PassSpark

CompTIA Security+ 2023 past questions and answers

This 2023 CompTIA Security+ set has 20 practice questions. Try these 5 free sample questions, tap a question to reveal the answer and explanation. Then practise the whole 2023 set with instant marking.

Practise the full 2023 setTimed exam mode

Sample CompTIA Security+ 2023 questions

1. An analyst downloads a vendor's software package and compares its SHA-256 digest with the digest published by the vendor through a trusted channel. What security property is this check primarily intended to verify?
  1. Confidentiality
  2. Integrity
  3. Availability
  4. Non-repudiation

Answer: B. Integrity

A matching cryptographic hash provides evidence that the package has not changed since the trusted digest was created. Hashing alone does not conceal the package or prove who sent it.

2. A company must encrypt large database backups efficiently and also provide a secure way for a remote partner to obtain the key. Which approach best meets both needs?
  1. Encrypt the backup with a symmetric key and protect that key using the partner's public key
  2. Encrypt the entire backup with the partner's public key and publish the private key internally
  3. Hash the backup and use the hash as the decryption key
  4. Use the same publicly shared key for encryption and authentication

Answer: A. Encrypt the backup with a symmetric key and protect that key using the partner's public key

Symmetric encryption is efficient for bulk data, while public-key encryption can protect the symmetric key for the intended recipient. Publishing a private key would defeat its security.

3. An employee receives an urgent invoice link from an address that differs from a supplier's real domain by one character. The login page also requests the employee's password and MFA code. Which threat is most directly indicated?
  1. A watering-hole attack
  2. A denial-of-service attack
  3. A credential-harvesting phishing attack
  4. A privilege-escalation exploit

Answer: C. A credential-harvesting phishing attack

The lookalike sender and fraudulent sign-in page are indicators of phishing intended to steal credentials and MFA codes. A denial-of-service attack targets availability rather than collecting a user's secrets.

4. A company wants to reduce the chance that ransomware encrypts both production data and its recoverable backups. Which backup design provides the strongest protection against an attacker who gains domain administrator access?
  1. Keep all backups in a writable folder on the production file server
  2. Use isolated or immutable backups with separate access controls and regularly test restoration
  3. Synchronize the production files continuously to another domain-joined server with the same administrator account
  4. Retain one backup copy on a user workstation that is always online

Answer: B. Use isolated or immutable backups with separate access controls and regularly test restoration

Isolation or immutability and separate credentials make it harder for a compromised production administrator to alter backup copies; restore testing checks recoverability. Continuously writable, commonly administered replicas can be encrypted along with production.

5. A vulnerability scanner finds two unpatched systems. System X has a high published severity but is isolated from the network and has no known exploit activity; System Y has a lower severity rating, is internet-facing, and is being actively exploited. Which should the team generally prioritize for immediate remediation?
  1. System X, because the published severity rating alone determines priority
  2. System X, because isolated systems are more exposed to external threats
  3. Neither until the next annual risk review
  4. System Y, because active exploitation and exposure increase its risk

Answer: D. System Y, because active exploitation and exposure increase its risk

Risk-based vulnerability prioritization considers exploit activity, exposure, and potential impact in addition to severity ratings. System Y's active exploitation and internet exposure make it the more urgent target for remediation.

More CompTIA Security+ years

2026202520242022

All CompTIA Security+ years · CompTIA subjects

PassSpark questions are original practice questions written to each exam's syllabus and format, in the style of past questions. They are not official past papers and are not affiliated with JAMB, WAEC, NECO, any university or any exam body.