22 Security Practice Questions & Answers

1. 1. Which statement correctly distinguishes a worm from a Trojan?

   • A.A worm encrypts user files and demands payment, while a Trojan only displays unwanted advertising.
   • B.A worm must attach itself to an existing host file, while a Trojan spreads only through infected boot sectors.
   • C.A worm copies itself to other systems across a network on its own, while a Trojan must be launched by a user who believes it is legitimate software.✓ Answer
   • D.A worm runs only in system memory, while a Trojan always requires administrative rights before it can run at all.

   The defining property of a worm is self-propagation: it carries its own delivery mechanism and spreads across network connections without any user action and without needing a host file. The defining property of a Trojan is disguise: it has no self-spreading mechanism at all and relies on social engineering, because the user voluntarily installs or runs it believing it is something useful.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.4, types of malwareReport a problem with this question

2. 2. Antivirus software running inside a booted, infected Windows installation reports that the system is clean, yet the machine shows hidden processes and unexplained outbound traffic. Why is a rootkit especially able to defeat that scan?

   • A.It subverts operating system or firmware components, so the OS returns falsified results to any tool that queries it; scanning from trusted external boot media is far more reliable.✓ Answer
   • B.It changes its own file extension every few minutes, so no signature file can ever match it.
   • C.It hides inside the page file, which antivirus software is not permitted to open.
   • D.It runs only while the user is logged off, so any scan started during a session cannot see it.

   A rootkit installs at a privileged level (kernel drivers, system libraries, or firmware) and hooks the very functions that enumerate files, processes, and registry keys. Any scanner that asks the running operating system what is present is asking a component the rootkit already controls, so the only trustworthy examination comes from outside that operating system — a preinstallation environment or bootable rescue media — and heavily compromised systems are often reimaged instead.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.4, rootkits and removal tools/methodsReport a problem with this question

3. 3. A user's documents have all been replaced with encrypted copies and a message demands payment for the decryption key. Which response BEST restores the data?

   • A.Restore the affected data from a recent, tested backup that was kept offline or otherwise isolated from the infected system.✓ Answer
   • B.Run a standard format on the drive, which reverses the encryption and returns the original files.
   • C.Reset the user's account password so the attacker can no longer use the encryption key.
   • D.Pay the demanded amount quickly, because attackers reliably release the key once payment clears.

   Ransomware encrypts data with a key the attacker holds, so nothing done on the victim machine can recover the plaintext. Recovery therefore depends entirely on a clean copy of the data that the malware could not reach, which is why backups must be tested and kept offline or immutable; paying provides no guarantee of a working key and funds further attacks, and formatting destroys rather than recovers the files.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.4, ransomware and prevention methodsReport a problem with this question

4. 4. Several office workstations run at nearly full CPU load around the clock, their fans are constantly loud, and performance is sluggish — but no files are missing, encrypted, or altered. Which type of malware best matches these symptoms?

   • A.Keylogger
   • B.Boot sector virus
   • C.Cryptominer✓ Answer
   • D.Ransomware

   A cryptominer's purpose is to steal processing cycles to mine cryptocurrency for the attacker, so its signature is sustained CPU or GPU saturation with the heat, fan noise, and power draw that follow — and deliberately no damage to data, since the attacker wants the machine to keep running. A keylogger causes no noticeable load, ransomware announces itself by encrypting files, and a boot sector infection shows up as a failure or anomaly during startup.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.4, cryptominers and malware symptomsReport a problem with this question

5. 5. A technician has investigated a workstation and verified that it is infected with malware. What should be done NEXT, before any cleanup work begins?

   • A.Reinstall the operating system immediately.
   • B.Educate the user about how the infection was probably acquired.
   • C.Disconnect the machine from the network and any shared storage in order to quarantine it.✓ Answer
   • D.Create a new restore point so the machine can be rolled back if the cleanup fails.

