CompTIA Security+ Practice Questions: Scenario-Based Questions Unpacked

Why Scenario-Based Questions Matter

The CompTIA Security+ exam (SY0-701) is notorious for its scenario-based questions. You won't just memorize definitions; you'll be presented with real-world situations and asked to apply your knowledge. This format tests your critical thinking and ability to make decisions under pressure. To succeed, you need practice that mirrors this exact style. That's why we've crafted these CompTIA Security+ practice questions to help you think like a security professional.

Practice Questions

Question 1

A security analyst receives an alert about a user account that has been locked out multiple times within the last hour. The user is currently on vacation. Which of the following is the MOST likely cause? See also CompTIA Security+ Difficulty: The Domains Most People Underestimate for a complementary perspective.

• A. The user forgot their password and is trying to reset it.
• B. An attacker is attempting a brute-force attack on the account.
• C. The user's device has a malware infection that is causing lockouts.
• D. The account has reached its password expiration date.

Correct Answer: B

Explanation: The user is on vacation, so they are not trying to log in. Multiple lockouts indicate repeated failed attempts, which is a classic sign of a brute-force attack. Option A is unlikely because the user is away. Option C is possible but less likely without additional indicators. Option D would cause a single lockout, not multiple, and users typically get a warning before expiration.

Question 2

A company's web server is experiencing a Distributed Denial of Service (DDoS) attack. The server is flooded with traffic from many different IP addresses. Which of the following is the BEST immediate action to mitigate the attack?

• A. Block the IP addresses in the firewall.
• B. Enable rate limiting on the web server.
• C. Increase the server's bandwidth.
• D. Implement a load balancer.

Correct Answer: B

Explanation: Rate limiting can help mitigate the impact of a DDoS attack by limiting the number of requests a server will accept from a single source or in total. Blocking IPs (A) is ineffective because the attack uses many IPs. Increasing bandwidth (C) may help absorb the traffic but is not a direct mitigation and can be costly. A load balancer (D) distributes traffic but doesn't reduce the volume.

Question 3

A security engineer is configuring a new firewall and wants to allow inbound HTTPS traffic to a web server. Which of the following ports should be opened?

• A. 80
• B. 443
• C. 22
• D. 3389

Correct Answer: B

Explanation: HTTPS uses port 443. Port 80 is HTTP, port 22 is SSH, and port 3389 is RDP. Opening the correct port ensures secure web traffic.

Question 4

A security analyst discovers that sensitive data has been exfiltrated from the network. The logs show that the data was sent in small chunks over a long period to avoid detection. Which of the following is the BEST technique to prevent this type of exfiltration?

• A. Data Loss Prevention (DLP) solution
• B. Intrusion Detection System (IDS)
• C. Antivirus software
• D. Firewall rules

Correct Answer: A This connects to what we discuss in CompTIA Security+ Without IT Experience: Can You Actually Pull It Off?.

Explanation: DLP solutions are designed to monitor and prevent unauthorized data transfers. They can detect patterns such as large volumes of data leaving the network in small chunks. An IDS (B) can detect the activity but does not prevent it. Antivirus (C) focuses on malware, and firewall rules (D) control traffic based on ports/IPs, not content.

Question 5

An organization wants to implement a solution that allows employees to securely access internal resources from their personal devices. Which of the following would be the BEST approach?

• A. Virtual Private Network (VPN) with two-factor authentication
• B. Network Access Control (NAC)
• C. Demilitarized Zone (DMZ)
• D. Intrusion Prevention System (IPS)

Correct Answer: A

Explanation: A VPN creates a secure tunnel for remote access, and adding two-factor authentication ensures that only authorized users can connect. NAC (B) controls access based on device compliance but is not specifically for remote access. A DMZ (C) is a network segment for public-facing services. An IPS (D) is for detecting/preventing intrusions, not for remote access.

Question 6

A security administrator receives a report that a user received an email with a link that, when clicked, installed malware on the user's computer. Which of the following social engineering techniques was used?

• A. Phishing
• B. Spear phishing
• C. Whaling
• D. Vishing

Correct Answer: A

Explanation: Phishing is a broad term for emails that trick users into clicking malicious links. Spear phishing (B) targets specific individuals, but the scenario doesn't indicate targeting. Whaling (C) targets high-level executives. Vishing (D) is voice phishing. Without more context, phishing is the best answer.

Question 7

A company's backup strategy involves storing copies of data on a separate site that is not connected to the production network. This is an example of which of the following?

• A. Offsite backup
• B. Onsite backup
• C. Cloud backup
• D. Tape backup

Correct Answer: A

Explanation: Offsite backup stores data at a different physical location, which protects against disasters like fires or floods. Onsite backup (B) is local, cloud backup (C) is a specific type, and tape backup (D) refers to the medium, not the location. Before moving on, consider reading CompTIA Security+ Study Plan: From Zero to SY0-701 in 10 Weeks.

If you are mapping out your preparation timeline, this free CompTIA Security+ study plan gives you a schedule that fits the time you have available.

Question 8

A security auditor is reviewing the password policy of an organization. The policy requires passwords to be at least 12 characters and include uppercase letters, lowercase letters, numbers, and symbols. Which of the following is the MOST important reason for this policy?

• A. To prevent users from reusing passwords
• B. To increase the complexity and reduce the likelihood of brute-force attacks
• C. To comply with regulatory requirements
• D. To make passwords easier to remember

Correct Answer: B

Explanation: A complex password policy increases the number of possible combinations, making brute-force attacks more difficult. It does not directly prevent reuse (A) — that requires a password history policy. Compliance (C) may be a reason, but the question asks for the MOST important. Easier to remember (D) is false; complex passwords are harder to remember.

Question 9

A security team is implementing a solution to monitor network traffic for suspicious patterns and alert administrators in real time. Which of the following technologies should they use?

• A. Intrusion Detection System (IDS)
• B. Firewall
• C. Proxy server
• D. Load balancer

Correct Answer: A

Explanation: An IDS monitors network traffic and generates alerts when suspicious activity is detected. A firewall (B) filters traffic based on rules but does not analyze patterns. A proxy (C) acts as an intermediary, and a load balancer (D) distributes traffic.

Question 10

After a security incident, the incident response team needs to preserve evidence for potential litigation. Which of the following is the MOST important step to ensure the evidence is admissible in court?

• A. Document the chain of custody
• B. Make a copy of the evidence
• C. Encrypt the evidence
• D. Store the evidence in a secure location

Correct Answer: A

Explanation: Chain of custody is a documented record of who handled the evidence and when. It is crucial for proving that the evidence has not been tampered with. Making a copy (B) is important for preservation, but without chain of custody, the evidence may be inadmissible. Encryption (C) and secure storage (D) are good practices but not the primary factor for admissibility.

Accelerate your last week of revision with CompTIA Security+ practice questions that focus on high-weight topics.

If you want a quick check of your weak areas, try this free CompTIA Security+ readiness check before exam day.