Security+ Security Operations: 672 practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

Security+ Security Operations: 672 practice questions

Security+ 672 questions 12 shown free

12 of the 672 Security Operations questions in the Certsqill Security+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Security+? Take the free 5-min readiness check →

1. Document tested secure settings for supported systems: Which control most directly establishes the required ba

Medium
A library is establishing a secure baseline for newly issued servers. The security lead has approved the baseline scope, but implementation has not begun. Which control most directly establishes the required baseline?
  1. Enable multifactor authentication for administrators.
    Multifactor authentication protects privileged access, but it does not define the server's complete secure configuration baseline.
  2. Deploy a web application firewall before production release.
    A web application firewall protects web traffic, but it does not establish host configuration requirements.
  3. Run static analysis against custom applications.
    Static analysis examines application code, but it does not establish operating-system settings or service configurations.
  4. Document tested secure settings for supported systems. ✓
    A documented, tested set of secure settings directly establishes the approved baseline for supported systems.
The trap
Confuses one access control with establishing a system-wide baseline. Applies an application-development assessment to infrastructure hardening. Selects a perimeter application control instead of defining the baseline.

A tested, documented set of secure settings establishes the configuration baseline that later deployments must follow.

2. Deploy the tested hardened image through change control: Which action best satisfies the deployment objective?

Medium
An engineering firm has validated a hardened server image in its test environment. The change board approved production deployment, and no production changes have yet occurred. Which action best satisfies the deployment objective?
  1. Scan production servers for application vulnerabilities first.
    Vulnerability scanning provides evidence, but it does not deploy the already tested configuration.
  2. Require developers to review every operating-system setting.
    Developer review may add insight, but it is not a controlled mechanism for deploying an approved server baseline.
  3. Place a web application firewall in front of each server.
    A web application firewall filters application traffic, but it does not deploy host hardening settings.
  4. Deploy the tested hardened image through change control. ✓
    Deploying the validated image through approved change control moves the tested baseline into production safely.
The trap
Confuses verification with the requested deployment action. Substitutes informal review for authorized configuration deployment. Uses a compensating application control for an infrastructure deployment need.

The tested hardened image should be deployed using the approved change process.

3. Enable file-integrity monitoring on protected system files: Select TWO controls that directly support this obj

Medium
A construction business wants to detect unauthorized changes to standardized file servers. The baseline is already deployed, and administrators need ongoing evidence of configuration drift. Select TWO controls that directly support this objective.

Select two. More than one option is correct — every correct one is ticked below.

  1. Enable file-integrity monitoring on protected system files. ✓
    File-integrity monitoring detects unexpected changes to designated files and supplies evidence of possible baseline drift.
  2. Require multifactor authentication for administrator accounts.
    Multifactor authentication strengthens administrative access, but it does not detect changes after authorized access occurs.
  3. Run scheduled configuration-compliance comparisons against the approved baseline. ✓
    Scheduled comparisons identify deviations between current settings and the organization’s approved secure configuration.
  4. Create replicated copies of production data each evening.
    Replication improves availability or recovery, but it does not compare system settings with an approved baseline.
  5. Install a web application firewall on public-facing services.
    A web application firewall filters application requests, but it does not monitor server configuration drift.
The trap
Confuses access prevention with monitoring configuration changes. Applies traffic filtering to a host-state monitoring requirement. Confuses data continuity with configuration monitoring.

File-integrity monitoring and scheduled compliance comparisons provide direct, ongoing evidence of baseline drift.

4. Disable the unused service after confirming dependencies: What should the administrator do first?

Medium
A municipal office is hardening a newly installed internal server. Inventory shows a legacy file-transfer service that no business process uses, and the service is currently enabled. What should the administrator do first?
  1. Perform static analysis of the office’s source code.
    Static analysis examines software code, but it does not address an enabled infrastructure service with no business purpose.
  2. Add multifactor authentication to every user account.
    Multifactor authentication improves identity assurance, but it does not remove exposure from an unnecessary listening service.
  3. Disable the unused service after confirming dependencies. ✓
    Disabling an unnecessary service reduces attack surface after confirming that no legitimate process depends on it.
  4. Place the server behind a web application firewall.
    A web application firewall may protect web traffic, but it does not directly disable an unrelated file-transfer service.
The trap
Treats stronger authentication as a substitute for reducing attack surface. Applies a web-specific control to a service-reduction requirement. Confuses application assurance with host service hardening.

