CompTIA Security+ (SY0-701) Practice Exam

Question 1 CompTIA Security+ (SY0-701)

What is the difference between RADIUS and TACACS+?

Hashing is one-way and not reversible; encryption is two-way and reversible with a key Diffie-Hellman is a key exchange protocol; RSA is an encryption/signature algorithm. ECDH is the elliptic-curve variant. Network traffic flowing between servers within a data center or cloud environment, as opposed to north-south (client-to-server) RADIUS combines authentication/authorization, encrypts only the password (UDP); TACACS+ separates all three A's and encrypts the full body (TCP)

Question 2 CompTIA Security+ (SY0-701)

What is east-west traffic?

Social engineering using fraudulent email or messages to trick users into revealing credentials or installing malware TLS is the successor to SSL; modern systems use TLS 1.2 or 1.3. SSL 3.0 is deprecated and insecure. Network traffic flowing between servers within a data center or cloud environment, as opposed to north-south (client-to-server) An attacker captures and maliciously re-sends a valid data transmission to trick the receiver

Question 3 CompTIA Security+ (SY0-701)

What is the difference between WEP, WPA, WPA2, and WPA3?

WEP = broken RC4; WPA = TKIP transitional; WPA2 = AES-CCMP; WPA3 = SAE, strongest, forward secrecy A firewall combining traditional filtering with deep packet inspection, IDS/IPS, application awareness, and threat intelligence Something you know (password), have (token), are (biometric), do (behavior), somewhere you are (location) Authentication verifies identity ("who you are"); authorization determines permitted actions ("what you can do")

Question 4 CompTIA Security+ (SY0-701)

Which security principle extends CIA by adding authentication, authorization, and accounting (non-repudiation)?

AAA (Authentication, Authorization, Accounting) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege Something you know (password), have (token), are (biometric), do (behavior), somewhere you are (location) Physical security breach where an unauthorized person follows an authorized person through a controlled door

Question 5 CompTIA Security+ (SY0-701)

What is TLS stripping?

Downgrading a user's HTTPS connection to unencrypted HTTP via a MITM, exposing session data Authenticated encryption mode providing both confidentiality and integrity/authenticity in one operation Web Application Firewall - a firewall that filters and monitors HTTP traffic to/from a web application Voice phishing - social engineering conducted via telephone or VoIP

Question 6 CompTIA Security+ (SY0-701)

What is the difference between SFTP and FTPS?

Lightweight Directory Access Protocol - querying and modifying directory services such as Active Directory Dividing a network into smaller zones (VLANs, subnets) to limit the blast radius of a compromise SFTP is file transfer over SSH (port 22); FTPS is FTP with TLS (ports 989/990) A copy of a cryptographic key is held by a trusted third party so it can be recovered if the original is lost

Question 7 CompTIA Security+ (SY0-701)

What is the principle of least privilege?

Granting users only the minimum access rights necessary to perform their job functions Overloading a switch's MAC address table to force it into hub mode and capture traffic A single TLS certificate that secures a domain and all of its first-level subdomains (*.example.com) A firewall combining traditional filtering with deep packet inspection, IDS/IPS, application awareness, and threat intelligence

Question 8 CompTIA Security+ (SY0-701)

What is the difference between SSL and TLS?

Stateful tracks active connections and context; stateless inspects each packet independently against rules Assurance that a party cannot deny having performed an action, typically via digital signatures or audit logs TLS is the successor to SSL; modern systems use TLS 1.2 or 1.3. SSL 3.0 is deprecated and insecure. Precomputed table of hashes used to reverse common passwords by lookup rather than recomputation

Question 9 CompTIA Security+ (SY0-701)

What is tailgating (piggybacking)?

Physical security breach where an unauthorized person follows an authorized person through a controlled door A software flaw unknown to the vendor with no patch available, actively exploited by attackers A tamper-resistant physical device that generates, stores, and manages cryptographic keys A property where session keys are ephemeral, so compromising one long-term key does not reveal past sessions

Question 10 CompTIA Security+ (SY0-701)

What is a jump server (bastion host)?