   Containment comes immediately after the symptoms are verified because an infected host left online can spread to file shares and other machines and can keep communicating with the attacker while the technician works. Creating a restore point at this stage would preserve the infection, user education belongs at the very end when the actual cause is known, and reinstalling is a last-resort remediation rather than a first response.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.6, malware removal procedure (quarantine step)Report a problem with this question

6. 6. Before running a removal scan on a quarantined, infected computer, which action is required, and why?

   • A.Perform a quick format first, so the scanner has enough free space to work.
   • B.Update the anti-malware definitions first, because a scan run with outdated signatures can miss recently released threats.✓ Answer
   • C.Reconnect the machine to the network first, so the scanner can validate its license.
   • D.Re-enable System Restore first, so that the scanning engine has a checkpoint to write to.

   Signature-based detection can only recognize what is in its definition database, so scanning before updating is the classic ordering mistake: the tool reports a clean system simply because it does not yet know the threat. Definitions are updated as part of remediation and immediately before the scan-and-removal step, and updates can be applied from separate media or a controlled connection so the quarantine is not broken.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.6, update anti-malware software before scan and removalReport a problem with this question

7. 7. Which sequence correctly orders the steps of the malware remediation process after the symptoms have been investigated and verified?

   • A.Remediate → quarantine the system → create a restore point → update definitions → educate the end user
   • B.Quarantine the system → disable System Restore → update definitions, then scan and remove → re-enable System Restore and create a restore point → educate the end user✓ Answer
   • C.Educate the end user → quarantine the system → remediate → disable System Restore → create a restore point
   • D.Disable System Restore → educate the end user → quarantine the system → scan and remove → update definitions

   Each position exists for a reason: containment comes first so the infection cannot spread while work proceeds; System Restore is disabled because existing restore points can contain the malware and silently reinfect the machine after cleanup; definitions are updated before scanning so the scan can recognize current threats; a fresh restore point is created only after the system is verified clean; and user education is always last, because only then does the technician know what actually happened and can explain how to avoid a repeat.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.6, ordered SOHO malware removal procedureReport a problem with this question

8. 8. An unauthorized visitor slips through a badge-controlled door by walking closely behind an employee who has just badged in. Which control is specifically designed to stop this?

   • A.A privacy filter installed on every monitor
   • B.A longer minimum password length for all accounts
   • C.A cross-cut shredder placed next to each printer
   • D.An access control vestibule that admits only one authenticated person at a time✓ Answer

   This is tailgating, a physical social-engineering technique, so the countermeasure must also be physical: an access control vestibule uses two interlocking doors so that only one credentialed person passes per authentication, which mechanically removes the opportunity to follow someone in. Privacy filters address shoulder surfing, shredders address dumpster diving, and password rules do nothing about a door; user awareness training to challenge unknown followers supports the vestibule but does not replace it.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objectives 2.1 and 2.5, physical security controls and tailgatingReport a problem with this question

9. 9. An employee receives a phone call from someone claiming to be the company bank's fraud department, who urgently asks the employee to confirm account credentials. Which attack is this?

   • A.Shoulder surfing
   • B.Smishing
   • C.Whaling
   • D.Vishing✓ Answer

   The phishing variants are named for the delivery channel or the target, not for the pretext: vishing is phishing carried out by voice call, smishing arrives by SMS or text message, spear phishing is aimed at one specific person or small group, and whaling targets executives regardless of channel. Shoulder surfing is not phishing at all — it is direct visual observation of a screen or keypad.

   Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.5, phishing, vishing, smishing, spear phishing, whalingReport a problem with this question

10. 10. Attackers compromise a small industry news site that engineers at a target company read every morning, so that visiting the site silently infects their computers. Which technique is this?

    • A.Watering hole attack✓ Answer
    • B.Evil twin
    • C.Pretexting
    • D.Dumpster diving

    A watering hole attack works indirectly: instead of attacking a hardened target, the attacker poisons a third-party resource the target group already trusts and visits, so the victims come to the malware. Dumpster diving recovers information from discarded paper and media, an evil twin is a rogue wireless access point imitating a legitimate SSID, and pretexting is inventing a believable identity and story to draw information out of a person.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.5, social engineering attacks and threatsReport a problem with this question

11. 11. A login page asks for a password and then for the answer to a security question. Why does this NOT qualify as multifactor authentication?

