CompTIA Security+ — Practice Exam
3.0 Security Architecture: practice questions
Our CompTIA Security+ bank has 54 questions on this topic. Here are 5 of them with answers; the full mock exam draws from every topic, like the real one.
Question 1
Which recovery site has power and network but no ready systems or current data, so recovery takes longest?
- Hot site
- Warm site
- Mirrored site
- Cold site
Show the answer
D. Cold site — A cold site is an empty facility. A warm site has some equipment; a hot site can take over almost immediately.
Question 2
Why is the location of an IDS sensor important?
- It must be on every laptop
- It only works in the cloud
- It only sees traffic on the segment where it is placed
- Location does not matter because sensors see all traffic
Show the answer
C. It only sees traffic on the segment where it is placed — Device placement decides what traffic a sensor or firewall can see and control.
Question 3
What does SD-WAN mainly do?
- Encrypt data at rest on branch office servers
- Route WAN traffic over several links under central policy
- Replace all firewalls
- Issue certificates
Show the answer
B. Route WAN traffic over several links under central policy — SD-WAN chooses among links (MPLS, broadband, LTE) by policy and manages them centrally.
Question 4
Which protocol negotiates the keys and security associations for IPsec?
- IKE
- ESP
- AH
- L2TP
Show the answer
A. IKE — Internet Key Exchange (IKEv2, RFC 7296) authenticates peers and sets up security associations.
Question 5
A control system network has no physical or wireless connection to any other network. What is it?
- Screened subnet
- VLAN-segmented
- Air-gapped
- Software-defined
Show the answer
C. Air-gapped — An air gap is physical isolation. It still needs controls for removable media, which can bridge the gap.