CompTIA Security+ Preparation · lesson 39 of 45 · 25 min
Domain 1 & 2 Review — General Security Concepts & Threats
This practice set covers Security+ Domains 1 (General Security Concepts) and 2 (Threats, Vulnerabilities, and Mitigations). Work through all questions, review explanations carefully, and revisit any lessons where you score below 70%.
Domain 1 & 2 — 15 Practice Questions
Which control type is specifically used when the primary control cannot be implemented?
- Preventive
- Detective
- Compensating
- Corrective
Answer: Compensating
Compensating controls are alternatives used when the ideal control is not feasible.
A CVSS score of 9.8 indicates which severity?
- High
- Medium
- Critical
- Low
Answer: Critical
CVSS 9.0–10.0 is Critical.
A password combined with a fingerprint scan qualifies as MFA.
- True
- False
Answer: True
Password (know) + fingerprint (are) = two different factor categories = MFA.
Which threat actor is primarily motivated by financial gain using ransomware?
- Nation-state
- Hacktivist
- Organized crime
- Script kiddie
Answer: Organized crime
Organized crime groups run ransomware operations for financial gain.
The NIST CSF function added in version 2.0 that focuses on strategy and accountability is _____.
Answer: Govern
The Govern function was added in NIST CSF 2.0.
Spear phishing differs from regular phishing because it:
- Uses phone calls
- Is targeted and personalized
- Uses SMS messages
- Targets executives only
- Answer: Is targeted and personalized
Spear phishing uses personal information about the specific target.
Which symmetric encryption algorithm is the current standard?
- 3DES
- DES
- AES
- RSA
Answer: AES
AES (Advanced Encryption Standard) is the current symmetric encryption standard.
An IDS actively blocks malicious traffic inline.
- True
- False
Answer: False
An IDS is passive — it detects and alerts. An IPS actively blocks.
Which access control model uses classification labels like Top Secret and Secret?
- DAC
- RBAC
- MAC
- ABAC
Answer: MAC
Mandatory Access Control uses system-enforced classification labels.
A scanner reports a vulnerability that does not actually exist. This is a:
- True positive
- False positive
- False negative
- True negative
- Answer: False positive
A false positive is an incorrect report of a vulnerability that does not exist.
Which social engineering technique involves leaving infected USB drives in a parking lot?
- Pretexting
- Tailgating
- Baiting
- Vishing
Answer: Baiting
Baiting uses physical media with enticing labels to lure victims.
The unique identifier for a publicly known vulnerability is called a _____.
Answer: CVE
CVE (Common Vulnerabilities and Exposures) provides unique IDs for known vulnerabilities.
Which PKI component provides real-time certificate revocation status?
- CRL
- OCSP
- CA
- RA
Answer: OCSP
OCSP provides real-time revocation checking; CRLs are periodic lists.
Zero Trust grants implicit trust to users on the internal corporate network.
- True
- False
Answer: False
Zero Trust never grants implicit trust — every request is verified regardless of location.
Which framework is required for US Department of Defense contractors handling CUI?
- ISO 27001
- SOC 2
- NIST SP 800-171 / CMMC
- PCI-DSS
Answer: NIST SP 800-171 / CMMC
DoD contractors handling CUI must comply with NIST 800-171 and obtain CMMC certification.
Previous lesson: Risk management: identification, analysis, treatment, monitoring
Back to CompTIA Security+ Preparation
Next lesson: Security audits and assessments: internal, external, penetration test, vulnerability assessment