CompTIA Security+ Practice Test of the Day 260215

Welcome to today’s CompTIA Security+ practice test!

This practice test uses our new UI!

Today’s practice test is based on subdomain 4.2 (Explain the security implications of proper hardware, software, and data asset management.) from the CompTIA Security+ SY0-701 objectives.

This beginner-level practice test is inspired by the CompTIA Security+ (SY0-701) exam and is designed to help you reinforce key cybersecurity concepts on a daily basis.

These questions are not official exam questions, nor are they brain dumps, but they reflect topics and scenarios relevant to the Security+ certification. Use them to test your knowledge, identify areas for improvement, and build daily cybersecurity habits.

Note: CompTIA and Security+ are registered trademarks of CompTIA. This content is not affiliated with or endorsed by CompTIA.

To choose CompTIA Security+ practice tests based on specific domains/subdomains, click that link.

CompTIA Security+ Practice Test of the Day 260215

10 questions • Single best answer

Question 1

A security administrator at a mid-sized company discovers that several laptops containing regulated financial data were recently reassigned to new employees without being properly documented in the asset inventory system. During an internal audit, it was found that ownership records were outdated and device classification labels were missing. The organization operates in a hybrid work environment where employees frequently move between remote and onsite work. Which of the following is the MOST significant security risk associated with this situation?

A. Increased risk of malware infection due to improper patching B. Inability to enforce multifactor authentication policies C. Loss of accountability and inability to track sensitive data exposure D. Reduced wireless network performance due to device misconfiguration

Question 2

A security administrator at a mid-sized healthcare company is reviewing asset records and discovers that several database servers storing protected health information (PHI) are not properly labeled according to the organization’s data classification policy. These servers are included in backups but are not marked as “restricted” in the asset management system. The organization must comply with strict data retention and privacy regulations. Which of the following is the MOST significant impact of failing to properly classify these assets?

A. Increased likelihood of distributed denial-of-service (DDoS) attacks B. Inaccurate enforcement of security controls based on data sensitivity C. Reduced system availability during patch cycles D. Inability to implement multifactor authentication for administrators

Question 3

An analyst in a SOC observes that multiple unauthorized virtual machines have appeared in the organization’s cloud environment. Further investigation reveals that the assets were provisioned outside of the formal acquisition and accounting process. These systems are not included in vulnerability scans or asset tracking reports. Which of the following asset management failures MOST likely led to this issue?

A. Improper configuration enforcement of firewall rules B. Lack of monitoring and inventory enumeration controls C. Failure to implement secure coding practices D. Absence of network segmentation within the data center

Question 4

A mid-sized enterprise is undergoing a merger and must integrate hardware and software assets from another company. During the transition, duplicate devices, unsupported operating systems, and unclassified data repositories are identified. The acquiring company must quickly assess risk exposure while maintaining operational continuity. Which of the following actions should be performed FIRST to reduce security risk?

A. Immediately decommission all legacy systems B. Conduct a comprehensive asset inventory and classification review C. Deploy endpoint detection and response (EDR) agents to all systems D. Migrate all systems to a centralized identity provider

Question 5

Your organization is implementing a new asset procurement process for servers that will store confidential intellectual property. The security team wants to ensure that systems are tracked from acquisition through retirement and that data cannot be reconstructed after disposal. The company operates under strict regulatory requirements regarding data retention and destruction. Which of the following controls should be implemented to BEST address end-of-life security concerns?

A. Perform full-disk encryption and redeploy systems internally B. Use data sanitization methods followed by certification of destruction C. Reimage systems and donate them to a third-party vendor D. Remove user accounts and disable network access before resale

Question 6

Your organization maintains a centralized configuration management database (CMDB) to track hardware and software assets across on-premises and cloud environments. During an audit, it is discovered that multiple software licenses are installed on systems that are not documented in the inventory. Additionally, some retired servers are still listed as active assets. Which of the following risks is MOST directly associated with this situation?

A. Failure to meet non-repudiation requirements B. Increased exposure to unsupported and unpatched systems C. Weakness in symmetric encryption algorithms D. Inability to implement network segmentation policies

Question 7

An organization is preparing to decommission several solid-state drives (SSDs) that previously stored confidential intellectual property. The drives will be removed from production servers located in a geographically dispersed data center. Management wants assurance that no sensitive data can be reconstructed after disposal. Which of the following methods provides the MOST effective protection against data recovery in this scenario?

A. Logical deletion of files followed by standard formatting B. Cryptographic erasure using strong key destruction C. Removal of access control lists and system accounts D. Transferring the drives to cold storage for archival

Question 8

An analyst in a SOC observes unusual outbound traffic from a legacy application server that was scheduled for retirement six months ago. The asset appears in network logs but is not listed in the current asset inventory. Further investigation reveals that the server was never formally decommissioned due to an oversight in the change management process. Which of the following BEST explains the security implication of this oversight?

A. The organization has failed to implement adequate encryption for data in transit B. The server represents shadow IT that may bypass monitoring and patch management controls C. The system likely violates least privilege access policies D. The legacy system automatically enforces compensating controls

Question 9

A security administrator at a mid-sized financial services company is reviewing the organization’s asset lifecycle documentation. During the review, it is discovered that several mobile devices issued under a BYOD program were never formally registered in the asset inventory system. These devices have access to internal email, file-sharing platforms, and customer financial records. The company requires strict accountability and tracking of devices that store or process regulated data. Which of the following is the MOST significant security concern related to this oversight?

A. The devices may not support the latest wireless encryption standards B. The organization cannot properly enforce monitoring and data retention policies C. The devices are more susceptible to distributed denial-of-service (DDoS) attacks D. The organization will experience reduced network throughput

Question 10

Your company is conducting a quarterly audit of its data retention policies. During the review, the audit team finds that backup tapes containing confidential legal records were retained beyond their approved retention period. The tapes are stored offsite, but there is no documentation indicating review or destruction approval. The organization operates in a highly regulated industry with strict privacy requirements. Which of the following BEST describes the primary security implication of this finding?

A. Increased risk of data exposure due to failure in data retention governance B. Misconfiguration of endpoint detection and response (EDR) policies C. Failure to implement secure network segmentation D. Weakness in multifactor authentication enforcement

Take more CompTIA Security+ practice tests

CompTIA Security+ Practice Test of the Day 260215

Related Posts