Security+ Practice Exam 2 – Part 2 (Q21–Q40)
Questions only – No answers provided
Q21. Which of the following BEST describes a watering hole attack? A. Infecting a website
commonly visited by the target B. Targeting executives with fraudulent emails C. Redirecting DNS
requests D. Exploiting unpatched VPNs
Q22. Which access control model is based on roles assigned to users? A. DAC B. RBAC C. MAC
D. ABAC
Q23. Which cryptographic concept ensures that data cannot be altered without detection? A.
Confidentiality B. Integrity C. Availability D. Non-repudiation
Q24. Which protocol operates at Layer 7 of the OSI model? A. IP B. TCP C. HTTP D. ICMP
Q25. A penetration tester is attempting to crack password hashes. Which tool is MOST
appropriate? A. Wireshark B. Metasploit C. John the Ripper D. Nmap
Q26. An attacker exploits a web application input field to run malicious SQL commands. What type
of attack is this? A. XSS B. SQL Injection C. CSRF D. Buffer Overflow
Q27. A company enforces encryption of sensitive data before it is stored in the cloud. This is an
example of: A. Data obfuscation B. Data masking C. Data at rest protection D. Data in transit
protection
Q28. A system administrator needs to restrict access to systems based on attributes such as time
of day and device type. Which model BEST fits? A. RBAC B. DAC C. ABAC D. MAC
Q29. Which of the following is MOST effective against insider threats? A. IDS/IPS B. Strong
password policy C. User behavior analytics D. Firewalls
Q30. Which hashing algorithm is considered broken and should NOT be used? A. SHA-256 B.
SHA-1 C. SHA-3 D. AES
Q31. Which wireless security protocol uses AES encryption and is the most secure? A. WEP B.
WPA C. WPA2 D. WPA3
Q32. An attacker is monitoring network traffic to capture credentials. This is an example of: A.
Eavesdropping B. DoS C. Injection D. Social engineering
Q33. A company requires all changes to systems to be reviewed and approved before
implementation. This process is BEST described as: A. Risk management B. Change management
C. Configuration management D. Vulnerability management
Q34. Which type of malware disguises itself as legitimate software? A. Worm B. Rootkit C. Trojan
D. Logic bomb
Q35. Which tool is MOST appropriate for analyzing suspicious network traffic? A. Nmap B.
Wireshark C. Nessus D. Hydra
Q36. Which PKI component issues and manages digital certificates? A. CRL B. CSR C. CA D.
OCSP
Q37. A security team wants to ensure availability of services even if a server fails. Which is the
BEST solution? A. RAID 0 B. High availability cluster C. Cold site D. Backup tapes
Q38. A phishing campaign targeting a company’s CEO is BEST described as: A. Smishing B.
Vishing C. Whaling D. Spear phishing
Q39. Which of the following protocols provides secure remote command-line access? A. FTP B.
SSH C. Telnet D. SNMP
Q40. Which type of backup only saves files that have changed since the last full backup? A. Full B.
Differential C. Incremental D. Snapshot
