Security+ Domain 1 Practice Questions: General Security Concepts
40 free CompTIA Security+ SY0-701 practice questions for Domain 1, General Security Concepts, which is about 12% of the exam. Each question has the correct answer and a clear explanation. No account or signup needed.
Last updated August 2026
- Question 1
Encrypting a sensitive file so that only authorized people can read its contents primarily protects which part of the CIA triad?
- AIntegrity
- BConfidentiality
- CNon-repudiation
- DAvailability
Show answer and explanation
Correct answer: B. Confidentiality
Confidentiality means keeping information secret from unauthorized parties, which is exactly what encryption provides. Integrity is about preventing unauthorized changes, and availability is about access when needed.
- Question 2
A written policy that requires all employees to complete annual security awareness training is an example of which category of control?
- AOperational
- BTechnical
- CPhysical
- DManagerial
Show answer and explanation
Correct answer: D. Managerial
Managerial (administrative) controls are policies, procedures, and governance such as training requirements and risk assessments. Technical controls are enforced by technology, physical controls protect facilities, and operational controls are processes people perform.
- Question 3
A sign reading "Warning: 24-hour video surveillance" is posted at an entrance. Which control function does the sign itself perform?
- ACorrective
- BDeterrent
- CCompensating
- DRecovery
Show answer and explanation
Correct answer: B. Deterrent
A deterrent control discourages an attacker from acting. The sign does not detect or stop entry by itself; it simply discourages bad behavior. The camera that records would be detective.
- Question 4
A required patch cannot be installed right away, so the team temporarily adds strict firewall rules to limit exposure until it can. The firewall rules are acting as which type of control?
- ADetective
- BCompensating
- CDeterrent
- DDirective
Show answer and explanation
Correct answer: B. Compensating
A compensating control is an alternative measure used when the primary control is not feasible. The firewall rules compensate for the missing patch. They are not merely discouraging or detecting anything.
- Question 5
What does a digital certificate primarily bind together?
- AA username and a password
- BAn IP address and a MAC address
- CA public key and a verified identity
- DTwo symmetric session keys
Show answer and explanation
Correct answer: C. A public key and a verified identity
A digital certificate binds a public key to a verified identity, signed by a certificate authority so others can trust it. It does not store passwords or pair symmetric keys.
- Question 6
A system only allows logins when the device is physically connected inside the corporate office network. Which authentication factor is being used?
- ASomething you have
- BSomething you are
- CSomething you know
- DSomewhere you are
Show answer and explanation
Correct answer: D. Somewhere you are
Location-based authentication is the "somewhere you are" factor. Something you know is a secret like a password, something you have is a token, and something you are is a biometric.
- Question 7
What is the primary purpose of a formal change management process?
- ATo encrypt data while it is being transmitted
- BTo detect malware on endpoints
- CTo review, approve, test, and document changes so they do not cause outages or security gaps
- DTo recover systems after a disaster
Show answer and explanation
Correct answer: C. To review, approve, test, and document changes so they do not cause outages or security gaps
Change management ensures changes are reviewed, approved, tested, and documented so they do not introduce instability or vulnerabilities. The other options describe encryption, antimalware, and disaster recovery.
- Question 8
Hiding a secret message inside an ordinary-looking image file so its very existence is concealed is an example of?
- ATokenization
- BHashing
- CSteganography
- DKey stretching
Show answer and explanation
Correct answer: C. Steganography
Steganography conceals the existence of a message by embedding it within other data, such as an image. Hashing produces a fingerprint, tokenization substitutes a surrogate value, and key stretching strengthens keys derived from passwords.
- Question 9
A payment platform replaces each stored credit card number with a random surrogate value that has no mathematical relationship to the original. What is this technique?
- AEncryption
- BTokenization
- CSteganography
- DHashing
Show answer and explanation
Correct answer: B. Tokenization
Tokenization swaps sensitive data for a non-sensitive token with no algorithmic link to the original, so a stolen token is useless. Encryption is reversible with a key, and hashing is a one-way digest.
- Question 10
Which method lets two parties securely agree on a shared secret key over an untrusted network without ever transmitting the key itself?
- ABase64 encoding
- BSHA-256 hashing
- CDiffie-Hellman key exchange
- DAES encryption
Show answer and explanation
Correct answer: C. Diffie-Hellman key exchange
Diffie-Hellman allows two parties to derive a shared secret over an open channel without sending the secret. SHA-256 is a hash, AES is symmetric encryption that needs a key already shared, and Base64 is encoding, not security.
