Security+ Security Operations: 528 practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

Security+ Security Operations: 528 practice questions

Security+ 528 questions 12 shown free

12 of the 528 Security Operations questions in the Certsqill Security+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Security+? Take the free 5-min readiness check →

1. Document tested secure settings for supported systems: Which control most directly establishes the required ba

Medium
A library is establishing a secure baseline for newly issued servers. The security lead has approved the baseline scope, but implementation has not begun. Which control most directly establishes the required baseline?
  1. Enable multifactor authentication for administrators.
    Multifactor authentication protects privileged access, but it does not define the server's complete secure configuration baseline.
  2. Deploy a web application firewall before production release.
    A web application firewall protects web traffic, but it does not establish host configuration requirements.
  3. Run static analysis against custom applications.
    Static analysis examines application code, but it does not establish operating-system settings or service configurations.
  4. Document tested secure settings for supported systems. ✓
    A documented, tested set of secure settings directly establishes the approved baseline for supported systems.
The trap
Confuses one access control with establishing a system-wide baseline. Applies an application-development assessment to infrastructure hardening. Selects a perimeter application control instead of defining the baseline.

A tested, documented set of secure settings establishes the configuration baseline that later deployments must follow.

2. Deploy the tested hardened image through change control: Which action best satisfies the deployment objective?

Medium
An engineering firm has validated a hardened server image in its test environment. The change board approved production deployment, and no production changes have yet occurred. Which action best satisfies the deployment objective?
  1. Scan production servers for application vulnerabilities first.
    Vulnerability scanning provides evidence, but it does not deploy the already tested configuration.
  2. Require developers to review every operating-system setting.
    Developer review may add insight, but it is not a controlled mechanism for deploying an approved server baseline.
  3. Place a web application firewall in front of each server.
    A web application firewall filters application traffic, but it does not deploy host hardening settings.
  4. Deploy the tested hardened image through change control. ✓
    Deploying the validated image through approved change control moves the tested baseline into production safely.
The trap
Confuses verification with the requested deployment action. Substitutes informal review for authorized configuration deployment. Uses a compensating application control for an infrastructure deployment need.

The tested hardened image should be deployed using the approved change process.

3. Disable the unused service after confirming dependencies: What should the administrator do first?

Medium
A municipal office is hardening a newly installed internal server. Inventory shows a legacy file-transfer service that no business process uses, and the service is currently enabled. What should the administrator do first?
  1. Perform static analysis of the office’s source code.
    Static analysis examines software code, but it does not address an enabled infrastructure service with no business purpose.
  2. Add multifactor authentication to every user account.
    Multifactor authentication improves identity assurance, but it does not remove exposure from an unnecessary listening service.
  3. Disable the unused service after confirming dependencies. ✓
    Disabling an unnecessary service reduces attack surface after confirming that no legitimate process depends on it.
  4. Place the server behind a web application firewall.
    A web application firewall may protect web traffic, but it does not directly disable an unrelated file-transfer service.
The trap
Treats stronger authentication as a substitute for reducing attack surface. Applies a web-specific control to a service-reduction requirement. Confuses application assurance with host service hardening.

An unused service should be disabled after dependency confirmation because removal directly reduces the server’s attack surface.

4. Limit each workstation to administration and approved: Which control most directly hardens these privileged wo

Easy
An insurance office uses dedicated administrator workstations for directory and security management. Administrators currently browse the internet and read email from those systems. Which control most directly hardens these privileged workstations?
  1. Use standard accounts for routine daily activity.
    Standard accounts reduce routine privilege, but they do not isolate privileged administration from browsing and email exposure.
  2. Limit each workstation to administration and approved management tools. ✓
    Restricting these systems to administrative functions removes unnecessary browsing and email exposure from privileged sessions.
  3. Place an additional firewall between workstations and directory servers.
    Network filtering can limit connections, but it does not stop users from browsing or reading email on privileged systems.
  4. Install endpoint detection and response software on each workstation.
    Endpoint detection improves visibility and response, but it does not prevent risky general-purpose activity on privileged systems.
The trap
Provides least privilege without addressing workstation separation. Selects monitoring instead of reducing privileged workstation exposure. Uses network segmentation for an endpoint-use restriction.

Privileged workstations should be limited to administrative functions and approved tools.

