CompTIA Security+ Sample Questions With Explanations

Real CompTIA Security+ questions rarely ask you to define a term outright. Instead they describe a situation, a constraint, and a goal, and ask you to pick the control or response that fits all three. The nine questions below follow that same scenario-based style across several domains from the exam objectives, each with the full explanation so you can see the reasoning, not just the correct letter.

Question 1

Domain: Threats, vulnerabilities, and mitigations

A university research group runs a public data-sharing web application on a Linux server. The software vendor has not yet released a patch for a known remote code execution vulnerability, but the server cannot be taken offline because an international collaboration depends on it. The security manager requires a compensating control that prevents exploitation, not merely detection. Which control should be implemented?

• A. Weekly authenticated vulnerability scans of the application with a report sent to the group's administrators.
• B. A web application firewall with a virtual-patch rule that blocks traffic matching the known exploit signature.
• C. Immediate shutdown of the server until the vendor releases and certifies a patch for the application.
• D. A network intrusion detection system that generates alerts for traffic matching the known exploit signature.

Answer: B

The web application firewall with the virtual-patch rule is correct because it sits inline with the traffic and blocks the exploit attempt before it reaches the vulnerable code, so it prevents exploitation while the server stays online. The strongest distractor is the intrusion detection option: observing traffic and generating an alert provides detection and reporting, but it does not stop the request, so it cannot meet a prevention requirement. The general rule is when a patch cannot be applied and an asset must remain available, select a compensating control that can enforce a block in the data path; alerting alone is not prevention.

Question 2

Domain: Security program management and oversight

A healthcare provider uses a legacy electronic health record system with a known unpatched vulnerability. After implementing network segmentation and intrusion detection, a residual risk of unauthorized access remains. The risk owner has formally accepted this residual risk during the recent risk review. What should the security team do next?

• A. Transfer the risk by purchasing cyber liability insurance.
• B. Implement additional compensating controls to reduce the risk.
• C. Disconnect the system to avoid the risk entirely.
• D. Document the acceptance and continue monitoring the risk.

Answer: D

The risk owner has formally accepted the residual risk, making documenting the acceptance and continued monitoring the correct action. Implementing more compensating controls would override the business decision by adding controls the risk owner did not ask for; the insurance and disconnection options are different risk responses, transfer and avoidance, that also contradict the formal acceptance already made.

Question 3

Domain: Security operations

During the post-incident review of a telecom operator, root cause analysis shows that a support engineer's password was collected by a phishing site and then used to access the billing system. The CISO asks the team to implement a control that prevents stolen credentials from being usable, not a control that detects the abnormal sign-in. Which control should the team implement?

• A. Alert the SOC when a single account signs in from two distant locations within 30 minutes.
• B. Require phishing-resistant MFA, such as FIDO2 security keys, for privileged account sign-in.
• C. Require 30-character passwords for privileged accounts and prohibit reuse of previous 10 passwords.
• D. Feed sign-in logs from the identity provider into a SIEM to display impossible travel alerts.

Answer: B

This is correct because the CISO set the requirement to prevent stolen credentials from being usable. Phishing-resistant MFA adds a second, unphishable factor, so an attacker who collected only the password cannot complete the sign-in. The strongest distractor is the SOC alert option: it detects a likely compromise after the attacker signs in, but the scenario explicitly rules out detection as the primary response. Password-length and SIEM options are also defensive, but they address guessing or visibility, not the stolen-password scenario. The general rule: when a requirement says prevent, select a control that blocks the attack before it succeeds, and use monitoring and alerting for detect requirements.

Question 4

Domain: Security architecture

A logistics company must encrypt driver location data in transit under a customer data-processing agreement. Older trucks have telematics units that send IP packets using a legacy application protocol with no encryption, and the vendor will not patch them. The trucks must remain in service and the safety team needs the live location feed. Replacement telematics units are back-ordered. Which of the following is the best compensating control?

• A. Disable the telematics units on the affected trucks until the replacement hardware arrives.
• B. Send the same feed through a cellular provider that encrypts the air-interface link.
• C. Install an inline VPN gateway on each truck to encrypt the feed before it leaves the vehicle.
• D. Record the location feed locally and transmit it over HTTPS at the end of each delivery shift.

Answer: C

The telematics unit itself cannot encrypt, but the operational constraint says the trucks must keep transmitting. The inline VPN option adds encryption at the network edge, so it meets the data-protection requirement without disabling the live feed; this is a compensating control. The strongest distractor is disabling the telematics units: it stops the unencrypted data flow, but it abandons the required service and is risk avoidance, not a compensating control. The cellular air-interface option also fails because it protects only the radio link, not the end-to-end traffic. General rule: a compensating control must provide equivalent protection for the same objective under the same operational constraints.

Question 5

Domain: Security operations

A telecom operator suspects an edge router at a cell site was compromised and is now being used to pivot into the core network. The IR lead wants to return the router to service quickly because voice traffic is degrading, but legal counsel says the router may be evidence in a data-breach investigation. What must the IR team do first?

• A. Fail traffic to a redundant router and reimage the original as part of eradication.
• B. Capture volatile data and a forensic image, document the evidence chain, then begin recovery.
• C. Block the attack source with an access list and keep the router online for monitoring.
• D. Rebuild the router from a trusted image to restore voice service with minimal delay.

