CompTIA Security+ Preparation · lesson 43 of 45 · 25 min
Full Security+ Practice Assessment
This 20-question assessment covers all Security+ domains. Aim for 80%+ before sitting the real exam. Review any missed questions in the corresponding lesson.
Full Practice Assessment — 20 Questions
Which control category includes firewalls, encryption, and antivirus?
- Physical
- Managerial
- Technical
- Operational
Answer: Technical
Technical (logical) controls are implemented in hardware or software.
ECC is preferred over RSA on mobile devices because:
- ECC is symmetric
- ECC achieves equivalent security with smaller keys
- ECC is faster for bulk encryption
- ECC does not require certificates
- Answer: ECC achieves equivalent security with smaller keys
Smaller ECC keys mean less computation — critical for battery-powered devices.
A credentialed vulnerability scan provides a more accurate view of patch levels than a non-credentialed scan.
- True
- False
Answer: True
Credentialed scans log in and inspect installed software and patches directly.
Which threat actor type maintains persistent access over months or years for espionage?
- Script kiddie
- Hacktivist
- Nation-state / APT
- Organized crime
Answer: Nation-state / APT
APTs are government-sponsored, sophisticated, and maintain long-term access.
The NIST IR phase that removes malware and patches the exploited vulnerability is called _____.
Answer: Eradication
Eradication removes the root cause of the incident.
Which social engineering attack targets executives specifically?
- Phishing
- Smishing
- Whaling
- Vishing
Answer: Whaling
Whaling is spear phishing targeting C-suite executives.
SLE = $80,000 and ARO = 0.25. What is the ALE?
- $320,000
- $20,000
- $80,000
- $40,000
Answer: $20,000
ALE = SLE × ARO = $80,000 × 0.25 = $20,000.
Which cloud security tool acts as a proxy between users and cloud services to enforce policy?
- CSPM
- CASB
- SIEM
- NAC
Answer: CASB
CASB (Cloud Access Security Broker) enforces policy between users and cloud services.
DMARC, DKIM, and SPF help prevent email domain spoofing.
- True
- False
Answer: True
These email authentication protocols verify sender identity and prevent spoofing.
Which access control model is used in government classified systems with Top Secret and Secret labels?
- DAC
- RBAC
- MAC
- ABAC
Answer: MAC
Mandatory Access Control uses system-enforced classification labels.
According to the order of volatility, which should be collected last?
- RAM
- CPU registers
- Running processes
- Backup tapes
Answer: Backup tapes
Backups are the least volatile — they persist longest and should be collected last.
Which Zero Trust technology replaces broad VPN access with per-app access?
- SASE
- ZTNA
- CASB
- NAC
Answer: ZTNA
ZTNA grants access to specific applications only after identity and device verification.
The international certifiable standard for an Information Security Management System is ISO/IEC _____.
Answer: 27001
ISO/IEC 27001 is the certifiable ISMS standard.
A company stops collecting Social Security Numbers because the liability outweighs the benefit. This is:
- Risk transfer
- Risk mitigation
- Risk avoidance
- Risk acceptance
- Answer: Risk avoidance
Eliminating the activity that creates the risk is risk avoidance.
PCI-DSS applies only to banks and credit card companies.
- True
- False
Answer: False
PCI-DSS applies to any organization processing, storing, or transmitting payment card data.
Which firewall type specifically protects web applications from SQLi and XSS?
- NGFW
- Stateful
- WAF
- Packet filter
Answer: WAF
A WAF (Web Application Firewall) inspects HTTP/HTTPS traffic for web-specific attacks.
Which hash algorithm is considered broken and should not be used for security?
- SHA-256
- SHA-3
- MD5
- HMAC
Answer: MD5
MD5 is cryptographically broken — collisions can be generated quickly.
Which IAM principle requires that no single person controls an entire critical process?
- Least privilege
- Need to know
- Separation of duties
- Account lifecycle
Answer: Separation of duties
Separation of duties prevents fraud by requiring multiple people for critical processes.
A forensic bit-for-bit image captures deleted files and slack space.
- True
- False
Answer: True
A forensic image is a sector-by-sector copy capturing all data including deleted files.
Which GDPR principle requires collecting only the minimum personal data necessary?
- Data retention
- Data minimization
- Privacy by design
- Right to erasure
Answer: Data minimization
Data minimization requires collecting only what is necessary for the stated purpose.
Previous lesson: Data privacy concepts and data classification
Back to CompTIA Security+ Preparation
Next lesson: Data loss prevention (DLP): policies, endpoint DLP, network DLP, cloud DLP