Practice Technologies & Tools questions for the CompTIA Security+. Every question includes a full explanation of why the correct answer is right and why the tempting distractors are wrong.
28 questions available · medium difficulty · Security+ · Free, no registration required
10 example questions with full explanations. Use the interactive practice above to work through the complete set.
Question 1medium
A security team is evaluating email authentication controls after discovering that threat actors have been sending phishing emails that appear to come from the company's own domain. Select all that apply: Which DNS-based email security mechanisms should the team implement to prevent domain spoofing and ensure message integrity?
- A.SPF (Sender Policy Framework) to specify authorized mail servers for the domain✓
- B.DMARC to define policy actions when SPF or DKIM checks fail✓
- C.DNSSEC to encrypt all DNS zone transfer traffic
- D.DKIM to cryptographically sign outgoing messages so recipients can verify authenticity✓
Correct answer: A, B, D
SPF, DKIM, and DMARC together form the standard email authentication triad. SPF publishes authorized sending IP addresses in DNS; DKIM adds a cryptographic signature to message headers that recipients validate; DMARC builds on both by specifying what receiving servers should do (quarantine, reject, or do nothing) when checks fail. DNSSEC is incorrect here because it authenticates DNS records themselves rather than email messages, and it does not encrypt DNS zone transfers — it uses digital signatures to validate DNS responses.
Question 2medium
An analyst is investigating a potential compromise on a Windows workstation. They need to collect and preserve evidence for forensic analysis while maintaining chain of custody. Select all that apply: Which of the following practices or tools are appropriate for this forensic investigation?
- A.Use a write blocker before imaging the hard drive to prevent accidental modification of evidence✓
- B.Analyze the live system directly from the original drive to preserve the most accurate data
- C.Use Autopsy or FTK to examine a forensic image of the drive✓
- D.Document every action taken with timestamps to maintain chain of custody✓
- E.Generate a cryptographic hash of the original drive and the forensic image to verify integrity✓
Correct answer: A, C, D, E
Proper forensic process requires write blockers to ensure the original evidence is not altered during imaging, forensic tools like Autopsy or FTK to examine copies rather than originals, detailed documentation with timestamps for chain of custody, and hash verification (typically MD5 or SHA-256) to prove the forensic image is an exact copy of the original. Option B is incorrect because analysts should never work directly on the original evidence — doing so risks altering data and invalidates chain of custody.
Question 3medium
A company's security operations center wants to improve its ability to detect threats across the environment. They currently collect logs from firewalls, servers, and endpoints. Select all that apply: Which capabilities are provided by a SIEM solution that would directly support this goal?
- A.Aggregating log data from multiple sources into a centralized platform✓
- B.Automatically executing remediation playbooks to contain detected threats
- C.Correlating events across data sources to identify patterns indicative of an attack✓
- D.Generating alerts and dashboards to notify analysts of suspicious activity✓
Correct answer: A, C, D
SIEM (Security Information and Event Management) is specifically designed to aggregate logs from disparate sources, apply correlation rules to detect patterns across those sources, and surface findings via dashboards and alerts to analysts. Option B describes SOAR (Security Orchestration, Automation, and Response), which extends SIEM capabilities by running automated playbooks for remediation. A SIEM can trigger alerts but does not natively execute automated response actions — that distinction is a common exam trap.
Question 4medium
A network administrator is configuring wireless security for a corporate environment that requires strong authentication and centralized user management. Select all that apply: Which components are required to implement WPA2-Enterprise for the corporate wireless network?
- A.A RADIUS server to perform centralized authentication✓
- B.802.1X as the authentication framework between clients and the access point✓
- C.A pre-shared key (PSK) distributed to all users
- D.Individual user credentials or certificates for authentication✓
- E.A captive portal page for guest network access
Correct answer: A, B, D
WPA2-Enterprise uses 802.1X as the port-based network access control framework and requires a RADIUS server (such as Microsoft NPS or FreeRADIUS) to validate individual user credentials or certificates. This allows per-user authentication and centralized access management. A pre-shared key (Option C) is used in WPA2-Personal, not Enterprise — using a shared key defeats the purpose of centralized user management. Captive portals (Option E) are a separate mechanism typically used for guest access that does not require enterprise-grade authentication.
Question 5medium
A security team receives thousands of alerts daily from various security tools and is struggling to respond quickly enough to incidents. The team wants to automate repetitive tasks such as blocking malicious IPs, sending notifications, and creating tickets — without requiring manual intervention for each alert. Which technology best addresses this requirement?
- A.SIEM, because it can correlate events from multiple sources and generate prioritized alerts
- B.EDR, because it monitors endpoint behavior and automatically quarantines infected devices
- C.IPS, because it can automatically drop malicious traffic before it reaches internal systems
- D.SOAR, because it uses automated playbooks to orchestrate responses across multiple security tools✓
Correct answer: D
SOAR (Security Orchestration, Automation, and Response) is specifically designed to automate repetitive security tasks through playbooks and integrate with multiple tools for coordinated response — exactly what the team needs. SIEM is a strong distractor because it aggregates and correlates logs, but it does not automate responses; it generates alerts that still require human action. EDR operates only at the endpoint level and does not orchestrate cross-tool automation. IPS can block traffic automatically but only handles network-layer threats and lacks the broad orchestration and case management capabilities the scenario requires.
Question 6medium
A penetration tester has already identified several vulnerabilities on a target web server and now needs to attempt to exploit one of them to demonstrate proof of concept to the client. Which tool is best suited for this phase of the engagement?
