This free CompTIA Security+ practice exam covers basic knowledge in the field of Information Systems Security. To pass the CompTIA Security+ exam, a candidate will need knowledge in Network Security, Compliance and operational security, threats and vulnerabilities, access control and identity management, cryptography, and application, data, and host security. This free practice test will test your knowledge and readiness for the CompTIA Security+ Examination.
1) What will best help you if you need to prevent cross-site scripting on your companies intranet webpage?
When accepting user information into a system, you should use input validation to filter and validate the data provided. This helps ensures the system is not allowing malicious code access to internal software, databases and confidential information.
This question is filed under objective 4, Application, Data and Host Security
In computer science, data validation is the process of ensuring data have undergone data cleansing to ensure they have data quality, that is, that they are both correct and useful It uses routines, often called "validation rules", "validation constraints", or "check routines", that check for correctness, meaningfulness, and security of data that are input to the system The rules may be implemented through the automated facilities of a data dictionary, or by the inclusion of explicit application program validation logic of the computer and its application … Read More
2) What device will work best for servers that need to store private keys?
A Hardware Security Module (HSM) is a physical device used to manage digital signatures and certificates and keys.
This question is filed under objective 6, Cryptography
A hardware security module (HSM) is a physical computing device that safeguards and manages digital keys, performs encryption and decryption functions for digital signatures, strong authentication and other cryptographic functions These modules traditionally come in the form of a plug-in card or an external device that attaches directly to a computer or network server A hardware security module contains one or more secure cryptoprocessor chips… Read More
3) Your supervisor asked you to open the necessary ports for a 'secure telnet' What ports should you open?
Your supervisor is most likely describing SSH (Secure Socket Shell) which is protocol that allows secure access to servers. Functionally SSH is very similar to telnet but is encrypted for added security. SSH can also be used to encrypt any text based communication, for example SSH-FTP is FTP using SSH for encryption.
This question is filed under objective 4, Application, Data and Host Security
Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network Typical applications include remote command-line, login, and remote command execution, but any network service can be secured with SSH SSH provides a secure channel over an unsecured network by using a client–server architecture, connecting an SSH client application with an SSH server The protocol specification distinguishes between two major versions, referred to as SSH-1 and SSH-2 The standard TCP port for SSH is 22 SSH is generally used to access Unix-like operating systems, but it can also be used on Microsoft Windows Windows 10 uses OpenSSH as its default SSH client… Read More
4) The CEO of the company you work for has been receiving emails that appear to be from the local IT department. The emails address her user account, and instruct her to click a link in order to verify her password. Which type of attack is this?
Whaling is a phishing attempt that specifically targets high level employees or workers.
This question is filed under objective 3, Threats and Vulnerabilities
5) Which of the following is an example of a physical security measure?
A mantrap is a device designed to physically trap a person in an enclosed area. Typically, this is a set of doors that cannot be opened simultaneously. The idea is that this will help to prevent tailgating, as the intruder will be momentarily trapped inside the same room as the authorized user.
This question is filed under objective 2, Compliance and Operational Security
A mantrap, air lock, sally port or access control vestibule is a physical security access control system comprising a small space with two sets of interlocking doors, such that the first set of doors must close before the second set opens Airlocks have a very similar design, allowing free ingress and egress while also restricting airflow In a manual mantrap, a guard locks and unlocks each door in sequence An intercom and/or video camera are often used to allow the guard to control the trap from a remote location In an automatic mantrap, identification may be required for each door, sometimes even possibly different measures for each door… Read More
6) A malicious program that disguises itself as a legitimate program is known as a?
A Trojan Horse is a malicious program that disguises itself as a useful, harmless program. For example, a free instant messaging program that records keyboard input to obtain passwords, credit card numbers, etc would be considered a Trojan Horse.
This question is filed under objective 3, Threats and Vulnerabilities
In computing, a Trojan horse,[1] or trojan,[2] is any malware which misleads users of its true intent The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of TroyTrojans are generally spread by some form of social engineering, for example where a user is duped into executing an email attachment disguised to appear not suspicious, (eg, a routine form to be filled in), or by clicking on some fake advertisement on social media or anywhere else Although their payload can be anything, many modern forms act as a backdoor, contacting a controller which can then have unauthorized access to the affected computer… Read More
7) Select the answer that properly describes IPSec in tunnel mode:
IPSec in tunnel mode encrypts a packet and attaches new headers. IPSec in transport mode uses the original headers, encrypting only the packet's data (payload).