- Question 11
An organization configures host-based firewalls on every workstation to block unsolicited inbound connections. Which category of security control is this?
- AOperational
- BManagerial
- CPhysical
- DTechnical
Show answer and explanation
Correct answer: D. Technical
Host-based firewalls are technology-enforced technical controls. Managerial controls are policies and governance, operational controls are human-driven processes, and physical controls protect facilities and hardware.
- Question 12
Security staff perform nightly review of privileged account activity as required by procedure. Which control category does this best represent?
- ATechnical
- BPhysical
- CCompensating
- DOperational
Show answer and explanation
Correct answer: D. Operational
Human-executed procedures such as log review are operational controls. Technical controls use systems to enforce security, physical controls secure premises, and compensating controls temporarily offset a missing primary control.
- Question 13
A company installs bollards in front of the data center loading dock to stop vehicles from ramming the building. Which control function is this primarily?
- ADirective
- BDetective
- CCorrective
- DPreventive
Show answer and explanation
Correct answer: D. Preventive
Bollards stop an attack before damage occurs, so they are preventive. Detective controls identify events after or during occurrence, corrective controls restore after an incident, and directive controls guide required behavior.
- Question 14
After malware is removed, administrators restore clean system images and reapply baselines. Which control function best describes this work?
- ADirective
- BDeterrent
- CPreventive
- DCorrective
Show answer and explanation
Correct answer: D. Corrective
Restoring systems after an incident is corrective. Deterrent controls discourage attacks, preventive controls stop them beforehand, and directive controls set rules without themselves remediating damage.
- Question 15
A policy states that removable media is prohibited on production servers. Which control function does the written rule itself primarily serve?
- ADirective
- BDetective
- CRecovery
- DCompensating
Show answer and explanation
Correct answer: A. Directive
A written rule that tells people what they must do is directive. Detective controls discover violations, compensating controls substitute for unavailable primary controls, and recovery controls restore operations after disruption.
- Question 16
An IDS generates an alert when it observes known exploit traffic patterns on a segment. Which control function is the IDS primarily providing?
- APreventive
- BDetective
- CDeterrent
- DPhysical
Show answer and explanation
Correct answer: B. Detective
An IDS identifies suspicious activity and alerts, which is detective. It does not block by default like a preventive control, does not merely discourage like a deterrent, and is not a physical facility control.
- Question 17
A badge reader denies entry when a card is presented outside authorized hours. Which category and function combination best fits this control?
- ATechnical detective
- BOperational corrective
- CManagerial deterrent
- DPhysical preventive
Show answer and explanation
Correct answer: D. Physical preventive
A door badge system is a physical control that blocks unauthorized entry, so it is preventive. It is not primarily detective, managerial, or corrective, and it is not only a human procedure.
- Question 18
Management requires encryption for all laptops, and IT enforces it with endpoint management software. The software enforcement is which type of control?
- AManagerial
- BDirective
- CTechnical
- DPhysical
Show answer and explanation
Correct answer: C. Technical
Endpoint management that applies encryption is a technical control. The policy requirement is managerial or directive, physical controls protect facilities, and directive alone describes the rule rather than the enforcement technology.
- Question 19
A user proves identity with a smart card, then the system checks whether that user may open a finance application. What is the second step?
- AAuthentication
- BAttestation
- CAccounting
- DAuthorization
Show answer and explanation
Correct answer: D. Authorization
Checking permissions after identity is proven is authorization. Authentication is proving identity, accounting is recording activity, and attestation is asserting device or software state, not granting app rights.
- Question 20
A security design assumes no user or device is trusted by default, even on the internal LAN, and every access request is verified. Which concept is this?
- ALeast privilege
- BDefense in depth
- CNeed to know
- DZero trust
Show answer and explanation
Correct answer: D. Zero trust
Zero trust continuously verifies identity and context instead of trusting the network location. Defense in depth layers controls, least privilege limits rights, and need to know limits data access based on job need.
- Question 21
Which AAA component records who accessed a resource, when it happened, and what actions were performed?
- AAuthorization
- BAccounting
- CAuthentication
- DFederation
Show answer and explanation
Correct answer: B. Accounting
Accounting tracks and logs usage for audit and investigation. Authentication verifies identity, authorization grants rights, and federation links identities across organizations rather than logging actions.
