detected on a critical server. What should be done FIRST?

A. Delete all infected files

B. Reboot the server
C. Isolate the server from the network
D. Notify customers immediately

Answer: C. Isolate the server from the network

Explanation: Isolation limits the spread of malware and preserves evidence for investigation
and remediation.

261. Which security principle ensures that no single individual has complete control over a
critical process?

A. Least Privilege
B. Job Rotation
C. Separation of Duties
D. Mandatory Vacations

Answer: C. Separation of Duties

Explanation: Separation of Duties (SoD) divides critical tasks among multiple individuals to
reduce the risk of fraud, errors, and abuse of privileges.

262. Which attack uses malformed or unexpected packets to exploit vulnerabilities in

systems?

A. Smishing
B. Buffer Overflow
C. Malformed Packet Attack
D. Credential Stuffing

Answer: C. Malformed Packet Attack

Explanation: Attackers may send specially crafted packets designed to crash services or
exploit weaknesses in packet processing logic.
263. Which technology allows users to authenticate once and access multiple applications?

A. LDAP
B. SSO
C. MFA
D. RADIUS

Answer: B. SSO

Explanation: Single Sign-On (SSO) improves user convenience by allowing one

authentication event to provide access to multiple systems.

264. What is a significant security concern associated with Single Sign-On?

A. Increased password complexity

B. Multiple login prompts
C. A compromised account can provide broad access
D. Reduced user productivity

Answer: C. A compromised account can provide broad access

Explanation: Because SSO grants access to multiple services, compromising a single

account can have widespread consequences.

265. Which social engineering technique involves pretending to be a trusted individual?

A. Tailgating
B. Baiting
C. Impersonation
D. Shoulder Surfing

Answer: C. Impersonation

Explanation: Attackers use impersonation to gain trust and convince victims to reveal
sensitive information.

266. Which physical security control uses electronic credentials to restrict access?

A. Bollards
B. Access Badges
C. Security Guards
D. Motion Sensors

Answer: B. Access Badges

Explanation: Badge systems provide controlled physical access and can generate audit
records of entry attempts.

267. Which physical control is designed to stop vehicles from entering restricted areas?

A. CCTV Cameras
B. Access Badges
C. Bollards
D. Turnstiles

Answer: C. Bollards

Explanation: Bollards are physical barriers used to prevent unauthorized vehicle access.

268. Which physical security control detects movement within a secured area?

A. Motion Sensors
B. Locks
C. Security Signage
D. Fencing

Answer: A. Motion Sensors

Explanation: Motion sensors help identify unauthorized movement and can trigger alarms or
surveillance systems.

269. Which fire suppression system is most appropriate for protecting data centers without
damaging equipment?

A. Wet Pipe Sprinkler System

B. Dry Pipe Sprinkler System
C. Clean Agent Fire Suppression System
D. Foam Suppression System

Answer: C. Clean Agent Fire Suppression System

Explanation: Clean agent systems suppress fires without leaving residue or damaging
electronic equipment.

270. Which environmental control helps detect excessive heat in server rooms?

A. Humidity Sensors
B. Motion Sensors
C. Temperature Sensors
D. Smoke Detectors
Answer: C. Temperature Sensors

Explanation: Temperature monitoring helps prevent overheating that could damage systems
or cause outages.

271. Which cloud characteristic allows resources to scale automatically based on demand?

A. Segmentation
B. Elasticity
C. Redundancy
D. Obfuscation

Answer: B. Elasticity

Explanation: Elasticity enables cloud environments to dynamically allocate resources as

workload demands change.

272. Which component of the CIA Triad ensures systems and data remain accessible when
needed?

A. Confidentiality
B. Integrity
C. Availability
D. Authentication

Answer: C. Availability

Explanation: Availability focuses on maintaining reliable access to systems and information.

273. Which component of the CIA Triad protects against unauthorized disclosure of
information?

A. Integrity
B. Confidentiality
C. Availability
D. Accountability

Answer: B. Confidentiality

Explanation: Confidentiality ensures that only authorized individuals can access sensitive
information.
274. What is the purpose of an incident response playbook?

A. Replace disaster recovery plans

B. Provide predefined response procedures for specific incidents
C. Generate forensic reports automatically
D. Monitor user activity

Answer: B. Provide predefined response procedures for specific incidents

Explanation: Playbooks improve consistency and speed during incident response activities.