- A.Metasploit, because it provides a framework for selecting and launching exploits against identified vulnerabilities✓
- B.Nessus, because it identifies and prioritizes vulnerabilities on the target system
- C.Wireshark, because it captures network packets to observe server responses
- D.Burp Suite, because it intercepts and modifies HTTP requests to test for injection flaws
Correct answer: A
Metasploit is an exploitation framework designed specifically to turn identified vulnerabilities into working exploits, which is exactly what is needed for proof-of-concept demonstration. Nessus is a vulnerability scanner — it finds weaknesses but does not exploit them. Wireshark captures packets for traffic analysis but performs no exploitation. Burp Suite is a strong distractor for web application testing scenarios, but it is focused on testing and manipulating web requests (e.g., finding SQLi or XSS), not on launching module-based exploits against server vulnerabilities.
Question 7medium
A company's security policy requires that all remote employees route only corporate traffic through the VPN tunnel, while personal browsing goes directly to the internet from their local connection. Which VPN configuration satisfies this requirement?
- A.Site-to-site VPN, which connects two fixed network endpoints using IPsec
- B.Split tunneling, which routes corporate traffic through the VPN while other traffic exits directly to the internet✓
- C.Full-tunnel VPN, which sends all client traffic through the corporate VPN gateway
- D.SSL/TLS VPN with always-on configuration, which encrypts all traffic regardless of destination
Correct answer: B
Split tunneling is the VPN configuration that allows corporate-bound traffic to traverse the VPN tunnel while all other traffic (such as personal browsing) exits directly through the user's local internet connection — precisely what the policy describes. Full-tunnel VPN is the opposite: it forces all traffic through the VPN gateway. Site-to-site VPN connects two fixed office networks and is not applicable to individual remote employees. SSL/TLS VPN with always-on is similar to full-tunnel and would route all traffic through the corporate gateway, not just corporate traffic.
Question 8medium
A security analyst notices that a user's workstation is communicating with a known command-and-control server. The analyst needs a tool that can provide detailed behavioral telemetry from the endpoint — including process execution chains, file modifications, and network connections — to determine how the compromise occurred. Which tool category is most appropriate?
- A.Host-based IDS (HIDS), which monitors system logs and alerts on policy violations
- B.Network-based IPS (NIPS), which inspects and blocks malicious traffic at the network perimeter
- C.EDR, which continuously records endpoint activity and provides behavioral analysis and investigation capabilities✓
- D.DLP, which monitors and controls data transfers to prevent sensitive information from leaving the organization
Correct answer: C
EDR (Endpoint Detection and Response) continuously collects and records detailed endpoint telemetry — process trees, file system changes, registry modifications, and network connections — making it ideal for reconstructing how a compromise unfolded. HIDS monitors logs and file integrity but lacks the rich behavioral recording and investigation workflow that EDR provides. NIPS operates at the network level and cannot provide process-level visibility on the endpoint. DLP is focused on preventing data exfiltration based on content classification, not on behavioral forensics or incident investigation.
Question 9hard
A security architect is deploying a next-generation firewall (NGFW) to replace an aging stateless packet filter at the network perimeter. The architect claims the NGFW will provide capabilities the stateless firewall cannot. Select all that apply — which of the following capabilities are correctly attributed to an NGFW but NOT to a traditional stateless packet filter?
- A.Inspecting the application-layer content of encrypted HTTPS traffic after SSL/TLS decryption✓
- B.Blocking traffic based solely on source IP address and destination port number
- C.Identifying and controlling specific applications regardless of the port they use✓
- D.Maintaining a state table to track TCP session handshakes and reject out-of-state packets
- E.Enforcing user-identity-based policies by integrating with Active Directory✓
Correct answer: A, C, E
NGFWs extend traditional firewall capabilities with deep packet inspection including SSL/TLS decryption (A), application-layer awareness that identifies apps by behavior rather than port (C), and user-identity integration with directory services like Active Directory (E). Option B describes a capability that stateless packet filters already possess — filtering on IP/port is the defining feature of stateless firewalls, not an NGFW differentiator. Option D describes stateful inspection, which is a feature of stateful firewalls — a category predating NGFWs — and is still not unique to NGFWs. Candidates often confuse 'stateful' with 'next-generation'; stateful inspection alone does not qualify a device as an NGFW.
Question 10hard
A SOC analyst is tuning an intrusion detection system (IDS) after receiving complaints that legitimate database backup traffic is being flagged as suspicious exfiltration. The analyst wants to reduce false positives without disabling detection entirely. Select all that apply — which actions would be appropriate for an IDS in this scenario, recognizing the fundamental differences between IDS and IPS deployments?
- A.Creating a signature exception that whitelists the known backup server's IP and traffic pattern✓
- B.Switching the IDS to inline mode so it can actively drop future false-positive traffic automatically
- C.Tuning the anomaly-based detection baseline to account for the regular backup traffic window✓
- D.Adding a correlation rule to suppress alerts when traffic matches the backup schedule and source IP✓
- E.Replacing the IDS with an IPS to gain the ability to modify detection thresholds
Correct answer: A, C, D
An IDS in detection-only mode can be tuned by adding signature exceptions for known-good traffic (A), rebaselining anomaly detection to incorporate legitimate traffic patterns (C), and suppressing correlated alerts that match known benign conditions (D) — all without converting the system to an IPS. Option B is incorrect because placing an IDS inline would convert it to function as an IPS, which is a fundamentally different deployment model and goes beyond 'tuning' the IDS. Option E is incorrect because the ability to modify detection thresholds is not the distinguishing feature of an IPS over an IDS — both can have tunable thresholds; the IPS distinction is the ability to actively block traffic, not tune detections.