CompTIA Security+ General Security Concepts Practice Questions

1. After several after-hours break-in attempts, a company puts up prominent signs at its warehouse entrances stating that the premises are under 24-hour video surveillance and that trespassers will be prosecuted. Which control type do the signs primarily represent?

Objective 1.1

Show answer

Answer: C. Deterrent

The signs try to discourage an intruder from attempting entry, which makes them a deterrent control. They are not preventive because they cannot physically stop anyone; the cameras themselves would be the detective control.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

2. A hospital runs an imaging system on an operating system the vendor no longer patches. Until the system can be replaced, the security team places it on an isolated VLAN that only the imaging workstations can reach. Which control type does this isolation represent?

Objective 1.1

Show answer

Answer: A. Compensating

A compensating control is an alternative safeguard used when the primary control (here, patching) cannot be applied. It is not corrective, because corrective controls restore systems after an incident rather than reduce risk ahead of time.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

3. Which security concept provides proof of a message's origin and integrity so that the sender cannot later credibly deny having sent it?

Objective 1.2

Show answer

Answer: D. Non-repudiation

Non-repudiation, usually achieved with a digital signature made with the sender's private key, proves who sent a message and that it was not altered. Authorization only decides what an authenticated user may do; it proves nothing about who sent a message.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

4. In a zero trust architecture, which control plane component evaluates policy, threat intelligence and the subject's context to decide whether an access request should be granted?

Objective 1.2

Show answer

Answer: B. Policy engine

The policy engine, part of the policy decision point, makes the grant-or-deny decision. The policy enforcement point sits in the data plane and only carries out that decision by allowing or blocking the connection.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

5. A security team creates a spreadsheet named "payroll_admin_passwords.xlsx" containing fake credentials and places it on a file share. No legitimate user has any reason to open it, so any access triggers an alert. What is this technique called?

Objective 1.2

Show answer

Answer: C. Honeyfile

A honeyfile is a decoy file whose only purpose is to reveal an intruder when it is opened. A honeypot is a whole decoy system, not a single file planted on a real server.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

6. Which physical security control uses two interlocking doors, where the second door cannot open until the first has closed, to stop people from tailgating into a secure area?

Objective 1.2

Show answer

Answer: A. Access control vestibule

An access control vestibule (once called a mantrap) lets only one person through at a time. A badge reader on its own does not stop an unauthorized person from following an authorized one through the open door.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

7. A company plans to align its security program with a published framework. Before buying any new tools, the CISO wants a document showing how current controls compare with the framework's requirements and what is missing. Which activity should be performed?

Objective 1.2

Show answer

Answer: B. Gap analysis

A gap analysis compares the current state with a desired baseline and lists the differences to close. A business impact analysis looks at how outages affect business functions, not at how controls measure up against a framework.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

8. A change advisory board is reviewing a request to update firewall rules during Saturday's maintenance window. Which part of the request describes how to return to the previous configuration if the update causes an outage?

Objective 1.3

Show answer

Answer: D. Backout plan

The backout plan documents how to undo a change and restore the prior state if something goes wrong. The impact analysis estimates what the change might affect but does not say how to reverse it.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

9. An administrator upgrades a database server during an approved change. Afterwards, the order-processing web application that relies on that database stops working. Which technical consideration was most likely overlooked in the change request?

Objective 1.3

Show answer

Answer: A. Dependencies

The web application depends on the database, and that dependency should have been identified and tested before the upgrade. The maintenance window only controls when the change happens, so it would not have prevented the breakage.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

10. Two users choose the same password, yet their stored password hashes are different. Which technique explains this, and also defeats precomputed rainbow-table attacks?

Objective 1.4

Show answer

Answer: B. Salting

A salt is random data added to each password before hashing, so identical passwords produce different hashes and precomputed tables no longer match. Key stretching makes each guess slower by hashing many times, but on its own it does not make identical passwords hash differently.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

11. A browser needs to check whether a website's certificate has been revoked without downloading the certificate authority's full list of revoked certificates. Which protocol should it use?

Objective 1.4

Show answer

Answer: C. OCSP

OCSP asks the CA's responder for the status of a single certificate and gets a quick answer. A CRL is the complete list of revoked certificates, which is exactly the download the browser wants to avoid.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

12. A company wants each laptop's drive encrypted with keys protected by a chip on the laptop's motherboard, which can also verify that boot components have not been tampered with. Which technology meets this need?

Objective 1.4

Show answer

Answer: D. Trusted Platform Module

A TPM is a chip built into the motherboard that stores keys for full-disk encryption and supports secure boot measurements. An HSM also protects keys, but it is a separate, usually network-attached device for servers, not a chip inside each laptop.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

CompTIA Security+ · Domain 1 · 12% of the examGeneral Security Concepts

1. After several after-hours break-in attempts, a company puts up prominent signs at its warehouse entrances stating that the premises are under 24-hour video surveillance and that trespassers will be prosecuted. Which control type do the signs primarily represent?

2. A hospital runs an imaging system on an operating system the vendor no longer patches. Until the system can be replaced, the security team places it on an isolated VLAN that only the imaging workstations can reach. Which control type does this isolation represent?

3. Which security concept provides proof of a message's origin and integrity so that the sender cannot later credibly deny having sent it?

4. In a zero trust architecture, which control plane component evaluates policy, threat intelligence and the subject's context to decide whether an access request should be granted?

5. A security team creates a spreadsheet named "payroll_admin_passwords.xlsx" containing fake credentials and places it on a file share. No legitimate user has any reason to open it, so any access triggers an alert. What is this technique called?

6. Which physical security control uses two interlocking doors, where the second door cannot open until the first has closed, to stop people from tailgating into a secure area?

7. A company plans to align its security program with a published framework. Before buying any new tools, the CISO wants a document showing how current controls compare with the framework's requirements and what is missing. Which activity should be performed?

8. A change advisory board is reviewing a request to update firewall rules during Saturday's maintenance window. Which part of the request describes how to return to the previous configuration if the update causes an outage?

9. An administrator upgrades a database server during an approved change. Afterwards, the order-processing web application that relies on that database stops working. Which technical consideration was most likely overlooked in the change request?

10. Two users choose the same password, yet their stored password hashes are different. Which technique explains this, and also defeats precomputed rainbow-table attacks?

11. A browser needs to check whether a website's certificate has been revoked without downloading the certificate authority's full list of revoked certificates. Which protocol should it use?

12. A company wants each laptop's drive encrypted with keys protected by a chip on the laptop's motherboard, which can also verify that boot components have not been tampered with. Which technology meets this need?