How to Ace the SECURITY-PLUS: CompTIA Security+

Question 1 · General Security Concepts

A company wants to implement a security model that assumes no trust for any user or device, regardless of whether they are inside or outside the corporate network. Which architecture best supports this requirement?

• Role-Based Access Control
• Zero Trust
• Perimeter-based security
• Defense in Depth

Correct answer: Zero Trust

Zero Trust architecture operates on 'never trust, always verify' - requiring continuous authentication and authorization for every access request regardless of network location. Unlike perimeter security which trusts internal users, Zero Trust treats all access as potentially hostile.

Question 2 · Threats, Vulnerabilities, and Mitigations

A security administrator notices unusual outbound connections from a web server to known malicious IP addresses. The server is displaying IoCs associated with data exfiltration. Which attack type is most likely occurring?

• Denial of service flooding that exhausts the server's connection table
• Command and control communication
• ARP poisoning that redirects local subnet traffic to a rogue gateway
• Man-in-the-middle interception of the server's inbound client sessions

Correct answer: Command and control communication

Outbound connections to malicious IPs with data exfiltration indicators strongly suggest compromised systems communicating with attacker command and control (C2) infrastructure. This is characteristic of advanced persistent threats and malware infections.

Question 3 · Security Architecture

An organization wants to host public web servers while protecting internal networks from direct internet exposure. Which network architecture should be implemented?

• Peer-to-peer network
• Direct internet connection
• Intranet only
• DMZ (Demilitarized Zone)

Correct answer: DMZ (Demilitarized Zone)

A DMZ creates a buffer network between trusted internal networks and untrusted external networks. Public-facing servers (web, email, DNS) reside in the DMZ, protecting internal networks while maintaining external service availability.

Question 4 · Security Operations

A security administrator receives an alert about suspicious lateral movement between servers in the data center. Network logs show unusual SMB connections from a compromised workstation. What is the immediate priority?

• Reboot the domain controller to clear the active malicious SMB sessions
• Delete the user accounts that initiated the suspicious SMB connections
• Isolate the compromised workstation and affected servers
• Update antivirus definitions and run a full scan across every server

Correct answer: Isolate the compromised workstation and affected servers

Immediate containment is critical to prevent further lateral movement and data exfiltration. Isolating affected systems stops the attack progression while preserving evidence for investigation. Other actions follow containment.

Question 5 · Security Program Management and Oversight

A European company processes personal data of EU residents. They must obtain explicit consent before collecting data and notify authorities of breaches within 72 hours. Which regulation applies?

• GDPR (General Data Protection Regulation)
• SOX (the US law governing corporate financial reporting and controls)
• PCI-DSS (the payment card industry standard for cardholder data security)
• HIPAA (the US framework governing protected patient health information)

Correct answer: GDPR (General Data Protection Regulation)

GDPR is the EU data protection regulation requiring lawful basis for processing, consent management, data subject rights, 72-hour breach notification, privacy by design, and potential fines up to 4% of global revenue.