Answer: B

This is correct because legal counsel has identified the router as potential evidence; preserving volatile state and creating a forensic image with documented custody must precede any action that could modify or destroy data. The strongest distractor is the failover-and-reimage option: it is operationally sound for availability, but reimaging erases the original evidence and breaks the chain of custody. The general rule is that when an incident may lead to legal action, preservation and chain-of-custody requirements outrank speed; isolate and collect evidence before remediation, and never reimage an evidentiary device until forensic acquisition is complete.

Question 6

Domain: Security operations

At a regulated financial services firm, a new fraud operations team must query transaction data across all business units to detect cross-account anomalies. The team requests standing read-only access to every production customer database. The CISO insists on least privilege, but the team argues that restricted data access will miss distributed fraud schemes. What should the security architect implement to balance these competing requirements?

• A. Grant read-only access to all production customer databases with multi-factor authentication, audit logging, and data loss prevention.
• B. Provide just-in-time elevated read access through an approval workflow scoped to the required queries and data elements.
• C. Assign the team a high-privilege role with quarterly access reviews and require formal sign-off for any new data access.
• D. Copy the customer data to an isolated analytics environment and give the fraud team full access to that copy.

Answer: B

This is correct because just-in-time, workflow-approved access grants broad query capability only when and to the extent needed, satisfying the operational need without installing standing broad privileges. The read-only, MFA, logging, and DLP option is the strongest distractor: it sounds protective, but the team asked for standing access to all production customer databases, which directly violates least privilege. The high-privilege-role and full-copy options also preserve broad standing access and are therefore less aligned with least privilege.

Question 7

Domain: Security architecture

A European airline runs its passenger booking system in an AWS EU Region. The disaster recovery team wants to replicate the database continuously to the airline's existing data center in the United States for a 15-minute RTO. European data-protection law prohibits copying passenger PII outside the EU/EEA. Which recovery architecture should the security team approve?

• A. Replicate continuously to an AWS recovery Region located within the EU/EEA.
• B. Replicate continuously to a commercial cloud DR site in the United States.
• C. Run the recovery workload across two Availability Zones in the current AWS EU Region.
• D. Replicate database snapshots to the US site but encrypt them with an AWS KMS key.

Answer: A

Regulatory data residency is the controlling constraint: passenger PII cannot be copied from the EU/EEA to a recovery site in the United States. The answer that replicates to an AWS Region inside the EU/EEA provides the continuous replication and 15-minute RTO while keeping every copy within the permitted legal boundary. The encrypted-KMS snapshot option looks strong because encryption is a legitimate security control, but encryption does not alter the physical jurisdiction in which the data is stored; the legal prohibition on copying PII outside the EU/EEA still applies. The general rule is to identify data-residency and other legal constraints before selecting an availability or disaster-recovery design; no technical control overrides a legal prohibition on data location.

Question 8

Domain: Security operations

A vulnerability assessment of a gaming studio's mobile game update pipeline identifies that one compromised developer account could deploy a malicious build. The CISO directs the team to implement a control that must survive insider compromise, not just block external attackers. Which control best meets this requirement?

• A. Move the update pipeline to a monitored cloud CI/CD provider.
• B. Enforce phishing-resistant MFA for every developer account.
• C. Rotate deployment signing keys after every game release.
• D. Require two senior developers to approve each deployment.

Answer: D

This is correct because the requirement is to stop a single compromised insider from pushing unauthorized code. Requiring two senior developers to approve each deployment means one stolen, coerced, or malicious account cannot complete the update by itself; this is separation of duties. The strongest distractor is the phishing-resistant MFA option: it is a strong control against external attackers, but it does not stop an attacker who is already using a legitimate insider account and session from performing an allowed action. The general rule is that high-risk actions need dual control and separation of duties, not merely stronger authentication.

Question 9

Domain: Security program management and oversight

The SEC will conduct an on-site examination of a broker-dealer. The security administrator is implementing NAC with a default rule that blocks all unmanaged devices. The examiners will connect their own laptops to review transaction records, and the broker-dealer is legally required to make those records available for examination. What should the administrator do?

• A. Put the examiners' devices in a quarantine VLAN that permits only outbound internet access for the length of the examination.
• B. Provide dedicated firm-managed workstations in a monitored room and require the examiners to remote into the records application.
• C. Apply the default deny rule to the examiners' devices until they are issued firm-managed laptops that meet the full compliance baseline.
• D. Enroll the examiners' devices in NAC and apply a role-based policy that limits them to the transaction-record systems with full logging.

Answer: D

Enrolling the examiners' devices under a limited-access NAC role is correct because the firm's legal obligation to make records available for examination overrides a blanket block on unmanaged devices. This preserves the NAC security posture while giving the examiners only the access they need. The strongest distractor is the firm-managed laptop approach: it is the standard technical response to an unmanaged device, but it would obstruct the legally required examination access rather than satisfy it. The general rule is that when a legal or regulatory requirement creates an exception to a security baseline, implement the narrowest controlled exception instead of bypassing or weakening the control.

Using these questions well

Do not just check whether you picked the right letter. Read the explanation even when you got the question right, since the reasoning pattern behind each answer, prevent versus detect, standing access versus just-in-time, legal constraint versus technical control, repeats across many real exam questions in different disguises. Once you have worked through these nine, a practice test built to the real domain weightings and time limit is the next step, and the study plan page can help you target whichever domain these questions exposed as your weakest.

Exam facts on this page come from CompTIA’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.