This question is filed under objective 4, Application, Data and Host Security
In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts the packets of data to provide secure encrypted communication between two computers over an Internet Protocol network It is used in virtual private networks (VPNs) IPsec includes protocols for establishing mutual authentication between agents at the beginning of a session and negotiation of cryptographic keys to use during the session IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host) IPsec uses cryptographic security services to protect communications over Internet Protocol (IP) networks… Read More
8) Which answer properly describes the purpose of the CA role in Public Key Infrastructure?
A system administrator will generate a Certificate Signing Request (CSR) which will contain a public key. The CSR will be sent to a Certificate Authority (CA) which will issue a certificate for the administrator to use.
This question is filed under objective 5, Access Control and Identity Management
In cryptography, a certificate authority or certification authority (CA) is an entity that issues digital certificates A digital certificate certifies the ownership of a public key by the named subject of the certificate This allows others (relying parties) to rely upon signatures or on assertions made about the private key that corresponds to the certified public key A CA acts as a trusted third party—trusted both by the subject (owner) of the certificate and by the party relying upon the certificate The format of these certificates is specified by the X509 or EMV standard One particularly common use for certificate authorities is to sign certificates used in HTTPS, the secure browsing protocol for the World Wide Web… Read More
9) Which of the following options describes a zero-day attack?
A zero-day attack is an attack that is still unknown to the vendor, software developer, and/or system administrators. It is an attack that is newly discovered by malicious users.
This question is filed under objective 3, Threats and Vulnerabilities
A Zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability (including the vendor of the target software) Until the vulnerability is mitigated, hackers can exploit it to adversely affect computer programs, data, additional computers or a network An exploit directed at a zero-day is called a zero-day exploit, or zero-day attack The term "zero-day" originally referred to the number of days since a new piece of software was released to the public, so "zero-day" software was software that had been obtained by hacking into a developer's computer before release… Read More
10) As a security administrator, you decide to force expiration of all user passwords. Which of the following best supports this reasoning?
By force expiring all passwords, every network user will be required to change their password at next login. This is a good method to reset all passwords if you suspect some have been obtained maliciously.
This question is filed under objective 2, Compliance and Operational Security
A password, sometimes called a passcode, is a memorized secret, typically a string of characters, used to confirm the identity of a user Using the terminology of the NIST Digital Identity Guidelines, the secret is memorized by a party called the claimant while the party verifying the identity of the claimant is called the verifier When the claimant successfully demonstrates knowledge of the password to the verifier through an established authentication protocol, the verifier is able to infer the claimant's identity In general, a password is an arbitrary string of characters including letters, digits, or other symbols If the permissible characters are constrained to be numeric, the corresponding secret is sometimes called a personal… Read More
11) What sort of attack uses information gained from social media to obtain access to a users login?
A Cognitive Password is a password used as a response to a question that pertains specifically to the user. Secret questions/answers used to reset passwords are cognitive passwords. (eg. What is your favorite food?) Social Media can be used to obtain information about a user and allow cognitive passwords to be easily guessed.
This question is filed under objective 3, Threats and Vulnerabilities
A cognitive password is a form of knowledge-based authentication that requires a user to answer a question, presumably something they intrinsically know, to verify their identity Cognitive password systems have been researched for many years and are currently commonly used as a form of secondary access They were developed to overcome the common memorability vs strength problem that exists with the traditional password Cognitive passwords, when compared to other password systems, can be measured through the usage of a memorability vs guessability ratio… Read More
12) A software test that does not examine the software's code is known as what?
A Black Box test examines the workings of a program or system, without reviewing the code of the program itself.
This question is filed under objective 4, Application, Data and Host Security
Black-box testing is a method of software testing that examines the functionality of an application without peering into its internal structures or workings This method of test can be applied virtually to every level of software testing: unit, integration, system and acceptance It is sometimes referred to as specification-based testing… Read More
13) Which of the following options correctly describes SSO?
Single Sign On (SSO) describes the process of allowing a single set of credentials to validate a user across multiple independent systems. This is very common among Windows and Microsoft products, for example using Active Directory credentials on a SharePoint site collection.
