CompTIA Security+ Sample Questions and Explanations

Multifactor authentication combines different types of factors: something you know (password), something you have (phone, token), and something you are (fingerprint).

Wrong choices

• A password plus a security question: Both are something you know, so this is one factor type used twice.
• Two different passwords: Both are something you know.
• A username plus a password: A username is not an authentication factor.

Biometrics such as fingerprints, face, and iris are something you are.

Wrong choices

• Something you know: Passwords and PINs are something you know.
• Something you have: Phones, smart cards, and tokens are something you have.
• Somewhere you are: Location is a separate attribute, not a fingerprint.

Confidentiality keeps information secret from anyone who is not allowed to see it. Encryption and access controls are common ways to protect it.

Wrong choices

• Integrity: Integrity means data is not changed without authorization.
• Availability: Availability means systems and data are there when needed.
• Non-repudiation: Non-repudiation means someone cannot deny an action they took.

If even one bit of a file changes, its hash changes. Comparing hashes shows whether data was altered, which protects integrity.

Wrong choices

• Availability: Hashes do not keep systems running.
• Confidentiality: A hash does not hide the file's contents.
• Authorization: Authorization decides what a user may do.

Transferring risk moves the financial impact to another party, such as an insurer. The four common responses are accept, avoid, transfer, and mitigate.

Wrong choices

• Accept: Accepting means taking the risk without further action.
• Avoid: Avoiding means stopping the risky activity altogether.
• Mitigate: Mitigating means adding controls to reduce the risk.

Avoiding risk means not doing the activity that creates it.

Wrong choices

• Transfer: Transfer shifts the impact to another party, such as an insurer.
• Accept: Accepting keeps the activity and the risk.
• Mitigate: Mitigating keeps the activity but adds controls.

In SaaS, the provider runs everything and the customer just uses the application. The customer still manages its own users and data.

Wrong choices

• IaaS (Infrastructure as a Service): IaaS gives virtual servers, storage, and networks that the customer manages.
• PaaS (Platform as a Service): PaaS gives a platform for customers to build and run their own apps.
• On-premises: On-premises systems are run in the company's own facility, not by a cloud provider.

A screened subnet (DMZ) is a separate network zone between the internet and the internal network. Public servers sit there, and firewalls control traffic in both directions.

Wrong choices

• On the same network as the HR database: That would let attackers who reach the web server get close to sensitive data.
• Directly on an employee's laptop: Laptops are not suitable public servers.
• Inside the internal network with no firewall: This would expose the internal network.

Vishing (voice phishing) uses phone calls to trick people into giving up information. Smishing uses text messages, and phishing usually uses email.

Wrong choices

• Smishing: Smishing uses text (SMS) messages.
• Phishing: Phishing usually means fake emails or websites.
• Whaling: Whaling targets senior executives, usually by email.

Smishing is phishing by SMS text message. It often uses fake delivery or bank alerts with a link.

Wrong choices

• Vishing: Vishing uses voice calls.
• Tailgating: Tailgating is following someone through a secure door.
• Watering hole attack: A watering hole attack infects a website the targets often visit.