PassSpark

CompTIA Security+ 2026 past questions and answers

This 2026 CompTIA Security+ set has 20 practice questions. Try these 5 free sample questions, tap a question to reveal the answer and explanation. Then practise the whole 2026 set with instant marking.

Practise the full 2026 setTimed exam mode

Sample CompTIA Security+ 2026 questions

1. A company is adopting a Zero Trust model for its internal applications. Which change best reflects this model?
  1. Trust all traffic that originates from the corporate network
  2. Verify each access request using identity, device, and context, and grant only the required access
  3. Allow users to retain access after authentication for the entire workday
  4. Replace endpoint controls with a perimeter firewall

Answer: B. Verify each access request using identity, device, and context, and grant only the required access

Zero Trust treats each access request as untrusted until verified and applies least privilege. Network location alone does not establish trust.

2. A finance director receives an email that uses their name, references an actual pending acquisition, and urges them to open a disguised invoice. Which attack type is most specifically indicated?
  1. Spear phishing
  2. Vishing
  3. Smishing
  4. Watering-hole attack

Answer: A. Spear phishing

The message is tailored to a particular person and context, which is spear phishing. Vishing uses voice, smishing uses SMS, and a watering-hole attack compromises a site frequented by targets.

3. A web application builds a database query by concatenating a search field directly into SQL. Which change most directly mitigates SQL injection in this design?
  1. Encode the results before displaying them in the browser
  2. Move the database to a different network segment
  3. Use parameterized queries so user input is treated as data
  4. Increase the database account's password length

Answer: C. Use parameterized queries so user input is treated as data

Parameterized queries separate SQL instructions from supplied values, directly preventing input from changing query structure. Output encoding and segmentation can help elsewhere but do not fix unsafe query construction.

4. A company runs a workload on an infrastructure-as-a-service virtual machine. Which task is generally the customer's responsibility under the shared-responsibility model?
  1. Securing the cloud provider's physical data-center doors
  2. Patching the guest operating system on the virtual machine
  3. Replacing failed physical disks in the provider's storage array
  4. Maintaining the provider's hypervisor code

Answer: B. Patching the guest operating system on the virtual machine

For IaaS, the customer generally manages and patches the guest operating system and its applications. The provider is responsible for the physical facilities, hardware, and underlying virtualization infrastructure.

5. A database backup is stored on portable media that could be lost outside the office. Which control most directly protects the confidentiality of the data if the media is lost?
  1. A hash of the backup file stored on the same media
  2. A longer retention period for the backup
  3. A digital signature on the backup catalog
  4. Encryption of the backup at rest with protected key management

Answer: D. Encryption of the backup at rest with protected key management

Encryption at rest can prevent an unauthorized holder of the media from reading its contents, provided keys are protected separately. A hash or signature can help detect alteration but does not conceal the data.

More CompTIA Security+ years

2025202420232022

All CompTIA Security+ years · CompTIA subjects

PassSpark questions are original practice questions written to each exam's syllabus and format, in the style of past questions. They are not official past papers and are not affiliated with JAMB, WAEC, NECO, any university or any exam body.