5. Suppress public banners and verbose errors: Which control is most appropriate?

Medium
A construction business discovered that internet-facing servers disclose unnecessary software versions and detailed error messages. The servers are already patched, and the immediate objective is to reduce configuration-based exposure. Which control is most appropriate?
  1. Deploy a web application firewall for inbound requests.
    A web application firewall may filter attacks, but it does not reliably remove verbose banners and error details.
  2. Enable multifactor authentication for developers.
    Multifactor authentication protects accounts, but it does not change information disclosed by server responses.
  3. Suppress public banners and verbose errors; retain internal logs. ✓
    Changing exposed server settings directly reduces public information while preserving diagnostic evidence for authorized staff.
  4. Run dynamic analysis against the production application.
    Dynamic analysis can assess running behavior, but it is not the direct configuration change needed to suppress disclosures.
The trap
Addresses identity risk instead of server-response exposure. Confuses assessment with remediation. Treats traffic filtering as the primary configuration fix.

Suppress public banners and verbose errors while retaining internal diagnostic logging.

6. Apply vendor-tested settings during the approved: Which action should the security team take first?

Medium
A manufacturing company must harden an industrial controller, but an unscheduled reboot could stop a production line. The vendor has supplied approved settings and a maintenance window. Which action should the security team take first?
  1. Expose the controller to the internet for remote monitoring.
    Internet exposure increases risk and is unrelated to safely applying an approved industrial configuration.
  2. Apply vendor-tested settings during the approved maintenance window. ✓
    Using vendor-tested settings during an approved window reduces security risk while respecting operational availability constraints.
  3. Replace the controller with a newer model before changing settings.
    Replacement may be costly and unnecessary when approved hardening settings can be applied within a planned window.
  4. Force an immediate reboot to install generic hardening settings.
    An immediate reboot may disrupt production and ignores the controller’s vendor-specific operational requirements.
The trap
Prioritizes generic hardening over safety and availability constraints. Confuses remote visibility with secure ICS hardening. Escalates to replacement instead of using the available safe change path.

Apply the vendor-tested baseline during the planned maintenance window to balance hardening and operational availability.

7. Deploy mobile device management with enforced policies: Which control best meets all three requirements?

Medium
A school district manages organization-owned tablets used by students and staff. The security team needs consistent screen-lock settings, approved applications, and the ability to remotely wipe a lost device. Which control best meets all three requirements?
  1. Require users to install endpoint detection software.
    Endpoint detection may monitor threats, but it does not centrally enforce mobile settings or provide complete device administration.
  2. Create a separate wireless network for student tablets.
    Network separation limits connectivity, but it does not manage applications, screen locks, or lost-device response.
  3. Encrypt only the district’s wireless traffic.
    Wireless encryption protects data in transit, but it does not enforce device settings or enable remote wipe.
  4. Deploy mobile device management with enforced policies. ✓
    MDM centrally enforces settings and applications while supporting administrative actions such as remote wiping.
The trap
Confuses endpoint monitoring with mobile fleet management. Addresses network confidentiality instead of device management. Uses segmentation for endpoint policy enforcement.

MDM centrally enforces mobile settings and applications and supports remote-wipe administration.

8. Use a managed work container with selective wipe: Which control best fits this BYOD requirement?

Medium
A telecommunications provider permits employees to access corporate email from personally owned phones. The organization must remove business data from a lost phone without deleting personal photos or applications. Which control best fits this BYOD requirement?
  1. Use a managed work container with selective wipe. ✓
    A managed work container separates business data and permits selective wiping while preserving personal content.
  2. Provide a corporate-owned phone to every employee.
    Corporate ownership may simplify control, but it changes the stated ownership model instead of protecting existing personal devices.
  3. Require employees to use only the office wireless network.
    Restricting network location does not remove business data from a lost personal phone or protect it while offsite.
  4. Require a full-device wipe whenever a phone is lost.
    A full-device wipe removes personal content and ignores the privacy requirement associated with personal ownership.
The trap
Confuses BYOD selective removal with corporate-device destruction. Replaces the BYOD model rather than solving its data-separation need. Confuses network access restrictions with lost-device data management.

A managed work container with selective wipe protects corporate data while respecting personal-device ownership.

