Practice Architecture & Design questions for the CompTIA Security+. Every question includes a full explanation of why the correct answer is right and why the tempting distractors are wrong.
26 questions available · hard difficulty · Security+ · Free, no registration required
10 example questions with full explanations. Use the interactive practice above to work through the complete set.
Question 1medium
A financial services company hosts a customer-facing web application on a cloud platform. The security team needs visibility into misconfigured S3 buckets storing customer PII and wants automated remediation of policy violations across all cloud accounts. Which tool BEST addresses this requirement?
- A.Cloud Security Posture Management (CSPM)✓
- B.Cloud Access Security Broker (CASB)
- C.Web Application Firewall (WAF)
- D.Security Information and Event Management (SIEM)
Correct answer: A
CSPM continuously monitors cloud infrastructure for misconfigurations, enforces security policies, and provides automated remediation — making it the correct tool for identifying exposed S3 buckets and policy violations across cloud accounts.BCASB focuses on controlling user access to cloud applications and enforcing data-loss policies at the application layer, not infrastructure configuration.BWAF protects web applications from HTTP-based attacks but does not audit cloud resource configurations.BSIEM aggregates and correlates logs but does not directly remediate cloud misconfigurations.
Question 2medium
A security architect is designing a network where administrators must access servers in a highly restricted internal zone. The design requires that no direct connections from the corporate LAN to the restricted zone are permitted, and all administrative sessions must be logged and inspected. Which architecture component BEST satisfies both requirements?
- A.A DMZ hosting public-facing services
- B.A jump server (bastion host) positioned between the two zones✓
- C.A VLAN separating corporate and server traffic
- D.A reverse proxy in front of the restricted zone
Correct answer: B
A jump server (bastion host) acts as the single, hardened entry point between network zones. Administrators authenticate to the jump server first, and all session activity can be logged and inspected before traffic reaches the restricted zone — satisfying both requirements.ADMZ is designed for public-facing services, not internal administrative access control.AVLAN separates traffic logically but does not enforce session inspection or prevent direct connections without additional controls.Areverse proxy forwards client requests to backend servers for web traffic load balancing and filtering, not administrative session management between internal zones.
Question 3medium
A developer has stored user passwords in a database using SHA-256 without any additional processing. An attacker who obtains the database can quickly identify accounts using common passwords. Which improvement to the password storage process would BEST mitigate this attack?
- A.Switch from SHA-256 to MD5 for faster hashing performance
- B.Encrypt the hashed values using AES-256 before storing them
- C.Add a unique random salt to each password before hashing✓
- D.Hash each password twice using SHA-256 to increase complexity
Correct answer: C
Adding a unique random salt to each password before hashing defeats precomputed rainbow table attacks — the most efficient way an attacker exploits unsalted common-password hashes — because the salt makes each hash unique even when two users share the same password. MD5 is cryptographically broken and should never be used for password storage. Encrypting already-weak hashes with AES-256 does not fix the underlying vulnerability; if the encryption key is compromised, the weak hashes are exposed. Hashing twice with SHA-256 ('double hashing') provides negligible security benefit and does not prevent rainbow table attacks against common passwords.
Question 4medium
An organization is adopting a Zero Trust architecture. Currently, once a user authenticates to the VPN, they have unrestricted access to all internal servers. Which change BEST aligns the environment with Zero Trust principles?
- A.Replace the VPN with a site-to-site IPSec tunnel to encrypt traffic between offices
- B.Deploy a network IDS to monitor internal traffic for anomalous behavior after authentication
- C.Require all users to connect through a dedicated VLAN that is separated from server traffic
- D.Implement microsegmentation so that access to each resource requires explicit, per-session authorization based on user identity and device posture✓
Correct answer: D
Zero Trust operates on the principle of 'never trust, always verify' — no implicit trust is granted after authentication. Microsegmentation enforces least-privilege access at the resource level, requiring explicit authorization for every session based on identity and device health, directly addressing the broad implicit trust problem. Replacing VPN with IPSec tunnels addresses encryption between sites but does not change the implicit-trust problem once a user is connected. An IDS detects anomalies but does not enforce access controls or prevent lateral movement.AVLAN separates traffic segments but still grants broad access within the segment and does not implement per-resource authorization.
Question 5medium
A software team has completed development of a new internal application and wants to identify vulnerabilities that only appear at runtime — such as authentication flaws and injection vulnerabilities — without accessing the source code. Which application security testing method should the team use?
- A.Dynamic Application Security Testing (DAST)✓
- B.Static Application Security Testing (SAST)
- C.Manual code review by a senior developer
- D.Fuzz testing the input validation routines with malformed data
Correct answer: A
DAST tests a running application from the outside — simulating an attacker — without requiring access to source code. It is specifically designed to find runtime vulnerabilities such as authentication flaws, injection attacks, and session management issues. SAST analyzes source code or binaries without executing the application, so it requires code access and cannot find runtime-only issues. Manual code review also requires source code access and is prone to human oversight at scale. Fuzz testing sends unexpected or malformed inputs to find crashes and input-handling bugs, but it is narrower in scope than DAST and does not systematically test authentication flows or business logic flaws.
Question 6medium
A security architect is designing a PKI implementation for a mid-sized enterprise. The architect must ensure that certificates can be validated efficiently and that revoked certificates are detected quickly. Select all that apply — which components or mechanisms should be included in this PKI design?
