10 CompTIA SecurityX Questions Most Candidates Get Wrong
This set of questions is designed to mirror the analytical rigor and scenario-based thinking required for the CompTIA SecurityX (formerly CASP+) exam. Unlike lower-level certifications, these questions focus on why a solution is correct within a complex enterprise architecture, emphasizing risk management, advanced threat mitigation, and security engineering trade-offs. Read each scenario carefully and select the best answer, not just a technically possible one.
Question 1
A security architect is designing a Zero Trust architecture for a hybrid cloud environment. They need to enforce access decisions based on user identity, device health, and real-time risk, while minimizing the performance impact on the application team’s existing legacy VPN. Which approach BEST aligns with Zero Trust principles? This connects to what we discuss in 8 CompTIA Linux+ Questions Most Candidates Get Wrong.
A. Implement a VLAN segmentation strategy to isolate legacy systems from the cloud.
B. Deploy a cloud access security broker (CASB) to proxy all traffic to the legacy VPN.
C. Replace the legacy VPN with an identity-aware proxy that integrates with the existing IdP and device compliance checks.
D. Require multi-factor authentication (MFA) on the legacy VPN and increase password complexity.
Answer: C
Explanation: An identity-aware proxy (IAP) is the core of a modern Zero Trust architecture, enforcing access based on identity and context (device posture) rather than network location. While MFA (D) is critical, it does not address device health or continuous risk assessment. VLANs (A) and CASBs (B) are useful tools but do not replace the fundamental network-based trust model of a VPN with a session-based, identity-centric model.
Question 2
During a red team exercise, a penetration tester successfully exploits a web application firewall (WAF) bypass using an HTTP request with a malformed Content-Length header and chunked transfer encoding simultaneously. Which of the following is the MOST effective long-term mitigation against this specific class of attack?
A. Implement a rule in the WAF to block requests with both headers present.
B. Use a next-generation firewall (NGFW) to perform deep packet inspection on all ingress traffic.
C. Perform server-side input validation and canonicalization of all request headers in the application code.
D. Ensure the WAF and the origin server interpret the request and header termination identically.
Answer: D
Explanation: This attack exploits a "parsing desynchronization" or request smuggling vulnerability, where the WAF and the backend server disagree on where the request ends and the next begins. The definitive fix is to ensure protocol compliance and consistent interpretation across all intermediaries. While input validation (C) is good practice, it does not address the protocol-level ambiguity that causes the bypass. Blocking specific headers (A) is a fragile signature-based approach, and an NGFW (B) does not solve the application-layer parsing conflict.
Question 3
An organization is migrating to a hybrid cloud model and must encrypt data at rest in a cloud storage bucket. They want to maintain exclusive control over the encryption keys and have them stored on-premises. Which encryption strategy meets this requirement?
A. Use Server-Side Encryption with Customer-Provided Keys (SSE-C).
B. Use Server-Side Encryption with AWS KMS (SSE-KMS).
C. Use Client-Side Encryption with a key stored in a hardware security module (HSM) on-premises.
D. Enable default encryption on the bucket using a service-managed key.
Answer: C
Explanation: Client-side encryption ensures data is encrypted before it leaves the on-premises environment, and the key never leaves the customer's control (in this case, the HSM). SSE-C (A) still involves sending the key to the cloud provider for the encryption operation, even if it is not stored. SSE-KMS (B) and service-managed keys (D) mean the cloud provider manages or stores the key material, violating the "exclusive control" requirement.
Question 4
A DevOps team is implementing a CI/CD pipeline for a critical application. The security team requires a mechanism to scan container images for known vulnerabilities before they are pushed to a production registry. Which of the following is the MOST efficient and automated control to implement?
A. Perform a manual code review of the Dockerfile for insecure base images.
B. Configure the container registry to use an image scanning service upon push. For practical tips on this, see 10 SC-900 Questions Most Candidates Get Wrong.
C. Run a static application security testing (SAST) tool against the source code.
D. Use a runtime security agent in the Kubernetes cluster to monitor for malicious activity.
Answer: B
Explanation: Scanning images at the registry (e.g., using Clair or Trivy) is the standard "gate" in a CI/CD pipeline, automatically checking for CVEs and policy violations as soon as the image is built. Running a SAST tool (C) analyzes source code, not the compiled image dependencies. A manual review (A) is not scalable or automated, and runtime monitoring (D) occurs after the vulnerability has already been deployed.
Question 5
A security analyst is reviewing logs and identifies a series of successful logins from a single user account, but the login times follow the working hours of a different time zone than the user's usual location. The user has MFA enabled. Which of the following actions represents the MOST appropriate immediate response?
A. Immediately disable the user account and reset the password.
B. Change the MFA policy to require a hardware token instead of an authenticator app.
C. Flag the events as a potential account compromise and initiate an incident response process to verify the user's location.
D. Increase the logging verbosity for that specific user account to gather more data.
Answer: C
Explanation: Anomalous login patterns (time/location) are a classic indicator of a possible account takeover. The correct immediate step is to treat it as a potential incident and begin verification (e.g., contacting the user) rather than assuming a false positive. Disabling the account (A) is a drastic step that may be premature without confirming the anomaly, though it may be necessary later. Changing MFA (B) doesn't address the current compromise. Increasing logging (D) is a reactive step that fails to address the potential active threat.
