Security+ General Security Concepts: 287 practice questions

12 of the 287 General Security Concepts questions in the Certsqill Security+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Security+? Take the free 5-min readiness check →

1. Encrypt customer records on storage systems: Which TWO controls are technical controls?

Select two. More than one option is correct — every correct one is ticked below.

1. Train operators to follow handling procedures

   Operator training is an operational control because personnel perform the activity according to established procedures.
2. Require quarterly risk reviews by executives

   Executive risk reviews are managerial controls because leadership directs oversight rather than technology enforcing the protection directly.
3. Install badge readers at the data center entrance

   Badge readers are physical controls because they regulate entry into a facility or restricted room.
4. Encrypt customer records on storage systems ✓

   Storage encryption is a technical control that uses technology to protect data confidentiality when records reside on devices.
5. Segment customer systems with firewall rules ✓

   Firewall segmentation is a technical control because technology enforces network boundaries between systems and limits permitted communications.

Technical controls use technology to enforce protection, while managerial, operational, and physical controls rely on governance, people, or facility mechanisms.

2. Issue a charter assigning risk acceptance authority: Which control is managerial?

1. Use a daily checklist for site supervisors

   A supervisor checklist is an operational control because personnel use it to perform recurring work consistently.
2. Install locks on temporary equipment cabinets

   Cabinet locks are physical controls because they restrict direct access to equipment through a facility mechanism.
3. Issue a charter assigning risk acceptance authority ✓

   A leadership-approved charter is managerial because it establishes governance, accountability, and authority for risk decisions.
4. Deploy multifactor authentication for project portals

   Multifactor authentication is a technical control that verifies users through technology before granting portal access.

Managerial controls establish governance, accountability, and risk direction; they do not directly enforce access or perform routine work.

3. Require documented change procedures for technicians: Which TWO controls are operational?

Select two. More than one option is correct — every correct one is ticked below.

1. Restrict the control room with keyed locks

   Keyed locks are physical controls because they limit entry to a protected facility area.
2. Require documented change procedures for technicians ✓

   Technician procedures direct recurring human work during maintenance, so they are operational controls.
3. Configure alerts for unusual control-system traffic

   Traffic alerts are technical detective controls because systems identify activity and generate notifications automatically.
4. Approve an enterprise security policy

   An enterprise security policy is a directive managerial control that establishes organizational expectations and authority.
5. Maintain an incident-response runbook ✓

   A runbook guides personnel through repeatable response activities, making it an operational control.

Operational controls depend on people and procedures to perform recurring security activities, unlike technical, managerial, or physical mechanisms.

4. Install a badge-controlled door with a secured frame: Which control is physical?

1. Install a badge-controlled door with a secured frame ✓

   A badge-controlled door and secured frame physically restrict entry to the protected room.
2. Apply network access rules to instrument servers

   Network access rules are technical controls that restrict digital communications, not physical entry into the instrument room.
3. Require annual security awareness training

   Security awareness training is an operational control that changes personnel behavior through instruction.
4. Review camera footage for suspicious activity

   Reviewing footage is primarily a detective activity because personnel examine evidence after or during events.

Physical controls protect facilities or equipment directly through barriers, locks, entry systems, and other tangible mechanisms.

5. Block unauthorized USB storage devices: Which control most directly provides a preventive purpose before copyi

1. Block unauthorized USB storage devices ✓

   Device blocking prevents the risky action before data can be copied to unauthorized removable media.
2. Display a warning about removable-media monitoring

   A warning may deter users by influencing behavior, but it does not directly block the copying action.
3. Restore files from a clean backup

   Restoring files is corrective because it recovers from damage or loss after an adverse event.
4. Alert analysts after large transfers occur

   Post-transfer alerts detect suspicious activity after it occurs rather than preventing the transfer beforehand.

Preventive controls stop or restrict an unwanted event before it occurs, making device blocking the direct response to unauthorized copying.

6. Deploy a tuned SIEM correlation rule: Which control fits?

1. Deploy a tuned SIEM correlation rule ✓

   A SIEM correlation rule analyzes events and alerts analysts about patterns requiring investigation, making it detective.
2. Enforce multifactor authentication for agents

   Multifactor authentication prevents many unauthorized logins by requiring additional verification before access is granted.
3. Post a notice stating that accounts are monitored

   A monitoring notice primarily deters misuse by influencing behavior, although it may support transparency.
4. Restore affected workstations from trusted images

   Restoring workstations is corrective because it returns systems to a usable state after compromise or damage.