- Question 22
A digitally signed contract allows a sender to be uniquely tied to a message so they cannot later deny sending it. Which concept is demonstrated?
- AConfidentiality
- BAvailability
- CNon-repudiation
- DObfuscation
Show answer and explanation
Correct answer: C. Non-repudiation
Non-repudiation prevents credible denial of an action, often via digital signatures. Confidentiality hides content, availability keeps services usable, and obfuscation only makes code or data harder to read.
- Question 23
An analyst compares the current security program to a target framework and lists missing controls. What activity is this?
- APenetration test
- BTabletop exercise
- CGap analysis
- DThreat hunting
Show answer and explanation
Correct answer: C. Gap analysis
Gap analysis measures present state against a desired baseline and identifies shortfalls. Penetration tests exploit weaknesses, tabletops walk through response scenarios, and threat hunting searches for active adversaries.
- Question 24
Employees in accounts payable rotate duties every quarter so no one permanently owns the full payment process. Which practice is this?
- ASeparation of duties
- BMandatory vacation
- CJob rotation
- DLeast privilege
Show answer and explanation
Correct answer: C. Job rotation
Job rotation moves people through roles to reduce fraud and cross-train staff. Least privilege limits rights, mandatory vacation forces absence for audit, and separation of duties splits a task among people at once.
- Question 25
A researcher may view only project datasets assigned to their role, even though peers in the same department have other clearances. Which principle applies?
- ADefense in depth
- BNeed to know
- CZero trust
- DNon-repudiation
Show answer and explanation
Correct answer: B. Need to know
Need to know limits access to information required for a specific task, even among cleared staff. Defense in depth layers controls, zero trust continuously verifies requests, and non-repudiation proves origin of actions.
- Question 26
A login system accepts a hardware security key in addition to a PIN. Which authentication factor does the security key represent?
- ASomething you are
- BSomething you know
- CSomething you do
- DSomething you have
Show answer and explanation
Correct answer: D. Something you have
A physical security key is something you have. A PIN is something you know, biometrics are something you are, and something you do refers to behavioral patterns such as gait or keystroke rhythm.
- Question 27
A biometric door system incorrectly unlocks for a person who is not enrolled. Which metric describes this failure?
- AFalse acceptance rate
- BMean time to failure
- CCrossover error rate
- DFalse rejection rate
Show answer and explanation
Correct answer: A. False acceptance rate
False acceptance rate measures unauthorized people wrongly accepted. False rejection rate measures legitimate users wrongly denied, crossover error rate is where those rates meet, and mean time to failure is a reliability metric.
- Question 28
Before a firewall rule change goes live, the team documents how to reverse it if connectivity breaks. What is that documented plan called?
- ABackout plan
- BService level agreement
- CRisk register
- DBusiness impact analysis
Show answer and explanation
Correct answer: A. Backout plan
A backout plan defines how to undo a failed change. A BIA studies disruption impact, a risk register tracks risks, and an SLA defines service expectations between parties.
- Question 29
A change board reviews a proposed database upgrade for downtime, dependency risk, and security effects before approval. What is this review mainly providing?
- AImpact analysis
- BVulnerability scanning
- CIncident containment
- DCertificate pinning
Show answer and explanation
Correct answer: A. Impact analysis
Evaluating effects of a proposed change is impact analysis within change management. Vulnerability scanning finds weaknesses, containment is incident response, and certificate pinning is a TLS trust technique.
- Question 30
IT schedules high-risk infrastructure changes for a two-hour window on Saturday night when few users are online. What practice is this?
- AShadow IT approval
- BWarm site failover
- CContinuous deployment only
- DUsing a maintenance window
Show answer and explanation
Correct answer: D. Using a maintenance window
A maintenance window is a planned period for disruptive work. Shadow IT is unauthorized systems, continuous deployment is a release method, and warm site failover is disaster recovery capacity.
- Question 31
After a successful application update, the team revises runbooks and network diagrams to match the new design. Which change management activity is this?
- APerforming threat modeling only
- BIssuing a digital certificate
- CCreating a honeypot
- DUpdating documentation
Show answer and explanation
Correct answer: D. Updating documentation
Keeping diagrams and procedures current after a change is documentation update. Honeypots are decoys, threat modeling analyzes threats, and certificates establish cryptographic identity.