Question 6
An organization is required to comply with a framework that mandates "least privilege" for all user accounts. A security administrator must provision a service account for a nightly batch job that needs to read data from a database and write a report to a file share. What is the MOST appropriate way to configure this account?
A. Grant the account 'db_datareader' and 'db_datawriter' roles on the database and 'Modify' permissions on the file share.
B. Grant the account 'sysadmin' on the database and 'Full Control' on the file share to ensure the job never fails.
C. Grant the account 'db_datareader' on the specific database tables and 'Write' permissions on the specific report folder.
D. Grant the account 'db_owner' on the database and 'Read & Execute' on the file share.
Answer: C
Explanation: Least privilege requires granting the minimum permissions necessary. The job only needs to read the database (db_datareader) and write the report (Write permissions). Granting 'sysadmin' (B) or 'db_owner' (D) is excessive. 'db_datawriter' (A) allows modifications to the database, which is not required for a read-only job, and 'Modify' on the share allows deletion and changes beyond just writing the report.
Question 7
A security manager is evaluating a new tool that uses machine learning to detect insider threats. The tool analyzes user behavior, email content, and file access patterns. Which of the following is the PRIMARY ethical concern regarding the deployment of this tool?
A. The tool may generate a high number of false positives, leading to alert fatigue.
B. The cost of the tool may exceed the allocated security budget.
C. The collection and analysis of user activity may violate employee privacy expectations and legal regulations.
D. The machine learning model may be biased against certain departments or job roles.
Answer: C For a deeper dive, check out 8 CISM Questions Most Candidates Get Wrong.
Explanation: While false positives (A) and bias (D) are valid operational concerns, the primary ethical and legal issue is the mass surveillance of employee communications and behavior. This touches on privacy laws (e.g., GDPR, state laws) and requires clear policy, consent, and transparency. Budget (B) is a procurement issue, not an ethical one. Privacy is the fundamental hurdle that must be addressed before technical deployment.
Question 8
A network administrator needs to securely connect two geographically separated offices over the public internet. The connection must provide confidentiality, integrity, and authentication for all traffic between the two sites. Which of the following is the BEST solution?
A. A site-to-site IPsec VPN tunnel.
B. A remote access SSL VPN.
C. A dedicated MPLS circuit from the ISP.
D. A GRE tunnel with a static route.
Answer: A
Explanation: A site-to-site IPsec VPN is the industry standard for securely connecting two fixed networks, providing encryption (confidentiality), hashing (integrity), and peer authentication. An SSL VPN (B) is designed for remote users, not site-to-site. MPLS (C) is a private WAN technology but does not inherently provide encryption or authentication without additional security layers. GRE (D) is a tunneling protocol but provides no encryption or security by itself.
Question 9
A security engineer is tasked with implementing a solution to protect a web application from distributed denial-of-service (DDoS) attacks that target the application layer (e.g., HTTP floods). Which of the following controls is MOST effective for this specific type of attack?
A. Increase the bandwidth of the internet connection.
B. Deploy an on-premises intrusion prevention system (IPS).
C. Use a cloud-based web application firewall (WAF) with rate limiting and bot management.
D. Configure the load balancer to drop all incoming TCP SYN packets.
Answer: C
Explanation: Application-layer DDoS attacks require a solution that can inspect HTTP traffic, distinguish between legitimate users and bots, and apply granular rate limiting. A cloud-based WAF is designed for this purpose and can absorb large volumes of traffic. Increasing bandwidth (A) helps with volumetric attacks but not application logic floods. An IPS (B) is not designed to handle high-volume application-layer floods. Dropping SYN packets (D) is a mitigation for SYN floods (a network-layer attack), not HTTP floods.
Question 10
An organization is implementing a Business Continuity Plan (BCP). They have defined a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes for their primary transactional database. Which of the following replication strategies BEST meets these requirements?
A. Asynchronous replication to a secondary site with a 1-hour lag.
B. Synchronous replication to a secondary site in the same data center.
C. Asynchronous replication to a secondary site in a different availability zone.
D. Nightly full backups to tape stored offsite.
Answer: C
Explanation: To meet an RPO of 15 minutes, the data loss must be limited to 15 minutes of transactions. Asynchronous replication with a low lag (under 15 minutes) meets this RPO while allowing the secondary site to be geographically separate (protecting against site-wide failures). Synchronous replication (B) has zero RPO but often suffers from performance issues over long distances and does not protect against a failure of the entire data center. Option A's 1-hour lag exceeds the RPO. Tape backups (D) have an RPO of up to 24 hours and a much higher RTO.
That same focus on time can help you plan the rest of your SecurityX preparation, and a free CompTIA SecurityX study plan can provide a schedule that fits the time you have.
These questions represent the critical thinking and cross-domain knowledge required for the SecurityX exam. Mastery involves not just memorizing security controls, but understanding how to apply them in complex, real-world enterprise scenarios while balancing performance, cost, and compliance. Continue practicing with scenario-based questions to build your analytical muscle.
Before you tackle more scenarios, a free CompTIA SecurityX readiness check can show you which SecurityX topics need the most review.
Use CompTIA SecurityX mock exam to fine-tune your time management before the clock starts for real.