NEW
Font size
WorksheetsCompTIA S+ Practice Questions (Information Security Governance)
Total questions: 30
Worksheet time: 15mins
What is the process of trying every possible key or password combination to break encryption or log in?
Phishing
Brute Force
SQL Injection
Denial of Service (DoS)
An attacker tricks a user into clicking a malicious link by pretending to be a bank or a reputable company in an email. What kind of attack is this?
Vishing
Phishing
Man-in-the-Middle
Birthday Attack
What is the term for malicious software that requires the user to pay a fee to regain access to their files?
Trojan
Spyware
Ransomware
Rootkit
Which type of attacker is typically non-skilled and uses tools created by others to launch attacks?
Script Kiddie
Insider Threat
Nation-State
Hacktivist
What is the primary goal of a Denial of Service (DoS) attack?
To steal sensitive data.
To make a service unavailable to its legitimate users.
To gain root access to a system.
To spread a virus to other networks.
The principle of Defense in Depth is best described by which concept?
Using only one very strong security control.
Implementing multiple layers of security controls.
Placing all servers in a Demilitarized Zone (DMZ).
Ensuring all users have the highest security clearance.
Which network zone is best suited for public-facing servers (like a web server) that need to be accessed from the internet?
Internal LAN
DMZ (Demilitarized Zone)
Extranet
Sandbox
What security principle dictates that a user should only have the permissions they absolutely need to perform their duties?
Separation of Duties
Least Privilege
Job Rotation
Implicit Deny
Which device is used to filter network traffic based on a set of defined rules (e.g., source/destination IP address and port)?
Router
Hub
Switch
Firewall
What is a key benefit of using hashing (e.g., SHA-256) for passwords?
It speeds up the login process.
It ensures the password can be easily decrypted if forgotten.
It verifies the integrity of the password without storing the original text.
It provides confidentiality for data in transit.
What is the most secure wireless encryption protocol currently recommended for new Wi-Fi networks?
WEP
WPA
WPA2
WPA3
To ensure that two people are required to complete a critical transaction (like approving a major financial transfer), an organization is implementing:
Job Rotation
Mandatory Vacation
Separation of Duties
Least Privilege
Which security method ensures that data cannot be altered without being detected?
Confidentiality
Integrity
Availability
Non-repudiation
What common VPN protocol uses IPsec for security and is often used for gateway-to-gateway (site-to-site) connections?
SSL/TLS
PPTP
L2TP
IKEv2
What cryptographic method uses two different keys (a public key and a private key)?
Symmetric Encryption
Hashing
Asymmetric Encryption (PKI)
Steganography
What is the final phase of the incident response process?
Containment
Eradication
Recovery
Lessons Learned
Which administrative control is an employee required to sign, stating they understand the proper and secure way to use company IT resources?
Change Management Policy
Data Classification Policy
Acceptable Use Policy (AUP)
Business Impact Analysis (BIA)
What is the process of minimizing the exposure of a system or network after a security incident has been detected?
Recovery
Eradication
Containment
Analysis
Which tool is used to centralize and analyze security alerts and log files from all devices on a network?
IDS/IPS
VPN Concentrator
SIEM
Data Loss Prevention (DLP)
A hot site is a type of alternate processing facility that provides:
Basic utilities but no equipment.
Equipment and data in a fully functional facility that can be operational in hours.
Equipment but no data.
A simple office space for personnel.
What term refers to the maximum length of time a system or service can be down before the organization suffers unacceptable business consequences?
Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time to Repair (MTTR)
Maximum Tolerable Downtime (MTD)
Which legal regulation governs the privacy and security of credit card data?
HIPAA
SOX
PCI DSS
GDPR
Which term is used for the risk that remains even after all security controls have been implemented?
Inherent Risk
Total Risk
Zero-Day Risk
Residual Risk
A formal group responsible for reviewing and approving all major changes to an organization's IT environment is called the:
Incident Response Team (IRT)
Change Advisory Board (CAB)
Security Operations Center (SOC)
Crisis Management Team (CMT)
In the context of the SDLC, what is a primary purpose of input validation during the coding phase?
To ensure the code is well-commented.
To prevent injection attacks from user input.
To speed up application deployment.
To track changes to the code base.
Which type of application security testing is performed while the application is running?
Static Analysis (SAST)
Dynamic Analysis (DAST)
Code Review
Fuzzing
A developer should always assume that any data coming from a user or external source is potentially malicious. This is the principle of:
Secure Defaults
Never Trust User Input
Least Functionality
Least Privilege
Which type of attack involves a malicious party modifying data in transit between two parties without either party knowing the data has been intercepted or changed?
Replay Attack
Man-in-the-Middle (MITM)
Privilege Escalation
Buffer Overflow
What is the process of assigning a sensitivity level (e.g., Public, Confidential, Secret) to an organization's data?
Data Retention
Data Encryption
Data Classification
Data Minimization
In a typical patch management process, what is the most important step immediately following patch testing but before deployment to production?
Reverting the changes.
Receiving authorization from the CAB.
Scanning the system for new vulnerabilities.
Installing the patch on a hot site.