A hardened host used to access and manage devices in a separate security zone Confidentiality, Integrity, and Availability Time-based One-Time Password - a 6-8 digit code generated from a shared secret and current time (e.g., Google Authenticator, RFC 6238) Public Key Infrastructure - the framework of policies, hardware, software, and people used to manage digital certificates and keys

Question 11 CompTIA Security+ (SY0-701)

What is a Kerberos ticket?

Security Orchestration, Automation, and Response - platforms that automate security operations workflows and incident response A time-limited token issued by the KDC proving a client's identity, used to access services without re-sending credentials Elliptic Curve Cryptography - asymmetric crypto offering equivalent security to RSA with smaller key sizes An identity layer on top of OAuth 2.0 providing authentication (verifying who the user is) using JSON Web Tokens

Question 12 CompTIA Security+ (SY0-701)

What is need-to-know?

An authorization framework that allows third-party apps to obtain limited access to user resources without exposing credentials Precomputed table of hashes used to reverse common passwords by lookup rather than recomputation Remote Authentication Dial-In User Service - a AAA protocol for centralized authentication, authorization, and accounting, often for network access Access is granted only to information required for a specific task, even if broader clearance exists

Question 13 CompTIA Security+ (SY0-701)

What is SOAR?

Hash-based Message Authentication Code - a MAC constructed using a cryptographic hash (e.g., HMAC-SHA256) Authentication verifies identity ("who you are"); authorization determines permitted actions ("what you can do") Security Orchestration, Automation, and Response - platforms that automate security operations workflows and incident response An unauthorized DHCP server handing out incorrect network configuration, including a malicious default gateway

Question 14 CompTIA Security+ (SY0-701)

What is a risk register?

Trying words from a predefined list of common passwords against an account Spear phishing targets a specific individual or group; whaling targets senior executives ("big fish") A documented inventory of identified risks, their likelihood, impact, owner, and mitigation status The sum of all points where an unauthorized user can attempt to enter or extract data from a system

Question 15 CompTIA Security+ (SY0-701)

What is a TPM?

Trusted Platform Module - a chip on the motherboard that stores cryptographic keys and supports platform integrity measurements A decoy system designed to attract attackers, study their behavior, and divert them from real assets WEP = broken RC4; WPA = TKIP transitional; WPA2 = AES-CCMP; WPA3 = SAE, strongest, forward secrecy An attacker secretly intercepts and possibly alters communication between two parties who believe they are talking directly

Question 16 CompTIA Security+ (SY0-701)

What is the difference between IDS and IPS?

IDS (Intrusion Detection System) monitors and alerts; IPS (Intrusion Prevention System) blocks traffic in real time RADIUS combines authentication/authorization, encrypts only the password (UDP); TACACS+ separates all three A's and encrypts the full body (TCP) A layered security strategy using multiple overlapping controls so no single failure causes compromise Something you know (password), have (token), are (biometric), do (behavior), somewhere you are (location)

Question 17 CompTIA Security+ (SY0-701)

What is a hardware security module (HSM)?

Web Application Firewall - a firewall that filters and monitors HTTP traffic to/from a web application An OTP generated from a counter value and shared secret, used in hardware tokens (RFC 4226) Symmetric uses one shared key for encrypt/decrypt; asymmetric uses a mathematically paired public/private key pair A tamper-resistant physical device that generates, stores, and manages cryptographic keys

Question 18 CompTIA Security+ (SY0-701)

What is a WAF?

Web Application Firewall - a firewall that filters and monitors HTTP traffic to/from a web application Attack vector = the path or method used to gain access; attack surface = the total set of all possible entry points AAA (Authentication, Authorization, Accounting) Lightweight Directory Access Protocol - querying and modifying directory services such as Active Directory

Question 19 CompTIA Security+ (SY0-701)

What is defense in depth?

A layered security strategy using multiple overlapping controls so no single failure causes compromise Issues, signs, and manages digital certificates that bind public keys to identities Network traffic flowing between servers within a data center or cloud environment, as opposed to north-south (client-to-server) Trust established between two organizations' identity providers so users from one can access resources in the other

Question 20 CompTIA Security+ (SY0-701)

What is the difference between Diffie-Hellman and RSA?