- A.Online Certificate Status Protocol (OCSP) responder to allow real-time certificate status checks✓
- B.Certificate Revocation List (CRL) published at regular intervals to a known distribution point✓
- C.Certificate Signing Request (CSR) generated by the CA and sent to the end entity
- D.An intermediate (subordinate) CA to protect the root CA by keeping it offline✓
- E.Certificate pinning applied to all internal web servers to eliminate the need for a CRL
Correct answer: A, B, D
OCSP (A) allows clients to check certificate status in real time without downloading a full CRL, while a published CRL (B) provides a periodic list of revoked certificates — both are standard revocation mechanisms in a robust PKI. An intermediate CA (D) shields the root CA so that if the subordinate CA is compromised, the root remains trusted and can revoke the intermediate. A CSR (C) is generated by the end entity and submitted to the CA, not the other way around, making C incorrect. Certificate pinning (E) hardcodes a specific certificate or public key and does not eliminate the need for revocation infrastructure — it is also impractical as a blanket policy for all internal servers and can cause outages during certificate renewal.
Question 7medium
An organization is rolling out a new MFA policy for remote employees. The security team wants to use factors that are resistant to phishing and replay attacks wherever possible. Select all that apply — which authentication methods meet these requirements?
- A.FIDO2 hardware security key that performs cryptographic challenge-response authentication✓
- B.Time-based One-Time Password (TOTP) generated by an authenticator app
- C.SMS-based one-time code sent to the user's registered mobile number
- D.Fingerprint biometric scan verified locally on a FIDO2-compliant device✓
Correct answer: A, D
FIDO2 hardware security keys (A) use public-key cryptography bound to the origin domain, making them inherently phishing-resistant because a fake site cannot obtain a valid response. A fingerprint biometric on a FIDO2-compliant device (D) similarly leverages the FIDO2 framework — the biometric unlocks the private key locally and the authentication is cryptographically bound to the legitimate site, preventing replay and phishing. TOTP codes (B) are time-limited but are still susceptible to real-time phishing, where an attacker can relay the code to the legitimate site within its validity window. SMS OTPs (C) are vulnerable to SIM-swapping attacks and real-time phishing relays, making them the weakest option and not considered phishing-resistant.
Question 8medium
A network engineer is redesigning the corporate network after a ransomware incident that spread rapidly across all systems. The goal is to limit lateral movement if a future breach occurs. Select all that apply — which architectural controls directly support this objective?
- A.Implementing VLANs to logically separate departments such as Finance, HR, and Operations✓
- B.Deploying microsegmentation using software-defined networking to enforce per-workload firewall policies✓
- C.Placing publicly accessible web servers in a DMZ isolated from the internal corporate network✓
- D.Replacing all internal switches with ones that support 10 Gbps throughput to improve performance
- E.Creating an air-gapped network segment for critical industrial control systems✓
Correct answer: A, B, C, E
VLANs (A) segment the network so that a compromised Finance workstation cannot directly reach HR or Operations systems without traversing a controlled boundary. Microsegmentation (B) goes further by applying granular east-west firewall rules between individual workloads, directly limiting lateral movement within a segment. A DMZ (C) isolates internet-facing servers so that a compromised web server cannot directly access internal resources. Air-gapping critical ICS systems (E) physically prevents network-based lateral movement to those systems entirely. Upgrading switch throughput (D) is a performance improvement and has no bearing on containing lateral movement — it is a distractor representing a common but incorrect association between network upgrades and security.
Question 9medium
A company is evaluating cryptographic algorithms to protect sensitive data at rest and in transit. The security team must select algorithms appropriate for bulk data encryption that prioritize speed without sacrificing modern security standards. Select all that apply — which algorithms are appropriate choices for this use case?
- A.AES-256 in GCM mode for encrypting large data sets stored on disk✓
- B.RSA-2048 as the primary cipher for bulk encryption of database records
- C.AES-128 in CBC mode for encrypting data in transit within an internal network✓
- D.3DES (Triple DES) as a drop-in modern replacement for AES in high-throughput environments
Correct answer: A, C
AES-256 in GCM mode (A) is a symmetric cipher well-suited for bulk data at rest — it is fast, provides authenticated encryption, and is considered cryptographically strong. AES-128 in CBC mode (C) is also a valid symmetric choice for data in transit within a controlled internal network, as AES-128 still meets NIST security standards and is computationally efficient. RSA-2048 (B) is an asymmetric algorithm used for key exchange and digital signatures, not bulk encryption — it is orders of magnitude slower than AES and is not designed for encrypting large data sets. 3DES (D) is a legacy cipher with known vulnerabilities (SWEET32 attack) and poor throughput compared to AES; it is being deprecated and is not a modern replacement for AES.
Question 10medium
A cloud administrator is hardening a containerized microservices environment running on a shared hypervisor. The team is concerned about isolation failures that could allow one tenant or container to affect others. Select all that apply — which threats or controls are relevant to this environment?
- A.VM escape, where a malicious virtual machine exploits a hypervisor vulnerability to access the host or other VMs✓
- B.Container breakout, where a process escapes its container namespace and gains access to the host OS✓
- C.Applying the principle of least privilege to container runtimes by avoiding privileged container execution✓
- D.Using a type 2 hypervisor in production to provide stronger isolation than a type 1 hypervisor
- E.Keeping the hypervisor and container runtime software patched to reduce exposure to known vulnerabilities✓
Correct answer: A, B, C, E
VM escape (A) is a real attack vector in virtualized environments where a compromised VM exploits a hypervisor flaw to interact with the host or peer VMs, directly threatening multi-tenant isolation. Container breakout (B) is the analogous risk in containerized environments — containers share the host kernel, so a namespace escape can expose the underlying OS. Running containers without elevated privileges (C) limits the blast radius of a breakout by restricting what an escaped process can do on the host. Patching the hypervisor and container runtime (E) is a fundamental control to eliminate known exploits used in escape attacks. A type 2 hypervisor (D) runs on top of a host operating system, which actually introduces an additional attack surface compared to a type 1 (bare-metal) hypervisor — making type 2 weaker, not stronger, for production isolation.