PassSpark

CompTIA Security+ 2024 past questions and answers

This 2024 CompTIA Security+ set has 20 practice questions. Try these 5 free sample questions, tap a question to reveal the answer and explanation. Then practise the whole 2024 set with instant marking.

Practise the full 2024 setTimed exam mode

Sample CompTIA Security+ 2024 questions

1. A security analyst needs to determine whether a file was altered while being transferred to a partner. Which security objective is the analyst primarily protecting?
  1. Confidentiality
  2. Availability
  3. Integrity
  4. Non-repudiation

Answer: C. Integrity

Integrity addresses whether information has been changed without authorization. Confidentiality would prevent unauthorized disclosure, but it does not by itself detect alteration.

2. A finance director receives a convincing email tailored to a pending acquisition. It asks the director to open an attached invoice that installs malware. Which attack technique best describes the email?
  1. Spear phishing
  2. Wardriving
  3. Tailgating
  4. Brute-force attack

Answer: A. Spear phishing

Spear phishing is a targeted social-engineering message tailored to a particular person or organization. Wardriving searches for wireless networks and does not describe a targeted email.

3. A web application builds a database query by concatenating a visitor's unvalidated search text into the SQL statement. An attacker enters crafted text that changes the query logic. Which vulnerability is being exploited?
  1. Cross-site request forgery
  2. Integer overflow
  3. Directory traversal
  4. SQL injection

Answer: D. SQL injection

Untrusted input changing the meaning of a database query is SQL injection; parameterized queries are a key mitigation. Directory traversal targets file paths rather than SQL query logic.

4. A security team wants to identify and rank known weaknesses across its servers without attempting to exploit them. Which activity best fits this objective?
  1. A penetration test that exploits selected findings
  2. A vulnerability scan followed by risk-based prioritization
  3. A tabletop exercise for incident responders
  4. A disaster recovery test of backup restoration

Answer: B. A vulnerability scan followed by risk-based prioritization

Vulnerability scanning identifies known weaknesses and supports prioritization without requiring exploitation. A penetration test actively attempts to exploit weaknesses, which is beyond the stated goal.

5. A company adopts a zero-trust approach for employee access to internal applications. Which design choice best reflects this approach?
  1. Evaluate each access request using identity and context, then grant only the required access
  2. Trust every device automatically once it connects to the corporate network
  3. Allow broad access after a user passes one perimeter VPN check
  4. Disable authentication for services on internal network segments

Answer: A. Evaluate each access request using identity and context, then grant only the required access

Zero trust removes implicit trust and evaluates access requests with least privilege and relevant context. A perimeter VPN check followed by broad access relies on the implicit trust model zero trust is designed to reduce.

More CompTIA Security+ years

2026202520232022

All CompTIA Security+ years · CompTIA subjects

PassSpark questions are original practice questions written to each exam's syllabus and format, in the style of past questions. They are not official past papers and are not affiliated with JAMB, WAEC, NECO, any university or any exam body.