- Question 32
A proposed OS upgrade is first installed on a non-production clone of the server for validation. Which change practice is being followed?
- AAir-gapped key escrow
- BTesting in a staging environment
- CProduction hot patching only
- DImmediate full cutover
Show answer and explanation
Correct answer: B. Testing in a staging environment
Validating changes in staging reduces production risk. Hot patching only in production skips that safety step, full cutover without testing is riskier, and key escrow is a cryptographic recovery practice.
- Question 33
Two internal servers encrypt bulk file transfers with a shared secret key used for both encryption and decryption. Which cryptography type is this?
- AAsymmetric
- BSteganographic
- CSymmetric
- DHash-only
Show answer and explanation
Correct answer: C. Symmetric
The same key for encrypt and decrypt is symmetric cryptography. Asymmetric uses key pairs, steganography hides existence of data, and hashing is one-way integrity checking without reversible encryption.
- Question 34
An administrator downloads a vendor ISO and compares its published SHA-256 value to a hash of the local file. What property is being verified?
- AIntegrity
- BConfidentiality
- CAvailability
- DNon-repudiation only
Show answer and explanation
Correct answer: A. Integrity
Matching hashes shows the file was not altered, which is integrity. Confidentiality would require encryption secrecy, non-repudiation needs proof of origin such as signatures, and availability concerns uptime.
- Question 35
A software publisher signs application packages so customers can verify the publisher and detect tampering. Which cryptographic mechanism enables this?
- ATokenization
- BStream cipher alone
- CDigital signature
- DSalting
Show answer and explanation
Correct answer: C. Digital signature
Digital signatures use private-key signing and public-key verification for authenticity and integrity. Stream ciphers encrypt, salting hardens password hashes, and tokenization replaces sensitive values with surrogates.
- Question 36
A bank stores private keys for certificate signing inside a dedicated appliance that resists extraction and logs key use. What is this appliance?
- AJump server
- BContent filter
- CHardware security module
- DLoad balancer
Show answer and explanation
Correct answer: C. Hardware security module
An HSM protects and uses cryptographic keys in hardened hardware. Jump servers broker admin access, load balancers distribute traffic, and content filters inspect web or email content.
- Question 37
A laptop uses a chip on the motherboard to store disk encryption keys and measure boot components. Which technology is this describing?
- ANext-generation firewall
- BSIEM connector
- CWeb application firewall
- DTrusted Platform Module
Show answer and explanation
Correct answer: D. Trusted Platform Module
A TPM is a hardware root of trust for keys and measured boot. NGFWs filter network traffic, SIEM connectors feed logs, and WAFs protect web applications.
- Question 38
An organization stores copies of employee encryption keys with a trusted third party so data can be recovered if keys are lost. What practice is this?
- APerfect forward secrecy
- BKey stretching
- CCertificate stapling
- DKey escrow
Show answer and explanation
Correct answer: D. Key escrow
Key escrow keeps recovery copies of keys with a trusted party. Key stretching slows password cracking, PFS limits damage from long-term key theft, and stapling delivers revocation status with TLS handshakes.
- Question 39
A password storage scheme runs many slow iterations of a hash function to make offline guessing expensive. Which technique is this?
- AKey stretching
- BKey escrow
- CSteganography
- DSymmetric tunneling
Show answer and explanation
Correct answer: A. Key stretching
Key stretching intentionally slows hashing so brute-force attempts cost more time. Key escrow is recovery storage, steganography hides messages, and symmetric tunneling encrypts network paths.
- Question 40
Developers deploy an internal tool with a certificate they generated themselves, not issued by the corporate CA. What is the main security concern?
- ASymmetric algorithms become unusable
- BThe certificate cannot use HTTPS at all
- CHashing functions stop working
- DClients may not trust the certificate without manual exception
Show answer and explanation
Correct answer: D. Clients may not trust the certificate without manual exception
Self-signed certificates lack a trusted CA chain, so browsers and clients warn or block unless trust is added. They can still use TLS, and they do not disable symmetric crypto or hashing.
Master every domain
A free account opens all of Domain 1: a lesson, a hands-on lab and a graded question bank on every objective, plus a placement check and a dated plan. No card.
FAQ
Are these Security+ Domain 1 practice questions free?
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.How much of the Security+ exam is Domain 1?
Domain 1, General Security Concepts, accounts for about 12% of the CompTIA Security+ SY0-701 exam.
Practice another domain
Original practice questions aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.