An unused service should be disabled after dependency confirmation because removal directly reduces the server’s attack surface.

5. Limit each workstation to administration and approved: Which control most directly hardens these privileged wo

Easy
An insurance office uses dedicated administrator workstations for directory and security management. Administrators currently browse the internet and read email from those systems. Which control most directly hardens these privileged workstations?
  1. Use standard accounts for routine daily activity.
    Standard accounts reduce routine privilege, but they do not isolate privileged administration from browsing and email exposure.
  2. Limit each workstation to administration and approved management tools. ✓
    Restricting these systems to administrative functions removes unnecessary browsing and email exposure from privileged sessions.
  3. Place an additional firewall between workstations and directory servers.
    Network filtering can limit connections, but it does not stop users from browsing or reading email on privileged systems.
  4. Install endpoint detection and response software on each workstation.
    Endpoint detection improves visibility and response, but it does not prevent risky general-purpose activity on privileged systems.
The trap
Provides least privilege without addressing workstation separation. Selects monitoring instead of reducing privileged workstation exposure. Uses network segmentation for an endpoint-use restriction.

Privileged workstations should be limited to administrative functions and approved tools.

6. Suppress public banners and verbose errors: Which control is most appropriate?

Medium
A construction business discovered that internet-facing servers disclose unnecessary software versions and detailed error messages. The servers are already patched, and the immediate objective is to reduce configuration-based exposure. Which control is most appropriate?
  1. Deploy a web application firewall for inbound requests.
    A web application firewall may filter attacks, but it does not reliably remove verbose banners and error details.
  2. Enable multifactor authentication for developers.
    Multifactor authentication protects accounts, but it does not change information disclosed by server responses.
  3. Suppress public banners and verbose errors; retain internal logs. ✓
    Changing exposed server settings directly reduces public information while preserving diagnostic evidence for authorized staff.
  4. Run dynamic analysis against the production application.
    Dynamic analysis can assess running behavior, but it is not the direct configuration change needed to suppress disclosures.
The trap
Addresses identity risk instead of server-response exposure. Confuses assessment with remediation. Treats traffic filtering as the primary configuration fix.

Suppress public banners and verbose errors while retaining internal diagnostic logging.

7. Apply vendor-tested settings during the approved: Which action should the security team take first?

Medium
A manufacturing company must harden an industrial controller, but an unscheduled reboot could stop a production line. The vendor has supplied approved settings and a maintenance window. Which action should the security team take first?
  1. Expose the controller to the internet for remote monitoring.
    Internet exposure increases risk and is unrelated to safely applying an approved industrial configuration.
  2. Apply vendor-tested settings during the approved maintenance window. ✓
    Using vendor-tested settings during an approved window reduces security risk while respecting operational availability constraints.
  3. Replace the controller with a newer model before changing settings.
    Replacement may be costly and unnecessary when approved hardening settings can be applied within a planned window.
  4. Force an immediate reboot to install generic hardening settings.
    An immediate reboot may disrupt production and ignores the controller’s vendor-specific operational requirements.
The trap
Prioritizes generic hardening over safety and availability constraints. Confuses remote visibility with secure ICS hardening. Escalates to replacement instead of using the available safe change path.

Apply the vendor-tested baseline during the planned maintenance window to balance hardening and operational availability.

8. Deploy mobile device management with enforced policies: Which control best meets all three requirements?

Medium
A school district manages organization-owned tablets used by students and staff. The security team needs consistent screen-lock settings, approved applications, and the ability to remotely wipe a lost device. Which control best meets all three requirements?
  1. Require users to install endpoint detection software.
    Endpoint detection may monitor threats, but it does not centrally enforce mobile settings or provide complete device administration.
  2. Create a separate wireless network for student tablets.
    Network separation limits connectivity, but it does not manage applications, screen locks, or lost-device response.
  3. Encrypt only the district’s wireless traffic.
    Wireless encryption protects data in transit, but it does not enforce device settings or enable remote wipe.
  4. Deploy mobile device management with enforced policies. ✓
    MDM centrally enforces settings and applications while supporting administrative actions such as remote wiping.
The trap
Confuses endpoint monitoring with mobile fleet management. Addresses network confidentiality instead of device management. Uses segmentation for endpoint policy enforcement.

MDM centrally enforces mobile settings and applications and supports remote-wipe administration.

