01
True or false
1 point
True or false: A vulnerability scanner's critical-severity finding is proof that the affected system has been compromised.
Free Practice Quiz Question List
8 Comprehensive Security+ Practice and Review Online Quiz Questions
Use this free practice quiz with 20 questions to review 8 Comprehensive Security+ Practice and Review, test your knowledge, and prepare for your next test or exam.
20 questions
02
Written response
1 point
Which security property does encryption primarily protect?
03
True or false
1 point
True or false: The percentages assigned to exam domains determine the exact number of questions from each domain on every exam form.
- A
True
- B
False
04
Written response
1 point
What is the governance term for an authorized risk owner's documented decision to accept a risk for a defined period?
05
Fill in the blank
1 point
Complete each definition. The specifies the target time for restoring a service. The specifies the maximum acceptable period of data loss.
06
Choose one
1 point
A payroll administrator entered a password on a page linked from an unexpected email. An alert shows a new device accessing payroll records. What should the security team do first?
- A
Delete the email and wait for the user's next scheduled password change.
- B
Revoke active sessions and disable or restrict the account while preserving relevant logs.
- C
Shut down every payroll server.
- D
Announce that payroll data has definitely been stolen.
07
Choose one
1 point
A company needs employees on personal devices to access a cloud application. Which design best avoids trusting a device merely because it is on the corporate network?
- A
Grant broad access to every device connected through the corporate VPN.
- B
Authorize access to the specific resource using user identity and device context.
- C
Allow connections from known office IP addresses without user authentication.
- D
Treat all traffic on a private subnet as trusted.
08
Fill in the blank
1 point
A permissions error made confidential customer records readable to all employees. To limit unauthorized reading, apply . To help detect and investigate future access, enable .
09
Choose all
1 point
An alert suggests a workstation may have sent sensitive files to an unfamiliar external host. Select all actions that best support a reliable investigation and limit further harm.
- A
Preserve relevant endpoint, network, and application records.
- B
Document evidence collection and handling.
- C
Reimage the workstation immediately and discard its logs.
- D
Contain the device as appropriate while the investigation proceeds.
- E
Publicly identify a suspected attacker before validating the alert.
10
Choose one
1 point
A scanner finds a critical flaw on two systems: an internet-facing payment server with evidence of active exploitation and an isolated test machine with no sensitive data. What is the best next step?
- A
Patch the isolated test machine first because it is easier to update.
- B
Prioritize the exposed payment server, confirm business impact, and apply a tested fix or suitable interim mitigation.
- C
Defer both fixes until the next annual audit.
- D
Treat the scanner rating as proof both systems were compromised.
11
Choose all
1 point
A company plans to let a payment processor access customer information. Select all measures that appropriately address third-party risk before and during the relationship.
- A
Assess the processor's security and data-handling practices before granting access.
- B
Define security and incident-notification obligations in the agreement.
- C
Assume outsourcing removes the organization's responsibility to manage the risk.
- D
Monitor the relationship after it begins.
12
Choose one
1 point
A technician makes an unapproved firewall change that exposes a management interface to the internet. There is no confirmed compromise. What is the best response?
- A
Restore a known-good configuration through the authorized process, verify the exposure is closed, and preserve relevant records.
- B
Leave the rule in place until the next change window, regardless of risk.
- C
Delete all firewall logs to avoid confusion.
- D
Make undocumented changes to compensate.
13
Open ended
1 point
A learner is planning Security+ review using the published domain percentages. Explain how those percentages can guide study and what they cannot predict about an individual exam form.
14
Choose one
1 point
Which statement best describes how a security team should interpret vulnerability scan results when deciding what to remediate first?
- A
A critical scanner rating alone establishes that an attacker accessed the system.
- B
A finding should be assessed alongside exposure, exploitation evidence, asset importance, and potential impact.
- C
An isolated machine should always be patched before an exposed payment server.
- D
A vulnerability can be considered closed when a business owner asks for more time.
15
Choose one
1 point
A shared folder contains confidential customer records, but a permissions error allows all employees to read them. Which pair of controls most directly helps prevent unauthorized access and detect future access?
- A
Least-privilege permissions and access logging
- B
A disaster recovery site and a privacy notice
- C
A longer password-expiration period and an awareness poster
- D
An encrypted disk that does not protect the shared files and a vulnerability scan
16
True or false
1 point
A technician makes an unapproved firewall change that exposes a management interface to the internet. No compromise is confirmed. The rule can safely remain until the next scheduled change window. True or false?
- A
True
- B
False
17
Written response
1 point
What acronym names the recovery metric that specifies the maximum acceptable period of data loss?
18
Choose one
1 point
An organization needs to check that a downloaded software update came from its vendor and was not altered in transit. Which mechanism best meets both needs?
- A
Encrypt the update with a shared key
- B
Verify a digital signature using the vendor’s trusted public key
- C
Calculate a hash without a trusted reference value
- D
Store the update on an encrypted disk
19
Written response
1 point
What architecture name describes making resource-specific access decisions based on user identity and device context rather than trusting network location?
20
Choose one
1 point
A company plans to give a payment processor access to customer information. Which approach best manages risk before and during the relationship?
- A
Rely on the processor’s marketing claims and review its security only after an incident
- B
Assess its security practices, define obligations in the agreement, and monitor the relationship
- C
Assume outsourcing removes the organization’s responsibility for the risk
- D
Provide permanent administrator access so the processor can respond quickly