CompTIA Security+ Practice Test Answers

Question 1
(corresponding objective: 1.3)

Creating a basic standard for application settings, security settings, and active services on every company laptop would be considered...

A. group policy
B. baseline configuration
C. patch management
*D. a security template

Question 2
(corresponding objective: 3.7)

All of the following are correct about LDAP EXCEPT:

A. some implementations use x.509 certificates for securing communications
B. some of the implementations use default TCP ports 389 and 636
* C. all attributes will be encrypted
D. most of the implementations use the x.500 directory model

Question 3
(corresponding objective: 1.6)

Which of the following is a key reason for using virtual machines in a test lab where attackers or malware may compromise a machine?

A. Easier for the attacker to compromise the machine
B. Harder for the attacker to compromise the machine
* C. Easier to restore the system to the original state
D. Harder to restore the system to the original state

Question 4
(corresponding objective: 1.1)

Which of the following is more of an irritation than a security threat?

A. Rootkit
* B. Adware
C. Spyware
D. Trojan

Question 5
(corresponding objective: 3.1)

Least privilege is defined as giving access to information:

A. based on tenure at the company
B. based on sense of urgency from management
C. that may be revealed to the public
* D. needed to complete the task

Question 6
(corresponding objective: 1.1)

Which of the following describes a piece of malicious code that is activated when specified conditions are met?

A. Trojan
B. Spyware
* C. Logic Bomb
D. Virus

Question 7
(corresponding objective: 4.6)

An administrator wishes to enable network auditing policies. Which of the following should the security administrator log?

A. Only logon failures
B. Only logon success
*C. Both logon successes and logon failures
D. Only logon failures for non-existent users

Question 8
(corresponding objective: 4.4)

From a security perspective a performance baseline is MOST useful for:

* A. detecting performance anomalies that may be due to security breaches
B. assuring that systems are working to their optimal capacity
C. knowing when security scans are going to finish
D. predicting the end of useful life for the firewall


Question 9
(corresponding objective: 2.5)

A company creates its own application that accesses the company databases and requires a unique login, based on the user’s domain account. The developer has an undocumented login for testing that does not need to be authenticated against the domain. Which of the following is a security issue regarding this scenario?

A. The login should be the same as the domain account for authentication purposes
* B. It can be used as a backdoor into the company’s databases
C. The application should not be deployed if it is not fully tested
D. It is not considered best practice to have a user remember multiple logins


Question 10
(corresponding objective: 2.1)

In order to perform a TCP hijacking attack, an attacker would be required to:

A. have a protocol analyzer intercept traffic between two hosts
* B. know the IP addresses of both hosts and sequence numbers of the TCP/IP packets
C. perform a man-in-the-middle attack and communicate directly with two hosts
D. obtain the MAC address of the both hosts