    • A.True multifactor authentication requires at least three separate credentials.
    • B.Both items are something the user knows, so only one factor category is actually being used.✓ Answer
    • C.True multifactor authentication requires that the two credentials be entered on two different devices.
    • D.Security questions are stored encrypted, and encrypted values can never count as an authentication factor.

    Multifactor means credentials drawn from different categories — something you know, something you have, something you are — because each category fails to a different kind of attack. A password and a security question are both knowledge, so a single successful phishing call or database leak can hand over both; pairing the password with a hardware token or authenticator app (something you have) or a fingerprint (something you are) is what makes it genuinely multifactor.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.1, multifactor authentication factor categoriesReport a problem with this question

12. 12. A user signs in to the domain successfully but is told 'access denied' when opening a departmental folder. Which element of authentication, authorization, and accounting governs whether the user may open that folder?

    • A.Authentication
    • B.Single sign-on
    • C.Accounting
    • D.Authorization✓ Answer

    Authentication answers 'who are you' and it clearly succeeded, because the sign-in was accepted. Authorization answers 'what are you permitted to do' and is enforced through group membership and permissions on the resource, so that is where an access-denied message on a specific folder originates. Accounting is the record of what was done afterward, and single sign-on is a convenience mechanism that reuses one authentication across services rather than a rights decision.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.1, authentication vs. authorization vs. accountingReport a problem with this question

13. 13. Credentials belonging to several employees appear in a breach dump from an unrelated consumer website, and attackers immediately use them to log into the company portal. Which password policy principle MOST directly prevents this?

    • A.Enabling password hints on the sign-in page so users choose memorable passwords
    • B.Requiring frequent scheduled password changes on a fixed rotation
    • C.Shortening the account lockout duration so locked users recover faster
    • D.Requiring that every account use a unique password that is not reused on any other site or service✓ Answer

    This attack is credential stuffing, and it only works because the same password protects more than one account, so uniqueness is the control that breaks the chain — a password manager makes uniqueness practical. Forced frequent rotation tends to push users toward predictable variations and does not stop reuse, hints weaken the secret, and a shorter lockout duration helps the attacker rather than the defender. Lockout thresholds are the right answer for a different attack: online brute force and dictionary guessing.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.7, password best practices (uniqueness, length, lockout)Report a problem with this question

14. 14. Which statement correctly describes symmetric versus asymmetric encryption?

    • A.Symmetric encryption uses a public key to encrypt and a private key to decrypt, while asymmetric encryption uses the same key for both operations.
    • B.Symmetric encryption is one-way and cannot be reversed, while asymmetric encryption can be reversed with the correct key.
    • C.Symmetric encryption uses one shared key for both encryption and decryption and is fast, so it protects bulk data; asymmetric encryption uses a mathematically related public/private key pair and is typically used to exchange keys and to create digital signatures.✓ Answer
    • D.Asymmetric encryption is faster than symmetric encryption, which is why it is used to encrypt entire hard drives.

    Symmetric algorithms perform far less computation per block, so they are what actually encrypts disks, files, and network payloads, but they create a key-distribution problem: both parties must already share the secret. Asymmetric cryptography solves exactly that problem — anything encrypted with the public key can be opened only by the matching private key — which is why it is used to negotiate the symmetric session key and to sign data, not to bulk-encrypt it.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — encryption concepts (symmetric and asymmetric keys)Report a problem with this question

15. 15. Why is a cryptographic hash — rather than encryption — used to store passwords and to verify that a downloaded file was not altered?