9. COPE with full MDM enrollment: Which policy model and control combination is most appropriate?

Easy
A library issues smartphones to employees, permits limited personal use, and retains ownership of every device. The IT department wants centralized control over settings, applications, and lost-device response. Which policy model and control combination is most appropriate?
  1. Personal-use-only devices with network segmentation.
    Restricting personal use conflicts with the stated allowance and network segmentation does not manage device settings or wiping.
  2. BYOD with optional antivirus installation.
    BYOD describes personal ownership and optional antivirus does not provide centralized administrative control.
  3. CYOD with employee-controlled security settings.
    CYOD offers approved device choices, but employee-controlled settings conflict with the organization’s ownership and management requirement.
  4. COPE with full MDM enrollment. ✓
    COPE describes corporate ownership with personal use, while MDM provides centralized policy and lost-device management.
The trap
Misidentifies ownership and substitutes a narrow endpoint control. Confuses approved selection with corporate control. Changes the usage policy and applies a network control instead.

Corporate ownership with permitted personal use is COPE, and MDM supplies centralized device management.

10. Selective work-data wipe: Which control should administrators use?

Hard
A library allows patrons to use organization-managed tablets for catalog searches and staff work. When a staff member leaves, privacy rules require removing only organizational data while preserving personal photos. Which control should administrators use?
  1. Selective work-data wipe ✓
    A selective wipe removes managed organizational data while preserving personal content, matching the library’s privacy and separation requirement.
  2. Full-device remote wipe
    A full wipe removes organizational and personal content, exceeding the stated requirement and creating unnecessary privacy impact.
  3. Application allowlisting
    Allowlisting limits approved applications but does not remove existing organizational data from a departing user’s device.
  4. Factory reset after departure
    A factory reset erases the entire tablet and does not selectively preserve the staff member’s personal photos.
The trap
Confuses device loss response with separation of managed work data from personal content. Treats broad device sanitization as equivalent to selective enterprise-data removal. Applies preventive software control instead of the required data-removal action.

Selective wipe removes managed work data without erasing personal content, unlike a factory reset or full remote wipe.

11. Conduct a wireless site survey: Which activity should come first?

Easy
A regional utility is preparing wireless coverage for a new operations building. Before access points are permanently positioned, the network team must discover coverage gaps, interference, and signal behavior throughout the facility. Which activity should come first?
  1. Create a wireless heat map from collected measurements
    A heat map visualizes measured signal conditions, but surveying collects the measurements initially.
  2. Configure centralized enterprise wireless authentication services
    Enterprise authentication identifies users through centralized services but does not measure radio coverage or interference patterns.
  3. Conduct a wireless site survey ✓
    A site survey measures signal strength, interference, and environmental conditions needed for informed access-point placement.
  4. Enable WPA3
    WPA3 strengthens wireless protection but does not reveal physical coverage gaps, interference, or access-point placement needs.
The trap
Chooses a security control for a coverage-planning requirement. Selects the visualization output before performing the underlying assessment. Confuses identity control with physical wireless assessment.

A wireless site survey gathers radio measurements before deployment; heat maps present those measurements afterward.

12. Wireless heat map: Which deliverable is most appropriate?

Medium
A regional utility has completed a wireless site survey and collected signal readings throughout its control building. Engineers now need a visual representation showing strong, weak, and overlapping coverage areas before finalizing access-point placement. Which deliverable is most appropriate?
  1. WPA3 configuration
    WPA3 configuration improves wireless protection but does not visualize measured signal strength or coverage boundaries.
  2. Certificate validation
    Certificate validation helps prevent authentication-server impersonation but does not represent wireless signal measurements.
  3. Wireless heat map ✓
    A heat map converts survey measurements into a visual representation of signal strength, coverage, and overlap.
  4. AAA server policy
    AAA policy manages authentication and authorization but does not display physical wireless coverage or interference.
The trap
Confuses wireless security configuration with radio-frequency planning. Applies an identity-management control to a radio-coverage visualization need. Confuses trust validation with wireless planning analysis.

A wireless heat map visualizes collected survey data so engineers can evaluate coverage and access-point overlap.

516 more Security Operations questions

The remaining 516 questions in this domain are part of the full Security+ bank — 1918 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your Security+ readiness — free

Other Security+ domains

Part of the Certsqill Security+ question bank · Security Operations · Every answer, right and wrong, comes with its own explanation.