Security+ practice questions with explanations

Question 1: contain a compromised endpoint

An analyst confirms that a workstation is communicating with a known command-and-control address. The user is still signed in and the device contains volatile evidence. What should the analyst do first?

Best answer: isolate the workstation from the network using the approved response capability. This limits continued communication and lateral movement while preserving the system for investigation. Immediately wiping the device destroys evidence; simply resetting the user's password does not contain malware operating on the endpoint.

• Signal: confirmed active compromise.
• Immediate objective: containment.
• Distractor pattern: remediation before evidence-aware containment.

Question 2: choose the right identity control

A cloud administrator needs elevated access for a two-hour maintenance window each month. Which approach best reduces the risk of standing privilege?

Best answer: just-in-time privileged access with approval, expiration, and logging. A second permanent administrator account still creates standing access. Password rotation improves credential hygiene but does not remove unnecessary authorization.

• Signal: privilege is needed rarely and temporarily.
• Control: time-bounded elevation.
• Verification: log approval, use, and automatic removal.

Question 3: protect stored passwords

A development team is redesigning credential storage. Which approach most directly limits the usefulness of a stolen password database?

Best answer: a unique salt per password with a purpose-built, slow password-hashing function and appropriate work factor. Reversible encryption creates a key-management dependency, and fast general-purpose hashes make guessing cheaper.

• Security goal: resist offline guessing.
• Salt prevents identical passwords from producing identical stored values.
• A work factor raises the cost of each guess.

Question 4: restore availability with integrity

After ransomware affects a file server, the team finds that connected backups may also be altered. Which preparation would have most improved recovery confidence?

Best answer: tested, access-controlled offline or immutable backups with documented restoration procedures. High availability can replicate corruption, and an untested backup is not proof that recovery will work.

• Signal: destructive change may reach connected systems.
• Control outcome: recover a known-good state.
• Operational requirement: restoration must be rehearsed.

Question 5: interpret certificate warnings

Employees receive a browser certificate warning only when connecting through a newly installed inspection appliance. What should be checked first?

Best answer: whether the organization's trusted inspection certificate was deployed correctly and whether the appliance is presenting certificates with valid names and trust chains. Telling users to bypass warnings normalizes unsafe behavior.

• Signal: the change coincides with TLS inspection.
• Check trust, subject names, validity, and deployment scope.
• Never make warning bypass the routine solution.

How to learn from each answer

For each item, write why the best choice fits the immediate objective and why the strongest distractor fails. Then change one condition—for example, from suspected to confirmed compromise—and decide whether the answer changes.

• Classify misses as recall, scenario reading, control selection, or sequencing.
• Retest the concept with different wording.
• Use the full diagnostic to identify which domain needs attention next.