Free CompTIA SecurityX Certification Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CompTIA SecurityX Certification Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An enterprise policy requires controlled access to customer records, but administrators implement it inconsistently. Which document should the security manager add to specify how staff must carry out the access controls?

   1. A. A procedure describing the implementation steps
   2. B. A policy restating the organization's security intent
   3. C. A guideline suggesting optional implementation ideas
   4. D. A risk appetite statement defining acceptable exposure

   Answer: A

   Explanation: NIST states, "Procedures describe how the policies or controls are implemented". A procedure converts the existing access policy into actionable instructions; restating intent, suggesting optional practices, or defining risk appetite does not supply those instructions.

   Reference: Security and Privacy Controls for Information Systems and Organizations — AC-1, Discussion, p. 18

2. 2A network security design must drop detected attack packets before they reach an application. Which sensor placement directly enables packet blocking?

   1. A. A passive sensor connected only to a mirrored port
   2. B. A passive sensor receiving archived packet captures
   3. C. An inline sensor through which application traffic passes
   4. D. An offline sensor analyzing exported traffic summaries

   Answer: C

   Explanation: NIST identifies inline deployment as enabling sensors to "stop attacks by blocking network traffic". Copy-only monitoring lacks the same direct control over delivery.

   Reference: Guide to Intrusion Detection and Prevention Systems (IDPS) — Section 4.2.2, Inline, p. 4-4

3. 3An AWS request is allowed by an identity policy but explicitly denied by an applicable resource policy. The credentials are valid. What explains the access denial?

   1. A. A valid credential causes resource policies to be skipped
   2. B. The explicit deny overrides the applicable allow
   3. C. The identity policy's allow overrides resource-policy denials
   4. D. The order in which the two policies were created determines access

   Answer: B

   Explanation: AWS states an explicit deny "overrides the allow". Valid authentication does not override an applicable authorization denial.

   Reference: Policy evaluation logic — Evaluating identity-based policies with resource-based policies

4. 4After a log-format update, a SIEM stores each complete record as message text but no longer extracts source IP addresses into the source-address field. Which processing component should be corrected first?

   1. A. The event-aggregation rule that consolidates repeated records
   2. B. The source-specific parsing rule that extracts record fields
   3. C. The correlation rule that links events across multiple records
   4. D. The rotation rule that closes a log and opens its successor

   Answer: B

   Explanation: NIST defines log parsing as "extracting data from a log so that the parsed values can be used as input for another logging process." The source parser must interpret the changed record format. Aggregation consolidates events, correlation links records, and rotation manages file boundaries; none repairs field extraction.

   Reference: Guide to Computer Security Log Management — Section 3.2, Functions, log parsing

5. 5New database administrators have completed general security awareness training but will receive privileged production duties. Which training decision addresses the remaining preparation requirement?

   1. A. Repeat the general awareness presentation without technical changes
   2. B. Provide training tailored to their assigned administrative duties
   3. C. Replace technical training with an acknowledgment of acceptable use
   4. D. Defer role training until their first administrative security incident

   Answer: B

   Explanation: AT-3 includes "technical training specifically tailored for assigned duties" and requires role-based training before performing assigned duties. General awareness and policy acknowledgment do not replace preparation for privileged tasks; waiting for an incident leaves those duties unsupported.

   Reference: Security and Privacy Controls for Information Systems and Organizations — AT-3, Control and Discussion, p. 62

6. 6A design requires network traffic observation without forwarding production packets through the monitoring sensor. Which deployment meets that condition?

   1. A. A transparent inline IPS bridge
   2. B. An inline firewall with inspection enabled
   3. C. An inline proxy terminating client connections
   4. D. A passive sensor receiving a copy of traffic

   Answer: D

   Explanation: For passive sensors, NIST states, "no traffic actually passes through the sensor." The other deployments insert a device in the production forwarding or connection path.

   Reference: Guide to Intrusion Detection and Prevention Systems (IDPS) — Section 4.2.2, Passive, p. 4-5

7. 7A Lambda function cannot assume its execution role. The role's permission policy permits the needed resource action, but its trust policy omits lambda.amazonaws.com. Which change addresses the identified cause?

   1. A. Expand the role's resource-action policy without changing who can assume it
   2. B. Grant users permission to invoke the function without changing role trust
   3. C. Add the Lambda service principal to the execution role's trust policy
   4. D. Trust only the human deployment identity instead of the Lambda service

   Answer: C

   Explanation: AWS requires the role trust policy to identify "lambda.amazonaws.com" as a trusted service. The observed problem concerns which principal may assume the role. More downstream permissions, caller invocation rights, or human-only trust does not authorize Lambda service assumption.

   Reference: Defining Lambda Event Function permissions with an execution role — Execution role introduction, trust policy requirement

8. 8Two applications record equivalent event times using different time-zone notation and date formats. What processing makes those fields consistently comparable in the SIEM?

   1. A. Rotate the source log files at the same file size.
   2. B. Aggregate all records with the same application name.
   3. C. Normalize timestamps to a common representation and time zone.
   4. D. Suppress events from whichever application produces more records.

   Answer: C

   Explanation: NIST states, "In log normalization, each log data field is converted to a particular data representation and categorized consistently." Its examples include date and time formats. Normalization addresses representation differences; rotation, aggregation, and suppression address different processing problems.

   Reference: Guide to Computer Security Log Management — Section 3.2, Functions, log normalization and footnote 24

9. 9Employees correctly answer phishing quizzes, but the security team needs to assess their behavior when confronted with simulated malicious links. Which program component directly meets this requirement?

   1. A. A policy acknowledgment exercise about email ownership
   2. B. A classroom review of the definitions of phishing
   3. C. A practical awareness exercise using simulated phishing
   4. D. A role assignment review for email administrators

   Answer: C

   Explanation: AT-2(1) says, "Provide practical exercises in literacy training that simulate events and incidents." Its discussion specifically includes spear phishing and malicious web links. The other choices assess acknowledgment, recall, or role assignment rather than behavior in a simulated event.

   Reference: Security and Privacy Controls for Information Systems and Organizations — AT-2(1), Practical Exercises, p. 60

10. 10An enterprise must publish web servers on a segment separated from internal business systems, with controlled interfaces between the segments. Which placement follows the SC-7 boundary-protection design?

    1. A. A DMZ with controlled interfaces between public servers and internal networks
    2. B. A flat server subnet shared by public web servers and internal database systems
    3. C. An internal database subnet protected only at its Internet-facing perimeter
    4. D. A public-server subnet with unrestricted routed access into internal segments

    Answer: A

    Explanation: NIST states, "Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs." SC-7 also calls for controlled interfaces. A DMZ with controlled internal connections meets both conditions; shared internal placement or unrestricted routing does not.

    Reference: Security and Privacy Controls for Information Systems and Organizations — SC-7(b) and Discussion, p. 297