Detective controls identify events or conditions and notify responsible personnel, enabling investigation rather than directly preventing or repairing them.

7. Display prominent signs announcing monitored premises: Which control is best?

1. Require a locked reception entrance

   A locked entrance restricts access, so its primary purpose is prevention rather than discouragement.
2. Review access logs each morning

   Reviewing logs detects prior entry activity rather than discouraging an attempt before it occurs.
3. Display prominent signs announcing monitored premises ✓

   Visible warning signs communicate observation and possible consequences, primarily discouraging unauthorized attempts.
4. Install cameras monitored continuously by security staff

   Continuous camera review primarily detects and documents activity, although visible cameras may also deter.

Deterrent controls discourage unwanted behavior by signaling observation, consequences, or resistance before an event occurs.

8. Rebuild systems from the verified backup: Which control most directly restores affected services?

1. Add redundancy to the storage cluster

   Storage redundancy primarily prevents or reduces future outages rather than restoring the already affected service.
2. Rebuild systems from the verified backup ✓

   Rebuilding from a verified backup restores systems after disruption, making this a corrective control.
3. Publish a policy requiring backup reviews

   A backup review policy is directive and managerial; it establishes expectations rather than performing restoration.
4. Alert administrators when storage errors appear

   Storage alerts are detective controls that identify errors but do not restore affected services.

Corrective controls repair, restore, or otherwise return systems to operation after an incident or failure has occurred.

9. Require access through a monitored privileged gateway: Which control is compensating?

1. Create another backup of circulation records

   Additional backups support availability and recovery but do not compensate for missing authentication protection.
2. Replace the legacy application immediately

   Replacing the application implements the preferred capability rather than compensating for an unavoidable control limitation.
3. Publish a policy requiring stronger passwords

   A password policy directs behavior but does not provide comparable layered access protection by itself.
4. Require access through a monitored privileged gateway ✓

   A monitored gateway substitutes controlled, observable access for unavailable application MFA, satisfying the need through another mechanism.

A compensating control provides an alternative way to meet the security objective when the preferred control cannot be implemented.

10. Publish a remote-access acceptable-use policy: Which TWO are directive controls?

Select two. More than one option is correct — every correct one is ticked below.

1. Publish a remote-access acceptable-use policy ✓

   A remote-access policy directs how personnel may use remote connections and defines required behavior.
2. Install cameras at network operations entrances

   Entrance cameras are physical detective controls that monitor facility activity rather than direct information-handling behavior.
3. Train staff on approved remote-access procedures

   Training is an operational activity that helps personnel perform expected procedures but is not itself the directive.
4. Configure data-loss prevention blocking rules

   Data-loss prevention rules are technical preventive controls because systems enforce restrictions on data movement.
5. Issue a customer-data handling policy ✓

   A data-handling policy directs employee behavior and establishes mandatory organizational expectations for protecting customer information.

Directive controls establish required behavior through policies, standards, or similar authoritative instructions rather than direct technical enforcement.

11. Review recorded camera footage after reported unauthorized: Which control use most directly meets that objecti

1. Review recorded camera footage after reported unauthorized entry. ✓

   Reviewing recorded footage directly supports identifying unauthorized entry after the event, making the camera detective in purpose.
2. Post camera-warning signs at each entrance.

   Signs may discourage entry, but they do not provide evidence identifying who entered after an incident.
3. Require researchers to display identification badges.

   Badges support authorization decisions, but they do not independently record or identify an unauthorized physical entry.
4. Assign guards to watch entrance activity periodically.

   Periodic observation may detect activity, but inconsistent coverage can miss unauthorized entry between patrols.

Recorded footage reviewed after an event directly supports detection and investigation, whereas signs and badges address different security needs.

12. Technical: Which category should be recorded?

1. Managerial

   Managerial controls govern security through leadership decisions, risk direction, and oversight rather than automated processing.
2. Physical

   Physical controls protect facilities or tangible assets, while ticket routing operates through software and system logic.
3. Operational

   Operational controls rely on people and procedures, while this rule executes automatically within an information system.
4. Technical ✓

   An automated software rule is implemented through technology, so its category is technical even when supporting operations.

Because software automatically performs the routing decision, the control is technical regardless of the department using it.

Other Security+ domains

• Security Operations — 672 questions →
• Threats, Vulnerabilities, and Mitigations — 527 questions →
• Security Program Management and Oversight — 480 questions →
• Security Architecture — 432 questions →
• All 2398 Security+ questions →
• Security+ certification: requirements, cost and exam format →