Diffie-Hellman is a key exchange protocol; RSA is an encryption/signature algorithm. ECDH is the elliptic-curve variant. Cryptographic proof that a message was created by a known sender and was not altered, produced by signing a hash with a private key IDS (Intrusion Detection System) monitors and alerts; IPS (Intrusion Prevention System) blocks traffic in real time TLS encryption, server (and optionally client) authentication, and integrity for HTTP traffic

Question 21 CompTIA Security+ (SY0-701)

What is certificate pinning?

Hardcoding a specific certificate or public key in an application to detect fraudulent certificates A decoy system designed to attract attackers, study their behavior, and divert them from real assets SMS phishing - social engineering conducted via text messages A time-limited token issued by the KDC proving a client's identity, used to access services without re-sending credentials

Question 22 CompTIA Security+ (SY0-701)

What is social engineering?

RSA, ECC (Elliptic Curve Cryptography), and DSA for signatures Manipulating people into performing actions or divulging confidential information, exploiting human psychology Trying words from a predefined list of common passwords against an account An extension of the CIA triad adding Possession, Authenticity, and Utility

Question 23 CompTIA Security+ (SY0-701)

What is a TOTP?

Flagging activity that deviates from a learned baseline of normal behavior Authentication verifies identity ("who you are"); authorization determines permitted actions ("what you can do") Time-based One-Time Password - a 6-8 digit code generated from a shared secret and current time (e.g., Google Authenticator, RFC 6238) Security Assertion Markup Language - an XML-based standard for federated single sign-on (SSO) exchanging authentication/authorization data

Question 24 CompTIA Security+ (SY0-701)

What is perfect forward secrecy (PFS)?

DoS uses a single source; DDoS uses many distributed sources, making mitigation harder A copy of a cryptographic key is held by a trusted third party so it can be recovered if the original is lost A time-limited token issued by the KDC proving a client's identity, used to access services without re-sending credentials A property where session keys are ephemeral, so compromising one long-term key does not reveal past sessions

Question 25 CompTIA Security+ (SY0-701)

What is a MAC flooding attack?

Dividing a network into smaller zones (VLANs, subnets) to limit the blast radius of a compromise Overloading a switch's MAC address table to force it into hub mode and capture traffic An identity layer on top of OAuth 2.0 providing authentication (verifying who the user is) using JSON Web Tokens A decoy system designed to attract attackers, study their behavior, and divert them from real assets

Question 26 CompTIA Security+ (SY0-701)

What are the three parts of Kerberos?

Client, Application Server, and Key Distribution Center (KDC) consisting of Authentication Server and Ticket Granting Server Asymmetric encryption, digital signatures, and key exchange; security based on the difficulty of factoring large primes Web Application Firewall - a firewall that filters and monitors HTTP traffic to/from a web application By using nonces, sequence numbers, and session tickets that expire or are unique per session

Question 27 CompTIA Security+ (SY0-701)

What is a honeypot?

Spear phishing targets a specific individual or group; whaling targets senior executives ("big fish") A decoy system designed to attract attackers, study their behavior, and divert them from real assets Attack vector = the path or method used to gain access; attack surface = the total set of all possible entry points Distributed Denial of Service - overwhelming a target with traffic from many distributed sources (botnet)

Question 28 CompTIA Security+ (SY0-701)

What is an HMAC-based OTP (HOTP)?

Hardcoding a specific certificate or public key in an application to detect fraudulent certificates Message Authentication Code - a tag using a shared secret key to verify both integrity and authenticity of a message An OTP generated from a counter value and shared secret, used in hardware tokens (RFC 4226) Elliptic Curve Cryptography - asymmetric crypto offering equivalent security to RSA with smaller key sizes

Question 29 CompTIA Security+ (SY0-701)

What is phishing?

Social engineering using fraudulent email or messages to trick users into revealing credentials or installing malware TLS is the successor to SSL; modern systems use TLS 1.2 or 1.3. SSL 3.0 is deprecated and insecure. RSA, ECC (Elliptic Curve Cryptography), and DSA for signatures Elliptic Curve Cryptography - asymmetric crypto offering equivalent security to RSA with smaller key sizes

Question 30 CompTIA Security+ (SY0-701)

What is an evil twin attack?

