Free CompTIA ITF+ Security Principles Questions and Answers — Questions and Answers
Question 1: A financial services company performs a daily process that verifies its transaction logs to ensure no records have been illicitly modified or deleted. Which principle of the CIA triad is this practice primarily designed to uphold?
- Availability
- Confidentiality
- Integrity (Correct answer)
- Authorization
Correct answer: Integrity
Integrity, within the CIA triad, ensures that data is accurate and trustworthy, and has not been tampered with by unauthorized persons. Verifying transaction logs is a direct measure to confirm data integrity.
Question 2: A user logs into their corporate portal by first entering a password. They are then required to approve a push notification sent to their company-issued smartphone. This process is an example of which security concept?
- Single sign-on (SSO)
- Biometrics
- Role-based access control (RBAC)
- Multi-factor authentication (MFA) (Correct answer)
Correct answer: Multi-factor authentication (MFA)
Multi-factor authentication (MFA) enhances security by requiring two or more distinct verification methods. This scenario uses 'something you know' (the password) and 'something you have' (the smartphone), which is a classic implementation of MFA.
Question 3: An employee receives an urgent email that appears to be from the IT department, stating that their account has been compromised and they must click a link immediately to reset their password. The link leads to a convincing but fake login page. This is a common example of what type of attack?
- Phishing (Correct answer)
- Denial-of-Service (DoS)
- Brute-force
- Malware
Correct answer: Phishing
Phishing is a type of social engineering attack that uses fraudulent emails or messages to trick victims into revealing sensitive information, such as login credentials. The use of urgency and a deceptive link are hallmark tactics of a phishing attack.
Question 4: What is the primary function of data encryption?
- To guarantee data is always accessible to authorized users.
- To make data unreadable to unauthorized individuals. (Correct answer)
- To prevent hardware failures and data loss.
- To verify the identity of a system user.
Correct answer: To make data unreadable to unauthorized individuals.
Encryption is the process of converting readable data (plaintext) into an unreadable format (ciphertext) using a code or key. Its main purpose is to protect the confidentiality of data by ensuring that only authorized parties with the correct key can decrypt and read it.
Question 5: A company wants to increase the security of its server room to prevent unauthorized individuals from gaining physical access to the equipment. Which of the following is a physical security control?
- Installing a software firewall on the server.
- Enforcing a complex password policy for all administrators.
- Encrypting all data stored on the server's hard drives.
- Requiring a key card to unlock the server room door. (Correct answer)
Correct answer: Requiring a key card to unlock the server room door.
Physical security controls are measures designed to physically protect assets from unauthorized access or environmental threats. A key card access system is a direct method of controlling physical entry to a restricted space like a server room.
Question 6: Which of the following represents the strongest password according to common security best practices?
- Summer2026
- P@ssw0rd!
- 123456789
- MyP3t#isAwe$ome (Correct answer)
Correct answer: MyP3t#isAwe$ome
A strong password is long (typically 12+ characters), complex (using uppercase letters, lowercase letters, numbers, and symbols), and unpredictable. 'MyP3t#isAwe$ome' is the best option because it is long and uses all four character types, making it difficult to guess or crack.
Free CompTIA ITF+ Security Principles Questions and Answers
A financial services company performs a daily process that verifies its transaction logs to ensure no records have been illicitly modified or deleted.
Which principle of the CIA triad is this practice primarily designed to uphold?