Prepare for the Security+ CompTIA Security+ Exam

Free Security+ Practice Questions (With Answers)

5 real questions from the Security+ bank, with the full explanation for each answer. No sign-up needed to read them.

1. Question 1Threats, Vulnerabilities, and Mitigations [Cloud Vulnerabilities]

   A company migrates to the cloud but doesn't change the default storage bucket permissions, leaving sensitive data publicly accessible. What type of vulnerability is this?

   • A.Misconfiguration vulnerability
   • B.Zero-day vulnerability
   • C.A supply chain vulnerability risk
   • D.Encryption weakness
   Show answer and explanation

   Correct answer: A

   Correct. Cloud misconfiguration is the #1 cause of cloud data breaches. Default permissions often start overly permissive, and failing to restrict them exposes data publicly. This is an operational error, not a software flaw.

   Why the other options are wrong

   B. Incorrect. Zero-day is an unknown vulnerability. Public bucket permissions are a well-known misconfiguration issue.

   C. Incorrect. Supply chain vulnerabilities target vendor relationships. This is a configuration error in cloud resource permissions.

   D. Incorrect. The issue isn't encryption — it's access control. The data is publicly accessible due to misconfigured permissions, regardless of encryption status.

2. Question 2Threats, Vulnerabilities, and Mitigations [Network Attacks]

   An attacker modifies DNS records to redirect users from a legitimate banking site to a fake copy. What type of attack is this?

   • A.BGP hijacking attack
   • B.A phishing attempt
   • C.ARP spoofing
   • D.DNS poisoning
   Show answer and explanation

   Correct answer: D

   Correct. DNS poisoning (or DNS spoofing) corrupts DNS cache entries so that domain names resolve to attacker-controlled IP addresses. Users typing the correct URL are silently redirected to a malicious site.

   Why the other options are wrong

   A. Incorrect. BGP hijacking redirects internet routing at the ISP level. DNS poisoning targets name resolution, not routing.

   B. Incorrect. Phishing tricks users into clicking links. DNS poisoning redirects users automatically without requiring them to click anything — they type the correct URL but arrive at the wrong server.

   C. Incorrect. ARP spoofing operates at Layer 2 with MAC addresses. This attack manipulates DNS (Layer 7) to redirect domain name resolution.

3. Question 3Security Architecture [VPN]

   A company needs to connect two office locations with a persistent, encrypted tunnel that routes all inter-office traffic securely. What type of VPN is most appropriate?

   • A.SSL VPN portal
   • B.Remote access VPN
   • C.Split tunnel VPN
   • D.Site-to-site VPN
   Show answer and explanation

   Correct answer: D

   Correct. Site-to-site VPN creates a persistent encrypted tunnel between two network gateways, routing all inter-office traffic securely. Users don't need individual VPN clients — the gateway handles encryption transparently.

   Why the other options are wrong

   A. Incorrect. SSL portals provide browser-based access for individual users, not network-to-network connectivity.

   B. Incorrect. Remote access VPNs connect individual users. Site-to-site connects entire networks.

   C. Incorrect. Split tunneling is a routing decision, not a VPN type. Site-to-site is the appropriate architecture for connecting offices.

4. Question 4Security Architecture [Reflection]Choose all that apply

   A company's security architecture review reveals gaps. Which THREE are essential elements of a well-designed security architecture? (Choose 3)

   • A.Single point of security enforcement for simplicity
   • B.Network segmentation with least privilege access between zones
   • C.Defense in depth with multiple overlapping security controls
   • D.Relying on a single vendor for all security tools
   • E.Granting broad access to simplify administration
   • F.Resilience planning with tested backup and recovery procedures
   Show answer and explanation

   Correct answer: B, C, F

   Correct. Segmentation limits blast radius, and least privilege ensures only authorized traffic flows between zones.

   Correct. Layered controls ensure that failure of one control doesn't result in complete compromise.

   Correct. Business continuity requires tested DR plans with appropriate RTO/RPO alignment.

   Why the other options are wrong

   A. Incorrect. A single enforcement point creates a single point of failure. Defense in depth uses multiple controls.

   D. Incorrect. Single-vendor reliance creates concentration risk and is not a sound design principle.

   E. Incorrect. Broad access violates least privilege; good architecture minimizes access.

5. Question 5Security Architecture [Enterprise Infrastructure]

   An attacker gains network access by exploiting a monitoring tool left with its default administrator credentials. What does this scenario illustrate about enterprise infrastructure security?

   • A.Monitoring tools fall outside an organization's attack surface entirely, since they only passively observe network traffic without exposing active services to external networks.
   • B.Default credentials on internal tools are a compliance documentation formality with no meaningful real-world security impact, since internal networks are protected by firewalls.
   • C.When infrastructure security is an afterthought, gaps between systems, such as default credentials left on a monitoring tool, become stepping stones for attackers.
   • D.The attack indicates the perimeter firewall, not the internal monitoring tool, was the component that was misconfigured.
   Show answer and explanation

   Correct answer: C

   Correct. The guide names exactly this pattern: overlooked infrastructure components with weak configuration become the path an attacker actually uses.

   Why the other options are wrong

   A. Incorrect. A monitoring tool with network access and credentials is very much part of the attack surface, as this scenario shows.

   B. Incorrect. Default credentials are a well-established, high-impact weakness, not a mere formality.

   D. Incorrect. The scenario specifically identifies the monitoring tool's default credentials as the exploited weakness.