9. Use a managed work container with selective wipe: Which control best fits this BYOD requirement?

Medium
A telecommunications provider permits employees to access corporate email from personally owned phones. The organization must remove business data from a lost phone without deleting personal photos or applications. Which control best fits this BYOD requirement?
  1. Use a managed work container with selective wipe. ✓
    A managed work container separates business data and permits selective wiping while preserving personal content.
  2. Provide a corporate-owned phone to every employee.
    Corporate ownership may simplify control, but it changes the stated ownership model instead of protecting existing personal devices.
  3. Require employees to use only the office wireless network.
    Restricting network location does not remove business data from a lost personal phone or protect it while offsite.
  4. Require a full-device wipe whenever a phone is lost.
    A full-device wipe removes personal content and ignores the privacy requirement associated with personal ownership.
The trap
Confuses BYOD selective removal with corporate-device destruction. Replaces the BYOD model rather than solving its data-separation need. Confuses network access restrictions with lost-device data management.

A managed work container with selective wipe protects corporate data while respecting personal-device ownership.

10. COPE with full MDM enrollment: Which policy model and control combination is most appropriate?

Easy
A library issues smartphones to employees, permits limited personal use, and retains ownership of every device. The IT department wants centralized control over settings, applications, and lost-device response. Which policy model and control combination is most appropriate?
  1. Personal-use-only devices with network segmentation.
    Restricting personal use conflicts with the stated allowance and network segmentation does not manage device settings or wiping.
  2. BYOD with optional antivirus installation.
    BYOD describes personal ownership and optional antivirus does not provide centralized administrative control.
  3. CYOD with employee-controlled security settings.
    CYOD offers approved device choices, but employee-controlled settings conflict with the organization’s ownership and management requirement.
  4. COPE with full MDM enrollment. ✓
    COPE describes corporate ownership with personal use, while MDM provides centralized policy and lost-device management.
The trap
Misidentifies ownership and substitutes a narrow endpoint control. Confuses approved selection with corporate control. Changes the usage policy and applies a network control instead.

Corporate ownership with permitted personal use is COPE, and MDM supplies centralized device management.

11. Enroll selected phones in MDM: Select TWO.

Easy
A telecommunications provider is issuing personally owned phones from an approved list. Management requires employee choice while enforcing work security settings. Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Enroll selected phones in MDM ✓
    MDM applies required security settings, separates work controls, and supports policy enforcement across approved employee-selected devices.
  2. Publish an approved-device catalog ✓
    A CYOD catalog gives employees choices while limiting enrollment to models the organization has evaluated and supports.
  3. Deploy a web application firewall
    A WAF filters web requests and does not control device models, enrollment, or mobile configuration compliance.
  4. Permit unrestricted BYOD enrollment
    Unrestricted BYOD maximizes personal choice but does not enforce the approved-device requirement or consistent security baseline.
  5. Replace phones with corporate-only devices
    Corporate-only devices provide stronger ownership control but remove the employee choice explicitly required by the objective.
The trap
Confuses employee ownership flexibility with controlled choice from an approved catalog. Confuses COPE or corporate ownership with CYOD, which preserves choice among approved devices. Applies an application-layer control to an endpoint ownership and management decision.

CYOD combines an approved device selection with MDM enforcement; BYOD, corporate-only ownership, and WAFs address different needs.

12. Selective work-data wipe: Which control should administrators use?

Hard
A library allows patrons to use organization-managed tablets for catalog searches and staff work. When a staff member leaves, privacy rules require removing only organizational data while preserving personal photos. Which control should administrators use?
  1. Selective work-data wipe ✓
    A selective wipe removes managed organizational data while preserving personal content, matching the library’s privacy and separation requirement.
  2. Full-device remote wipe
    A full wipe removes organizational and personal content, exceeding the stated requirement and creating unnecessary privacy impact.
  3. Application allowlisting
    Allowlisting limits approved applications but does not remove existing organizational data from a departing user’s device.
  4. Factory reset after departure
    A factory reset erases the entire tablet and does not selectively preserve the staff member’s personal photos.
The trap
Confuses device loss response with separation of managed work data from personal content. Treats broad device sanitization as equivalent to selective enterprise-data removal. Applies preventive software control instead of the required data-removal action.

Selective wipe removes managed work data without erasing personal content, unlike a factory reset or full remote wipe.

660 more Security Operations questions

The remaining 660 questions in this domain are part of the full Security+ bank — 2398 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your Security+ readiness — free

Other Security+ domains

Part of the Certsqill Security+ question bank · Security Operations · Every answer, right and wrong, comes with its own explanation.