    • A.A hash is simply a reversible cipher with a shorter key, so it runs faster than encryption.
    • B.A hash can be decrypted only by the vendor, which proves the file came from that vendor.
    • C.A hash compresses the file so it downloads faster and can be checked more quickly.
    • D.A hash is a fixed-length, one-way digest that cannot be reversed to recover the input, and any change to the input produces a completely different digest, so it proves integrity without ever exposing the original data.✓ Answer

    Encryption is designed to be reversed by whoever holds the key, which is exactly the wrong property for a stored password: a stolen key would expose every password at once. Hashing has no key and no inverse, so a system can verify a password by hashing what was typed and comparing digests, and a user can verify a download by comparing its computed digest against the publisher's published checksum — a single altered byte changes the result completely.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.11, verifying downloads by hashing; hashing vs. encryptionReport a problem with this question

16. 16. What does the digital certificate presented by a secure website actually assert?

    • A.That the site's owner has agreed to a privacy policy audited by the browser vendor.
    • B.That the website's content has been scanned and found free of malware.
    • C.That a trusted certificate authority has verified the binding between the site's identity (its name) and the public key contained in the certificate.✓ Answer
    • D.That all data stored on the web server is encrypted at rest.

    A certificate is a signed statement binding an identity to a public key; the browser trusts it only because it chains up to a certificate authority the browser already trusts. That is why warnings appear when the certificate is expired, self-signed, issued for a different host name, or when the local clock is wrong — in each case the binding cannot be validated. The certificate says nothing about whether the site's content or business practices are trustworthy.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.11, secure connections and valid certificatesReport a problem with this question

17. 17. Why is a wireless network that uses no encryption (an 'open' network) unsafe even for ordinary web browsing?

    • A.Connecting to an open network disables the software firewall on every device that joins it.
    • B.Open networks broadcast the SSID, and the hidden SSID is the only thing that protects wireless traffic.
    • C.Open networks always run at lower speeds, which forces packets to be retransmitted in clear text.
    • D.The frames travel as unprotected radio signals, so anyone within range can capture and read traffic that is not otherwise encrypted, and an attacker can stand up a look-alike (evil twin) access point that client devices join automatically.✓ Answer

    On a wireless link the medium is shared radio, so confidentiality depends entirely on the link-layer encryption; with none, association requires no credential and every frame is readable by a passive listener with an ordinary adapter. The same absence of authentication lets an attacker advertise the same network name from a rogue access point, so per-site TLS or a VPN becomes the only remaining protection. Hiding an SSID or filtering MAC addresses is obscurity, not encryption, because both values are visible in the frames themselves.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objectives 2.3 and 2.10, wireless encryption settings and evil twinReport a problem with this question

18. 18. Why is WEP, the earliest Wi-Fi encryption scheme, considered fundamentally broken, and what did later wireless standards change?

    • A.WEP worked only on one radio band, and later standards fixed the security problem by adding a second band.
    • B.WEP required a central authentication server that most homes did not have, so later standards removed authentication altogether.
    • C.WEP used a short, repeating initialization vector with a weak stream cipher, so capturing enough ordinary traffic reveals the key; later standards moved to stronger block ciphers with per-packet key handling and eventually to a handshake that resists offline password guessing.✓ Answer
    • D.WEP transmitted the passphrase in clear text inside every frame, which later standards fixed by allowing the SSID to be hidden.

    WEP's flaw is structural rather than a matter of key length: the initialization vector space is small enough that values repeat, and repeated IVs with a stream cipher let an attacker solve for the key from passively collected frames, so no passphrase choice can save it. Each later generation attacked a specific weakness — first replacing the cipher and rekeying every packet, then adopting a strong block cipher, and later replacing the shared-key handshake with one whose capture no longer permits unlimited offline dictionary attempts and which provides forward secrecy.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.3, wireless security protocols and encryptionReport a problem with this question

19. 19. A standard user needs an approved business application installed on her Windows workstation. Which action BEST satisfies the request while preserving the principle of least privilege?

