CompTIA Security+ — Practice Exam
4.0 Security Operations: practice questions
Our CompTIA Security+ bank has 88 questions on this topic. Here are 5 of them with answers; the full mock exam draws from every topic, like the real one.
Question 1
Which control checks a device's health, such as patch level, before letting it join the network?
- Data loss prevention
- SNMP
- Network access control
- NetFlow
Show the answer
C. Network access control — NAC enforces posture and identity checks before granting network access.
Question 2
Which phase of incident response includes building the team, tools and playbooks before any incident?
- Recovery
- Lessons learned
- Preparation
- Containment
Show the answer
C. Preparation — Preparation makes the organization ready to respond; SP 800-61r3 also stresses ongoing improvement.
Question 3
In the incident response process, which phase includes isolating an infected host from the network?
- Eradication
- Containment
- Recovery
- Preparation
Show the answer
B. Containment — Containment limits spread and damage. Eradication removes the cause; recovery restores normal operation.
Question 4
Why does a forensic examiner hash a disk image right after acquisition?
- To prove later that the image was not changed
- To encrypt the evidence
- To compress the image so it fits on evidence media
- To delete malware
Show the answer
A. To prove later that the image was not changed — Matching hashes before and after analysis show the evidence is unchanged.
Question 5
Which tool records detailed endpoint activity and lets analysts isolate a host remotely?
- EDR
- UTM
- WAF
- SAML
Show the answer
A. EDR — Endpoint detection and response gives visibility and response actions on hosts; XDR extends this across more data sources.