275. What is digital forensics primarily concerned with?

A. Developing secure applications

B. Collecting and analyzing digital evidence
C. Performing vulnerability scans
D. Monitoring cloud environments

Answer: B. Collecting and analyzing digital evidence

Explanation: Digital forensics supports investigations by preserving and examining evidence

from electronic devices.

276. What is the primary objective of vulnerability management?

A. Eliminate all organizational risks

B. Continuously identify and remediate vulnerabilities
C. Replace penetration testing activities
D. Conduct compliance audits

Answer: B. Continuously identify and remediate vulnerabilities

Explanation: Vulnerability management is an ongoing process focused on reducing exposure

to known weaknesses.

277. Which phase of vulnerability management determines which vulnerabilities should be

addressed first?

A. Discovery
B. Prioritization
C. Reporting
D. Verification

Answer: B. Prioritization
Explanation: Prioritization considers factors such as severity, exploitability, and business
impact.

278. Which assessment method identifies known weaknesses without actively exploiting
them?

A. Penetration Testing
B. Red Team Exercise
C. Vulnerability Scanning
D. Social Engineering Assessment

Answer: C. Vulnerability Scanning

Explanation: Vulnerability scans compare systems against databases of known

vulnerabilities.

279. Which security exercise simulates realistic adversary behavior against an organization?

A. Vulnerability Assessment
B. Red Team Exercise
C. Compliance Audit
D. Fuzz Testing

Answer: B. Red Team Exercise

Explanation: Red teams emulate attackers to evaluate detection and response capabilities.

280. What is the primary purpose of Purple Team exercises?

A. Replace penetration testing

B. Improve collaboration between offensive and defensive teams
C. Conduct compliance reviews
D. Manage disaster recovery planning

Answer: B. Improve collaboration between offensive and defensive teams

Explanation: Purple Teams facilitate knowledge sharing between Red Teams and Blue
Teams to strengthen defenses.

281. Which document provides evidence that security controls are operating as intended
during audits?

A. Security Metrics
B. Documentation and Audit Records
C. Threat Intelligence Reports
D. Incident Playbooks

Answer: B. Documentation and Audit Records

Explanation: Documentation such as policies, procedures, access logs, and change records
demonstrates compliance and effective security practices during assessments.

282. What is the primary purpose of security metrics?

A. Replace compliance audits

B. Measure the effectiveness of security controls and programs
C. Eliminate vulnerabilities automatically
D. Generate encryption keys

Answer: B. Measure the effectiveness of security controls and programs

Explanation: Security metrics help organizations evaluate performance, identify weaknesses,

and support informed decision-making.

283. What does MTTD stand for?

A. Mean Time To Detect

B. Mean Time To Deploy
C. Maximum Time To Detect
D. Minimum Time To Defend

Answer: A. Mean Time To Detect

Explanation: MTTD measures the average amount of time required to identify a security
incident after it occurs.

284. What does MTTR stand for in incident response?

A. Mean Time To Recover/Respond

B. Maximum Time To Recover
C. Minimum Time To Respond
D. Mean Time To Report

Answer: A. Mean Time To Recover/Respond

Explanation: MTTR measures how quickly an organization can respond to and recover from
security incidents.
285. What is a major advantage of automation in security operations?

A. Eliminates the need for analysts

B. Provides faster and more consistent responses to security events
C. Prevents all cyberattacks
D. Removes the need for logging

Answer: B. Provides faster and more consistent responses to security events

Explanation: Automation reduces response times and minimizes errors in repetitive security
tasks.

286. What does SOAR stand for?

A. Security Operations and Automated Response

B. Security Orchestration, Automation, and Response
C. System Operations and Automated Recovery
D. Security Oversight and Audit Reporting

Answer: B. Security Orchestration, Automation, and Response

Explanation: SOAR platforms integrate tools and automate workflows to improve incident
response efficiency.

287. What is the purpose of establishing a security baseline?

A. Increase network speed

B. Define normal operating conditions for systems and networks
C. Replace vulnerability scans
D. Encrypt stored data

Answer: B. Define normal operating conditions for systems and networks

Explanation: Baselining helps identify unusual behavior that may indicate security incidents.

