Free tools · CompTIA Security+

Am I ready for CompTIA Security+?

Ten scenario questions across all five domains, with full explanations at the end. Honest bands, no email required to see your score.

1. Security Operations · Question 1/10

   Your SIEM shows 400 failed logins for one account overnight, then a success from a country the user has never logged in from. What is the BEST first step?

   Delete the account so the attacker loses accessDisable the account and force a password resetReimage the user's laptop immediatelyWait for the user to report a problem

2. Threats, Vulnerabilities, and Mitigations · Question 2/10

   An employee gets a text message: 'Your package could not be delivered, tap to reschedule: bit.ly/4x92'. Nobody ordered anything. What is this?

   WhalingSmishingVishingPharming

3. Security Architecture · Question 3/10

   A web server sits in the DMZ. Which firewall approach is correct?

   Allow all inbound traffic so the site never breaksAllow 443/TCP from the internet to the server, deny the rest, log the deniesBlock 443 and only allow 80 so traffic stays simplePut the web server on the LAN with no firewall rules

4. Security Operations · Question 4/10

   After a ransomware incident, leadership asks what would have made recovery fastest. The honest answer is:

   Paying the ransom quickly to get the keyTested offline backups with a practiced restore procedureMore antivirus agents on every endpointDisconnecting the company from the internet permanently

5. General Security Concepts · Question 5/10

   A data center door needs a badge AND a PIN to open. What control is the badge reader?

   Technical detective controlPhysical preventive controlManagerial corrective controlOperational deterrent control

6. Threats, Vulnerabilities, and Mitigations · Question 6/10

   Malware is spreading between workstations with nobody opening emails or files. Which type spreads on its own?

   TrojanWormRansomwareKeylogger

7. Security Architecture · Question 7/10

   A company is replacing office Wi-Fi. For corporate laptops with per-user authentication, the best choice is:

   WEP with a long shared keyWPA2-Personal with one password for allWPA3-Enterprise with 802.1XAn open network with a captive portal only

8. Security Program Management and Oversight · Question 8/10

   An employee plugs a free USB drive from a conference into a work laptop. Which document should already have forbidden this?

   The acceptable use / removable media policyThe firewall rulebaseThe backup retention scheduleThe penetration test report

9. Security Operations · Question 9/10

   During incident response, the team has confirmed malware on three hosts and isolated them from the network. What comes NEXT?

   Wipe and rebuild the hosts immediatelyEradicate the malware and verify, then recover systems in priority orderAnnounce the incident to customers firstRun a lessons-learned meeting

10. Security Program Management and Oversight · Question 10/10

    A backup policy says 'RPO 4 hours'. What does that promise?

    Systems will be back online within 4 hours of a failureNo more than 4 hours of data will ever be lostBackups run every 4 hours on the dotRecovery testing happens every 4 hours