This question is filed under objective 5, Access Control and Identity Management
Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID and password to any of several related, yet independent, software systems It is often accomplished by using the Lightweight Directory Access Protocol (LDAP) and stored LDAP databases on (directory) servers A simple version of single sign-on can be achieved over IP networks using cookies but only if the sites share a common DNS parent domainFor clarity, a distinction should be made between Directory Server Authentication and single sign-on: Directory Server Authentication refers to systems requiring authentication for each application but using the same credentials from a directory server, whereas single sign-on refers to systems where a single… Read More
14) Your supervisor asks you to implement a new KDC. Which of the following protocols is your supervisor planning to implement?
Kerberos is a type of Key Distribution Center (KDC) that supplies session tickets and session keys to authorized users on an Active Directory domain.
This question is filed under objective 5, Access Control and Identity Management
Kerberos () is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner The protocol was named after the character Kerberos (or Cerberus) from Greek mythology, the ferocious three-headed guard dog of Hades Its designers aimed it primarily at a client–server model and it provides mutual authentication—both the user and the server verify each other's identity Kerberos protocol messages are protected against eavesdropping and replay attacks Kerberos builds on symmetric key cryptography and requires a trusted third party, and optionally may use public-key cryptography during certain phases of authentication… Read More
15) You are a network administrator for a large business. Recently, you've noticed a large amount of unusual traffic and you suspect they are SYN attacks. What choice will help you defend against these attacks?
Flood Guards defend against DoS, DDoS, SYN floods, and other flooding type network attacks.
This question is filed under objective 1, Network Security
16) Which of the following ACL rules will deny DHCP traffic?
DENY UDP ANY SERVER eq 67 is the proper way of formatting an Access Control List (ACL) rule. The rule states that the firewall should deny any packet using UDP equal to port 67. You may also use the protocol name instead of port like so, DENY TCP ANY SERVER EQ TELNET.
This question is filed under objective 5, Access Control and Identity Management
17) After a power outage, which of the following documents contains detailed information on the order in which the system should be restored?
A Disaster Recovery Plan (DRP) is a part of a Business Continuity Plan. A DRP defines the recovery procedures following a power outage, natural disaster, large data loss, etc.
This question is filed under objective 2, Compliance and Operational Security
Given organizations' increasing dependency on information technology to run their operations, Business continuity planning covers the entire organization, and Disaster recovery focuses on IT Auditing of documents covering an organization's business continuity and disaster recovery plans provides a third-party validation to stakeholders that the documentation is complete and does not contain material misrepresentations Lack of completeness can result in overlooking secondary effects, such as when vastly increased work-at-home overloads incoming recovery site telecommunications capacity, and the bi-weekly payroll that was not critical within the first 48 hours is now causing perceived problems in ever recovering, complicated by governmental… Read More
18) Your organization has a web server that must be accessible by external users. Which of the following options is the best location for the server?
A Demilitarized Zone (DMZ), sometimes called a Perimeter Network , is a separate area of a network designated for externally facing systems and servers. It is the logical place for a web server that requires external access.
This question is filed under objective 1, Network Security
In computer security, a DMZ or demilitarized zone (sometimes referred to as a perimeter network or screened subnet) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted, usually larger, network such as the Internet The purpose of a DMZ is to add an additional layer of security to an organization's local area network (LAN): an external network node can access only what is exposed in the DMZ, while the rest of the organization's network is firewalled The DMZ functions as a small, isolated network positioned between the Internet and the private network and, if its design is effective, allows the organization extra time to detect and address breaches before they would further… Read More
19) Which of the following is the default port and protocol for HTTPS?
Hyper Text Transfer Protocol - Secure (HTTPS) uses TCP 443 as it's default protocol/port. HTTP (non-secure) uses TCP 80.
This question is filed under objective 4, Application, Data and Host Security
Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP) It is used for secure communication over a computer network, and is widely used on the Internet In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, its predecessor, Secure Sockets Layer (SSL) The protocol is therefore also often referred to as HTTP over TLS, or HTTP over SSL The principal motivations for HTTPS are authentication of the accessed website, protection of the privacy and integrity of the exchanged data while in transit It protects against man-in-the-middle attacks The bidirectional encryption of communications between a client and server protects against eavesdropping and… Read More
20) You're the admin of a large corporation's production computer system, with many users. How often should you review and audit your users rights?
Reviewing user rights should happen once a year. It is too lengthy of a process to do to often, but still needs to be done.
This question is filed under objective 2, Compliance and Operational Security
You can go back and review your answers or grade your test.