PassSpark

CompTIA Security+ 2022 past questions and answers

This 2022 CompTIA Security+ set has 20 practice questions. Try these 5 free sample questions, tap a question to reveal the answer and explanation. Then practise the whole 2022 set with instant marking.

Practise the full 2022 setTimed exam mode

Sample CompTIA Security+ 2022 questions

1. A security analyst finds that an employee entered credentials into a convincing login page reached through a link in a targeted email. The page used a look-alike domain and collected the credentials. Which attack best describes this event?
  1. Spear phishing
  2. Pretexting by telephone
  3. Tailgating
  4. Watering-hole attack

Answer: A. Spear phishing

The targeted email and fraudulent credential-harvesting page are characteristics of spear phishing. Tailgating is unauthorized physical entry, while a watering-hole attack compromises a site its intended victims commonly visit.

2. A web application displays database error details when a user submits a crafted value in a search field. Which weakness is the most likely cause?
  1. Cross-site request forgery
  2. SQL injection
  3. Integer overflow
  4. Directory traversal

Answer: B. SQL injection

A crafted search value that changes a database query can exploit SQL injection, and database errors may expose the result. CSRF abuses an authenticated browser session, while directory traversal manipulates file paths.

3. A developer must prevent user input from changing the structure of SQL queries. Which control is the most effective direct countermeasure?
  1. Store database backups offline
  2. Use parameterized queries
  3. Enable verbose application errors
  4. Require longer user passwords

Answer: B. Use parameterized queries

Parameterized queries separate data from executable SQL syntax and directly mitigate SQL injection. Offline backups and stronger passwords address other risks, and verbose errors can reveal additional information.

4. A company stores password verifiers using a fast hash function but adds a unique random value to each password before hashing. What is the primary benefit of the random value?
  1. It allows the password to be recovered from its hash.
  2. It prevents users from reusing passwords.
  3. It makes identical passwords produce different stored hashes and frustrates precomputed rainbow-table attacks.
  4. It encrypts the password with the database server's public key.

Answer: C. It makes identical passwords produce different stored hashes and frustrates precomputed rainbow-table attacks.

A unique salt makes identical passwords hash differently and reduces the usefulness of precomputed rainbow tables. A salt does not make a hash reversible, enforce password reuse policies, or encrypt the password.

5. A company hosts a public web server and an internal customer database. Which placement best limits direct exposure of the database to the internet?
  1. Place both servers on the public-facing network and rely on host passwords.
  2. Place the web server in a DMZ and keep the database on a protected internal network, allowing only required traffic between them.
  3. Place the database in the DMZ and the web server on the internal network.
  4. Connect both servers to a flat network and enable endpoint logging.

Answer: B. Place the web server in a DMZ and keep the database on a protected internal network, allowing only required traffic between them.

A DMZ exposes the public-facing web tier while network segmentation keeps the database on a protected internal segment with narrowly permitted flows. A flat or public network leaves the database unnecessarily exposed; logging alone does not provide isolation.

More CompTIA Security+ years

2026202520242023

All CompTIA Security+ years · CompTIA subjects

PassSpark questions are original practice questions written to each exam's syllabus and format, in the style of past questions. They are not official past papers and are not affiliated with JAMB, WAEC, NECO, any university or any exam body.