How should I use these Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security domain.

220-1202 · topic practice

Security practice questions

Practise CompTIA A+ Core 2 220-1202 Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Security

Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Security explanation →

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

Trap 1: Disable the USB blocking Group Policy for the entire domain

Disabling the policy for the whole domain exposes all workstations to risk, not just the manager's.

Trap 2: Give the manager a company-approved USB drive and tell them to use…

Without changing the block policy, the drive will still be blocked; instructions alone do not remediate the technical restriction.

Trap 3: Create a local admin account on the manager's workstation and…

Local changes can be overridden by Group Policy and create a security gap; it is better to manage via policy.

Security practice questions

What to know about Security

Common Security exam traps

Security questions

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

A user calls the help desk because their workstation is running very slowly and they notice unusual network activity. You suspect ransomware. What should you do first to contain the threat?

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

A user reports that their external hard drive is no longer recognized by Windows. They suspect it might be infected with malware from a previous connection. You run a security scan and find no threats. What is the most likely cause of the drive not being recognized?

A company's Android devices are failing to connect to the corporate email server after a security policy update. The devices show 'Authentication failed' for the email app. What is the most likely cause?

A technician is tasked with disposing of a server that contains multiple SAS hard drives. The company's data destruction policy mandates that drives must be rendered unreadable by any means. Which combination of methods ensures compliance?

A small business owner wants to allow a remote employee to access their office desktop from home, but is concerned about security. They currently have a standard router with a public IP. Which of the following is the most secure method to enable this access?

A company is experiencing a security incident where an attacker gained access to the internal network via a compromised VPN account. The technician must prevent future attacks. Which two-factor authentication method should the technician implement for VPN access?

A security analyst discovers that an attacker has been using a compromised VPN account to access the corporate network. The account belongs to a former employee who was terminated two weeks ago. Which of the following should the analyst do immediately to prevent further unauthorized access?

You are configuring a new Windows 10 workstation for a remote employee who will connect to the corporate VPN. The user should not be able to install software or change system settings. Which tool should you use to enforce these restrictions?

During a routine security audit, you discover that several user accounts on a Windows 10 workstation have local administrator privileges when they should only be standard users. You need to quickly review and modify user account types from the command line. Which built-in tool should you use?

A user is unable to change their desktop background because the option is grayed out. You suspect a Group Policy setting is enforcing a specific wallpaper. Which Control Panel tool would you use to check if a Group Policy is applied, and what is the specific path to verify this setting?

During a security incident, you need to identify which processes are listening on specific network ports on a Windows server. Which command-line tool should you use?

A security audit reveals that a Windows 10 workstation has an unauthorized local user account. You need to remove this account from the command line without using the GUI. Which command should you use?

During a security audit, you discover that a user's workstation has an unauthorized application running. You need to terminate the process immediately from the command line. The process name is 'malware.exe'. Which command should you use?

A security incident is suspected on a Windows 10 workstation. You need to list all active network connections and the associated processes to identify potential malicious activity. Which command provides this information?

During a security audit, you need to identify all user accounts that have been created or modified in the last 24 hours on a Windows Server. Which command-line tool can parse security event logs to extract this information?

Track your progress over time

Start a Security only practice session

Related 220-1202 topic practice pages

Windows OS Features and Tools practice questions

Windows Settings and Control Panel practice questions

Windows Command-Line Tools practice questions

Windows Administrative Tools practice questions

macOS Features and Tools practice questions

Linux Commands and File Permissions practice questions

Mobile OS Features and Tools practice questions

Virtualization and Cloud Technologies practice questions

Physical Security Controls practice questions

Logical Security Concepts practice questions

Wireless Security Protocols practice questions

Malware Types and Removal practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid