Free CompTIA SecurityX Practice Questions

Q1.Protective DNS blocked eleven thousand queries a day for six months and now blocks a few hundred, with no change to the threat feed and no reduction in user population or internet traffic volume. Endpoint telemetry shows browsers resolving names successfully. What is happening, and which combination of changes restores the control?

• A.Clients are resolving through browser based encrypted DNS, so policy manage it on managed devices and block known public encrypted DNS endpoints at egress while permitting your own encrypted resolver
• B.Clients are resolving through browser based encrypted DNS, so block all outbound traffic on ports 53 and 853 except to the internal resolvers
• C.The resolver cache is now warm enough that most queries never reach the policy engine, so shorten cache lifetimes on the protective resolver
• D.The threat feed provider has consolidated its indicators, so add a second feed and lower the confidence threshold for blocking

Domain: Security Engineering

Q2.A payments service and a checkout service run in a container platform and currently authenticate to each other with a shared secret held in a configuration file, refreshed manually each year. You want mutual authentication that survives the workload being rescheduled onto any node. What should the design use?

• A.Issue each workload a certificate bound to the node it runs on, and re-issue on reschedule
• B.Issue each workload a platform-attested identity with a short-lived, automatically rotated credential naming the workload rather than its host
• C.Move the shared secret into a managed secrets store and rotate it automatically every thirty days
• D.Accept connections based on the source address range assigned to the platform's node pool

Domain: Security Architecture

Q3.A security architect has no mandate over a product engineering group that reports elsewhere, and needs the group to start signing container images. The group has two open headcount and a launch in six weeks. What approach is most likely to succeed?

• A.Send the signing standard with a compliance deadline and copy the group's director.
• B.Arrive with the four-line pipeline change already tested against a copy of the group's build, and ask only for that.
• C.Escalate to the executive sponsor and request a mandate covering all product engineering groups.
• D.Add the group's non-compliance to the risk register and review it at the next steering committee.

Domain: Governance, Risk, and Compliance

Q4.Four teams issue certificates through different routes: one uses a public authority's console, one uses a cloud certificate manager, one uses an internal authority, and one buys certificates on a corporate card. A five-hour outage was caused by an expired certificate nobody owned. The board asks for a solution. Which first step actually addresses the failure?

• A.Stand up a new consolidated internal certificate authority and migrate all issuance to it
• B.Configure expiry alerting at thirty days on every certificate currently in the monitoring platform
• C.Run active discovery across scans, platform APIs and transparency logs into one register with an owner named per certificate
• D.Extend validity periods to three years so renewals occur less frequently

Domain: Security Architecture

Q5.A Statement of Applicability being prepared for a first certification audit marks every Annex A control as applicable and implemented, including several the organization plainly does not perform, such as controls for development environments it does not operate. The consultant says a full sheet looks stronger to an auditor. What is the correct approach?

• A.Mark every control applicable as advised, since claiming more coverage cannot be penalised at audit.
• B.Record honest applicability decisions, including controls deliberately excluded, each with a stated justification.
• C.Delete the rows for controls the organization does not perform so the sheet contains only live controls.
• D.Mark the questionable controls as applicable but not yet implemented, with no target date, so the sheet stays complete.

Domain: Governance, Risk, and Compliance

Q6.A heat map going to an executive committee shows six risks in the top-right red cell, all scored 5 for impact and 4 for likelihood. A quick look suggests one of them carries an exposure of roughly $400,000 and another closer to $40 million. The committee intends to fund treatment for the red cell in rank order. What should the risk lead do before the meeting?

• A.Run a coarse quantitative pass on the items in that cell so the committee can rank them by exposure rather than by colour.
• B.Expand the impact scale from five bands to ten so that the extremes stop sharing a cell.
• C.Re-score the six risks with a second independent assessor and average the two sets of scores.
• D.Present the cell as it stands and let the committee fund all six items to avoid choosing between them.

Domain: Governance, Risk, and Compliance

Q7.A payment authorisation function runs on a serverless platform. A fraud investigation needs to reconstruct what a specific request did across the function, the queue it published to and the downstream function that consumed the message. The environments for those executions were recycled days ago. What has to be engineered into the functions for this reconstruction to be possible?

• A.Enable provider audit logging of control plane API calls made by each execution role
• B.Increase the function timeout so buffered logs are flushed before the environment is recycled
• C.Attach a runtime protection agent to the execution environment to capture process activity
• D.Emit structured logs synchronously during execution and thread a correlation identifier through every hop

Domain: Security Engineering

Q8.Your order service exposes a webhook endpoint that a payment provider calls when a transaction completes. The handler parses the JSON body, matches an order identifier and marks the order paid. Anyone on the internet can reach the endpoint. What set of controls makes this safe?

• A.Restrict the endpoint to the provider's published source address ranges and parse the body normally
• B.Require a static shared secret in a request header and validate it after parsing the body
• C.Verify the provider's signature over the raw body before parsing, reject stale timestamps, and confirm the payment through the provider's API before marking the order paid
• D.Place the endpoint behind the API gateway with schema validation and a per-source rate limit

Domain: Security Engineering

Q9.During an intrusion the adversary held domain administrator rights and cleared the local event logs on several servers. Which control determines whether you can still reconstruct authentication activity on those hosts?

• A.Increasing the local event log file size, so entries survive longer before rollover.
• B.Local log signing on each server, so cleared logs can be detected afterwards.
• C.Daily file-level backups of each server's log directory taken by the backup agent.
• D.Prompt forwarding of logs off the generating host into a store with restricted deletion and immutability enabled.

Domain: Security Operations

Q10.You are standing up an inventory so that a future report of a backdoored public model becomes a one-hour query rather than a two-week investigation. Which two records matter most? Select two.

• A.The content hash and exact version of each model file together with the source URL it came from.
• B.The benchmark accuracy scores published by the model's authors.
• C.Which systems currently run each model and in what capacity.
• D.The parameter count and the quantisation used for inference.
• E.The average latency observed per request in production.

Domain: Security Operations