Free Core Security Concepts practice questions
10 free SY0-801 questions on Core Security Concepts, each with a full explanation — no account needed. This section sits in the Security Foundations part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A network administrator passed Security+ and wants to keep the certification active without sitting the exam again. Which statement about renewal is accurate?
Security+ is valid for three years from the day it is passed, and it renews by earning 50 continuing education units in that window and paying the renewal fee; earning a higher-level CompTIA certification such as CySA+ also renews it. It doesn't last for life or for five years, and retaking the exam is only needed if the certification is allowed to lapse.
The first item on a candidate's Security+ exam is a long performance-based simulation that she isn't sure how to approach. Which approach BEST uses her exam time?
CompTIA lists Security+ PBQs as simulations that save your work, so a widely used approach is to skim them, flag the long ones, answer the multiple-choice questions and come back with the time left. Simulations are scored, some can award partial credit, and Security+ simulations can be left and revisited, so skipping, rushing or treating one as a one-way door all cost points.
A candidate with two weeks left before the exam wants to prepare for performance-based questions. Which objectives should get the MOST hands-on practice?
Given-a-scenario objectives expect you to apply a concept, and they are the natural source of performance-based questions; on SY0-801 they include identity and access management, indicators of malicious activity and security awareness. Explain and summarize objectives are mostly tested with knowledge questions, and neither a domain's size nor an objective's position decides where PBQs come from.
A misconfigured cloud storage bucket lets anyone on the internet download a company's HR records. The files are unchanged and the HR system stays online. Which property was compromised?
The wrong people could read the records, which is disclosure and therefore a confidentiality failure. Nothing was altered, so integrity held, and the system stayed reachable, so availability held. Non-repudiation concerns proving who performed an action and isn't part of the triad.
A failing disk in a database server silently corrupts several rows in a product pricing table, and customers are charged the wrong amounts. No attacker was involved. Which property was affected?
Integrity means data is accurate and hasn't changed without authorization, and it covers accidental changes such as disk corruption as well as attacks. Availability is tempting because hardware failed, but the system stayed up and answered requests; the problem is that its data could no longer be trusted.
A company's public marketing website shows only product information that is already printed in its brochures. Which pair of properties should the site's security controls focus on?
The content is public, so keeping it secret hardly matters; what matters is that visitors can reach the site and that nobody can deface or alter it. Every pair that includes confidentiality spends protection on a property this site barely needs.
An administrator turns on full-disk encryption for every company laptop but doesn't keep copies of the recovery keys anywhere. Which property is MOST put at risk by this decision?
Encryption strengthens confidentiality, but if a key is lost, the data on that laptop becomes unreadable forever, which is an availability failure. That trade-off is why key escrow and recovery keys exist. Confidentiality is the tempting answer, but this design improves it rather than putting it at risk.
A software vendor posts each installer and its SHA-256 hash on the same download page. Attackers break into the web server and replace both the installer and the posted hash. Which control would still let customers detect the swap?
A hash only proves a file matches a published value, and an attacker who controls the site can change both; a digital signature closes that gap because only the vendor holds the private key that creates it. HTTPS protects the download in transit but faithfully delivers whatever the compromised server hosts, and switching hash algorithms leaves the same weakness.
A user types her employee email address into a sign-in page and hasn't yet entered her password. Which step has she completed?
Entering a username or email address is identification, a claim of identity that proves nothing on its own because anyone can type it. Authentication happens when she supplies evidence such as a password or an MFA approval, and authorization and accounting follow after that.
A company wants sign-in to its finance application to use true multifactor authentication. Which combination qualifies?
Multifactor authentication combines factors from different categories, and a smart card is something you have while a PIN is something you know. Every other pairing stays inside one category: passwords, PINs and security answers are all things you know, and a fingerprint and a face are both things you are.
Study this section
Every lesson that covers Core Security Concepts on the SY0-801 exam.