A rogue Wi-Fi access point mimicking a legitimate one to capture credentials of users connecting to it A ticket-based authentication system using a Key Distribution Center (KDC) to authenticate users in a Windows/AD environment A unique random value is added to each password before hashing, making precomputed tables ineffective Client, Application Server, and Key Distribution Center (KDC) consisting of Authentication Server and Ticket Granting Server

Question 31 CompTIA Security+ (SY0-701)

What is OAuth 2.0?

An authorization framework that allows third-party apps to obtain limited access to user resources without exposing credentials Access is granted only to information required for a specific task, even if broader clearance exists A copy of a cryptographic key is held by a trusted third party so it can be recovered if the original is lost SMS phishing - social engineering conducted via text messages

Question 32 CompTIA Security+ (SY0-701)

What is MFA?

Multi-Factor Authentication - requires two or more of: something you know, have, are, do, or somewhere you are A method of using a block cipher to securely encrypt data longer than a single block (e.g., CBC, GCM, CTR) Network traffic flowing between servers within a data center or cloud environment, as opposed to north-south (client-to-server) The standard format for public key certificates used in PKI and TLS

Question 33 CompTIA Security+ (SY0-701)

Define non-repudiation.

Remote Authentication Dial-In User Service - a AAA protocol for centralized authentication, authorization, and accounting, often for network access An authorization framework that allows third-party apps to obtain limited access to user resources without exposing credentials Assurance that a party cannot deny having performed an action, typically via digital signatures or audit logs A unique random value is added to each password before hashing, making precomputed tables ineffective

Question 34 CompTIA Security+ (SY0-701)

What is an attack surface?

The sum of all points where an unauthorized user can attempt to enter or extract data from a system Management formally acknowledges a risk and chooses not to mitigate it, typically when cost of control exceeds potential loss An unauthorized DHCP server handing out incorrect network configuration, including a malicious default gateway Social engineering where the attacker fabricates a believable scenario to steal information or access

Question 35 CompTIA Security+ (SY0-701)

What is a captive portal?

False positive = legitimate traffic flagged as malicious; false negative = malicious traffic not detected (more dangerous) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege A web page users must interact with (accept terms, log in) before gaining network access, common on guest Wi-Fi RSA, ECC (Elliptic Curve Cryptography), and DSA for signatures

Question 36 CompTIA Security+ (SY0-701)

What is risk transference?

TLS encryption, server (and optionally client) authentication, and integrity for HTTP traffic TCP 443 Shifting risk to a third party, e.g., via cyber insurance or outsourcing Lightweight Directory Access Protocol - querying and modifying directory services such as Active Directory

Question 37 CompTIA Security+ (SY0-701)

What is a rainbow table attack?

Social engineering where the attacker fabricates a believable scenario to steal information or access Online Certificate Status Protocol - real-time check to determine if a certificate is revoked Precomputed table of hashes used to reverse common passwords by lookup rather than recomputation The sum of all points where an unauthorized user can attempt to enter or extract data from a system

Question 38 CompTIA Security+ (SY0-701)

What is key escrow?

Multi-Factor Authentication - requires two or more of: something you know, have, are, do, or somewhere you are A copy of a cryptographic key is held by a trusted third party so it can be recovered if the original is lost TLS is the successor to SSL; modern systems use TLS 1.2 or 1.3. SSL 3.0 is deprecated and insecure. Searching through discarded trash for sensitive information like printed documents or credentials

Question 39 CompTIA Security+ (SY0-701)

Name three symmetric encryption algorithms.

AES, 3DES, ChaCha20 (Blowfish and RC4 are legacy) Trust established between two organizations' identity providers so users from one can access resources in the other Security Assertion Markup Language - an XML-based standard for federated single sign-on (SSO) exchanging authentication/authorization data Sending forged Wi-Fi deauth frames to disconnect clients, often to capture WPA handshakes

Question 40 CompTIA Security+ (SY0-701)

What port does SSH use by default?