    • A.Add her account to the local Administrators group permanently so she can install software whenever she needs it.
    • B.Turn off User Account Control on the workstation so the installation completes without prompts.
    • C.Have her share her workstation credentials with the help desk so a technician can sign in as her.
    • D.Have a technician install it with 'Run as administrator' using administrative credentials, or push it through a managed software deployment tool, leaving her account a standard user.✓ Answer

    Least privilege means an account carries only the rights its routine work requires, so elevation should be temporary, targeted, and performed with separate administrative credentials rather than granted permanently. Making the user a standing administrator means any malware she runs also inherits administrative rights, disabling User Account Control removes the elevation prompt that makes such changes visible, and sharing credentials destroys accountability because actions can no longer be attributed to an individual.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objectives 2.1 and 2.7, principle of least privilege and restricting user permissionsReport a problem with this question

20. 20. A batch of failed solid-state drives held sensitive data and must be sanitized before disposal. Why is degaussing the wrong method for these drives?

    • A.Degaussing is effective on SSDs but is only valid when the manufacturer's warranty is still active.
    • B.Degaussing only works on drives that are still powered on, and failed drives cannot be powered.
    • C.Degaussing erases the data but leaves the partition table intact, so the files can simply be rebuilt.
    • D.Degaussing destroys data by disrupting magnetic domains, but an SSD stores data in flash memory cells with no magnetic media, so the drives are left readable; shredding or pulverizing, or a cryptographic/secure erase, is required instead.✓ Answer

    A degausser works by applying a strong magnetic field that scrambles the magnetic orientation used to record bits, so it sanitizes hard disk platters and tape but has no effect whatsoever on NAND flash cells in an SSD or USB drive. Sanitization must match the storage technology: flash requires physical destruction or a controller-level secure/cryptographic erase, since ordinary overwriting is also unreliable on flash because wear leveling and over-provisioning keep spare blocks out of reach of the file system.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.9, physical destruction methods (degaussing) vs. media typeReport a problem with this question

21. 21. A department plans to redeploy retired hard drives to other internal users and intends to run a standard (quick) format on each drive first. What is wrong with that plan?

    • A.A standard format destroys the drive's firmware, so the drive cannot be reused at all.
    • B.A standard format only rewrites the file system's index, so the underlying data remains on the platters and can be recovered with ordinary tools; a secure overwrite or erase is required before reuse.✓ Answer
    • C.A standard format encrypts whatever data remains with a key that is then discarded, which internal auditors will not accept.
    • D.A standard format is acceptable only when the drive is leaving the organization, not when it stays.

    Formatting removes the pointers that tell the file system where files live; it does not overwrite the sectors that hold the content, which is why undelete and forensic tools routinely recover 'formatted' data. The decision rule is to match the method to the requirement: a drive being reused inside the organization needs a secure multi-pass overwrite or a drive-level secure erase, while a drive leaving the organization or holding regulated data should be physically destroyed.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.9, erasing/wiping vs. standard formatting for repurposingReport a problem with this question

22. 22. An organization contracts a third-party vendor to physically destroy drives that held regulated customer records. What documentation should the organization require back from the vendor?

    • A.A certificate of destruction identifying the devices destroyed, typically by serial number, along with the date and method used✓ Answer
    • B.A quick-format log generated from each drive before pickup
    • C.A degaussing waiver signed by the end user of each device
    • D.A copy of the vendor's business license and insurance policy

    When destruction is outsourced, the organization keeps the legal responsibility for the data but loses direct custody of the media, so it needs auditable proof that specific devices were in fact destroyed. A certificate of destruction supplies exactly that chain-of-custody evidence — which serial numbers, on what date, by what method — and is what an auditor or regulator asks for when data-retention and disposal obligations must be demonstrated.

    Source: CompTIA A+ Core 2 exam objectives, Domain 2.0 Security — objective 2.9, outsourcing concepts and certification of destructionReport a problem with this question

Practice questions written to the published CompTIA A+ Core 1 and Core 2 exam objectives and to standard IT support practice. CompTIA and A+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. The exam objectives are revised periodically — confirm the current objectives and exam requirements with CompTIA before testing. About the CompTIA A+ certification →