288. What does UEBA stand for?

A. Unified Endpoint Behavioral Analysis

B. User and Entity Behavior Analytics
C. User Event Baseline Assessment
D. Unified Event Behavior Auditing

Answer: B. User and Entity Behavior Analytics

Explanation: UEBA analyzes behavior patterns to identify anomalies that may indicate
insider threats or compromised accounts.
289. Which principle ensures that sensitive information is only accessible to authorized
individuals?

A. Availability
B. Confidentiality
C. Integrity
D. Accountability

Answer: B. Confidentiality

Explanation: Confidentiality protects data from unauthorized disclosure through controls

such as encryption and access restrictions.

290. Which policy defines how employees should properly handle organizational data?

A. Data Handling Policy

B. Password Policy
C. Disaster Recovery Policy
D. Remote Access Policy

Answer: A. Data Handling Policy

Explanation: Data handling policies specify requirements for storing, transmitting,

classifying, and disposing of information.

291. What is risk appetite?

A. The amount of risk an organization is willing to accept to achieve objectives

B. The total number of vulnerabilities in an environment
C. The annual cost of cybersecurity programs
D. The likelihood of a threat occurring

Answer: A. The amount of risk an organization is willing to accept to achieve objectives

Explanation: Risk appetite helps organizations determine appropriate security investments

and risk treatment strategies.

292. What is risk tolerance?

A. The process of transferring risk

B. The level of variation from objectives an organization can withstand
C. The elimination of all risks
D. The annual rate of occurrence of threats

Answer: B. The level of variation from objectives an organization can withstand

Explanation: Risk tolerance defines acceptable deviations from desired outcomes before
corrective actions are required.

293. What is the purpose of third-party risk management?

A. Eliminate all vendor relationships

B. Assess and manage risks introduced by suppliers and partners
C. Replace compliance assessments
D. Reduce internal staffing requirements

Answer: B. Assess and manage risks introduced by suppliers and partners

Explanation: Third-party risk management evaluates the security posture of vendors to

reduce supply chain risks.

294. Which document often defines security expectations between organizations and
vendors?

A. Chain of Custody Form

B. Service Level Agreement (SLA)
C. Incident Report
D. Penetration Test Report

Answer: B. Service Level Agreement (SLA)

Explanation: SLAs define responsibilities, performance expectations, and sometimes

security requirements between parties.

295. What is the purpose of continuous monitoring?

A. Replace annual audits

B. Provide ongoing awareness of security posture and emerging risks
C. Eliminate all vulnerabilities
D. Encrypt network traffic

Answer: B. Provide ongoing awareness of security posture and emerging risks

Explanation: Continuous monitoring enables organizations to detect changes and respond to

threats more effectively.

296. Which cybersecurity principle assumes that breaches are inevitable and organizations
should prepare accordingly?

A. Defense in Depth
B. Assume Breach
C. Least Privilege
D. Need to Know

Answer: B. Assume Breach

Explanation: The Assume Breach mindset encourages proactive detection, response

planning, and resilience.

297. Which process verifies a user’s identity before granting access?

A. Authorization
B. Authentication
C. Accounting
D. Federation

Answer: B. Authentication

Explanation: Authentication confirms that users are who they claim to be through
credentials or other factors.

298. Which process determines what actions an authenticated user is permitted to perform?

A. Authentication
B. Accounting
C. Authorization
D. Federation

Answer: C. Authorization

Explanation: Authorization defines permissions and access rights after identity verification.

299. Which process records and tracks user activities within a system?

A. Authentication
B. Authorization
C. Accounting
D. Federation

Answer: C. Accounting

Explanation: Accounting provides audit trails and supports monitoring by recording user
actions and resource usage.
300. Which study approach is MOST effective for preparing for the Security+ exam?

A. Memorize answers without understanding concepts

B. Focus exclusively on cryptography topics
C. Understand concepts thoroughly and practice scenario-based questions regularly
D. Skip performance-based questions because they are uncommon

Answer: C. Understand concepts thoroughly and practice scenario-based questions regularly

Explanation: Security+ emphasizes applying knowledge to real-world scenarios.

Understanding the reasoning behind concepts and practicing PBQ-style questions
significantly improves exam readiness.