CompTIA Security+ Security Operations Practice Questions

1. Which WPA3 feature replaces the WPA2 pre-shared key handshake and protects against offline dictionary attacks on captured handshakes?

Objective 4.1

Show answer

Answer: B. SAE

Simultaneous Authentication of Equals (SAE) uses a key exchange that cannot be cracked offline from a captured handshake. CCMP is the AES-based encryption WPA2 uses for data; it does not change how the shared password is verified.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

2. A company hires a vendor to shred its old hard drives. Auditors require proof that each drive was actually destroyed. What should the company get from the vendor?

Objective 4.2

Show answer

Answer: A. Certificate of destruction

A certificate of destruction is the vendor's documented proof that specific media were destroyed. Chain of custody records who handled an item and when, but on its own it does not prove the drive was destroyed.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

3. A vulnerability scan reports a critical Apache HTTP Server flaw on a host. The administrator confirms the host runs only Microsoft IIS and has never had Apache installed. How should this finding be classified?

Objective 4.3

Show answer

Answer: C. False positive

A false positive is a reported vulnerability that does not actually exist. A false negative is the opposite problem: a real vulnerability that the scanner missed.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

4. Which system gives a vulnerability a numerical score from 0 to 10 to help prioritize remediation by severity?

Objective 4.3

Show answer

Answer: D. CVSS

The Common Vulnerability Scoring System (CVSS) rates severity on a 0-10 scale. CVE gives each vulnerability a unique identifier, but it does not score it.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

5. Which tool collects logs from firewalls, servers and endpoints in one place, correlates related events across those sources and raises alerts on suspicious patterns?

Objective 4.4

Show answer

Answer: A. SIEM

A Security Information and Event Management (SIEM) system aggregates and correlates log data and generates alerts. SOAR automates the response through playbooks and is usually fed by a SIEM, rather than being the main log correlation platform.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

6. A company has published SPF and DKIM records, but spoofed emails using its domain still reach recipients. It wants receiving mail servers to reject messages that fail those checks and to send it reports. What should it implement?

Objective 4.5

Show answer

Answer: C. DMARC

DMARC tells receivers what to do (none, quarantine or reject) when SPF or DKIM checks fail, and where to send reports. DNSSEC protects the integrity of DNS answers but says nothing about how to handle failing email.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

7. A web application asks users for a password and then for a 4-digit PIN. Does this meet a multifactor authentication requirement?

Objective 4.6

Show answer

Answer: B. No, because both are something you know

A password and a PIN are both knowledge factors, so this is two-step but single-factor authentication. Requiring two credentials is not enough; they must come from different categories such as something you know, have or are.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

8. Which standard lets a user grant a third-party application limited access to their data on another service, such as a calendar, without giving that application their password?

Objective 4.6

Show answer

Answer: B. OAuth

OAuth is an authorization framework that issues the third-party app a scoped access token instead of the user's credentials. SAML exchanges authentication assertions for single sign-on and is not designed for delegated API access.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

9. A cloud team adds an automated check to its deployment pipeline that blocks the deployment of any storage bucket configured for public access. Which automation use case does this illustrate?

Objective 4.7

Show answer

Answer: D. Guard rails

Guard rails are automated checks that stop insecure changes before they reach production. Technical debt is a drawback of automation (the cost of quick fixes left to maintain later), not a use case.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

10. An analyst has disconnected an infected workstation from the network to stop the malware spreading. In the incident response process, which phase should come next?

Objective 4.8

Show answer

Answer: C. Eradication

After containment comes eradication, which removes the malware and closes the hole it used. Recovery comes after eradication; restoring the system first risks putting an infected machine back into service.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

11. During an investigation, which document records every person who handled a piece of evidence, when, and for what purpose, so that it can be shown in court not to have been tampered with?

Objective 4.8

Show answer

Answer: A. Chain of custody

Chain of custody documents each transfer and handling of evidence to preserve its integrity. A legal hold is an instruction to preserve relevant data; it does not track who handled a specific item.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

12. An attacker downloaded files from a server over unencrypted FTP last night. The firewall logs show the connection, but the analyst needs to know exactly which files were transferred. The network team records all traffic at the perimeter. Which data source will answer the question?

Objective 4.9

Show answer

Answer: D. Packet captures

Packet captures contain the full contents of the traffic, so the unencrypted FTP commands and file names can be read from them. Firewall logs record only connection details such as addresses, ports and times, not the data transferred.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

CompTIA Security+ · Domain 4 · 28% of the examSecurity Operations

1. Which WPA3 feature replaces the WPA2 pre-shared key handshake and protects against offline dictionary attacks on captured handshakes?

2. A company hires a vendor to shred its old hard drives. Auditors require proof that each drive was actually destroyed. What should the company get from the vendor?

3. A vulnerability scan reports a critical Apache HTTP Server flaw on a host. The administrator confirms the host runs only Microsoft IIS and has never had Apache installed. How should this finding be classified?

4. Which system gives a vulnerability a numerical score from 0 to 10 to help prioritize remediation by severity?

5. Which tool collects logs from firewalls, servers and endpoints in one place, correlates related events across those sources and raises alerts on suspicious patterns?

6. A company has published SPF and DKIM records, but spoofed emails using its domain still reach recipients. It wants receiving mail servers to reject messages that fail those checks and to send it reports. What should it implement?

7. A web application asks users for a password and then for a 4-digit PIN. Does this meet a multifactor authentication requirement?

8. Which standard lets a user grant a third-party application limited access to their data on another service, such as a calendar, without giving that application their password?

9. A cloud team adds an automated check to its deployment pipeline that blocks the deployment of any storage bucket configured for public access. Which automation use case does this illustrate?

10. An analyst has disconnected an infected workstation from the network to stop the malware spreading. In the incident response process, which phase should come next?

11. During an investigation, which document records every person who handled a piece of evidence, when, and for what purpose, so that it can be shown in court not to have been tampered with?

12. An attacker downloaded files from a server over unencrypted FTP last night. The firewall logs show the connection, but the analyst needs to know exactly which files were transferred. The network team records all traffic at the perimeter. Which data source will answer the question?