By using nonces, sequence numbers, and session tickets that expire or are unique per session TCP 22 TCP 443 Online Certificate Status Protocol - real-time check to determine if a certificate is revoked

Question 41 CompTIA Security+ (SY0-701)

What is a dumpster diving attack?

Overloading a switch's MAC address table to force it into hub mode and capture traffic Searching through discarded trash for sensitive information like printed documents or credentials The sum of all points where an unauthorized user can attempt to enter or extract data from a system Symmetric uses one shared key for encrypt/decrypt; asymmetric uses a mathematically paired public/private key pair

Question 42 CompTIA Security+ (SY0-701)

What is a self-signed certificate?

Sending forged ARP messages to associate the attacker's MAC address with a legitimate IP, enabling MITM A user authenticates once and gains access to multiple independent systems without re-entering credentials Spear phishing targets a specific individual or group; whaling targets senior executives ("big fish") A certificate signed by the same entity it certifies, not trusted by default in browsers unless manually added

Question 43 CompTIA Security+ (SY0-701)

How does TLS protect against replay attacks?

Security Assertion Markup Language - an XML-based standard for federated single sign-on (SSO) exchanging authentication/authorization data By using nonces, sequence numbers, and session tickets that expire or are unique per session Demilitarized zone - a buffer network between an untrusted network (Internet) and a trusted internal network, hosting public-facing services Security Orchestration, Automation, and Response - platforms that automate security operations workflows and incident response

Question 44 CompTIA Security+ (SY0-701)

What is LDAP used for?

A certificate signed by the same entity it certifies, not trusted by default in browsers unless manually added A one-way cryptographic function that maps data of any size to a fixed-size output (digest) Secure remote command-line access and file transfer, replacing unencrypted Telnet Lightweight Directory Access Protocol - querying and modifying directory services such as Active Directory

Question 45 CompTIA Security+ (SY0-701)

What is a PKI?

Security Assertion Markup Language - an XML-based standard for federated single sign-on (SSO) exchanging authentication/authorization data A web page users must interact with (accept terms, log in) before gaining network access, common on guest Wi-Fi Flagging activity that deviates from a learned baseline of normal behavior Public Key Infrastructure - the framework of policies, hardware, software, and people used to manage digital certificates and keys

Question 46 CompTIA Security+ (SY0-701)

What is ARP poisoning?

Authentication verifies identity ("who you are"); authorization determines permitted actions ("what you can do") Trying a small set of common passwords against many accounts to avoid account lockouts Sending forged ARP messages to associate the attacker's MAC address with a legitimate IP, enabling MITM Common Vulnerability Scoring System - a 0.0-10.0 score representing base severity of a vulnerability

Question 47 CompTIA Security+ (SY0-701)

What is a man-in-the-middle (MITM) attack?

An attacker captures and maliciously re-sends a valid data transmission to trick the receiver IDS (Intrusion Detection System) monitors and alerts; IPS (Intrusion Prevention System) blocks traffic in real time An attacker secretly intercepts and possibly alters communication between two parties who believe they are talking directly Public Key Infrastructure - the framework of policies, hardware, software, and people used to manage digital certificates and keys

Question 48 CompTIA Security+ (SY0-701)

What does STRIDE stand for?

A property where session keys are ephemeral, so compromising one long-term key does not reveal past sessions A software flaw unknown to the vendor with no patch available, actively exploited by attackers The standard format for public key certificates used in PKI and TLS Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

Question 49 CompTIA Security+ (SY0-701)

Define a block cipher mode of operation.

Trust established between two organizations' identity providers so users from one can access resources in the other Time-based One-Time Password - a 6-8 digit code generated from a shared secret and current time (e.g., Google Authenticator, RFC 6238) Access is granted only to information required for a specific task, even if broader clearance exists A method of using a block cipher to securely encrypt data longer than a single block (e.g., CBC, GCM, CTR)

Question 50 CompTIA Security+ (SY0-701)

What is a key exchange protocol?

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege Common Vulnerability Scoring System - a 0.0-10.0 score representing base severity of a vulnerability A method for two parties to establish a shared secret over an insecure channel (e.g., Diffie-Hellman) Certificate Revocation List - a CA-published list of certificates that have been revoked before expiration