How should I use these Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security domain.

FC0-U61 · topic practice

Security practice questions

Practise CompTIA ITF+ FC0-U61 Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Security

Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full wireless explanation →

A small business owner wants to protect sensitive customer data stored on a laptop that is frequently used on public Wi-Fi networks. The owner is considering implementing a security control that ensures data remains confidential even if the laptop is stolen. Which of the following is the BEST control for this scenario?

Trap 1: Use a VPN when connected to public Wi-Fi

A VPN encrypts network traffic, not data stored on the device.

Trap 2: Install antivirus software

Antivirus protects against malware but does not ensure data confidentiality if the device is stolen.

Trap 3: Require a strong password for user login

A strong password prevents unauthorized login but does not encrypt data at rest.

Study all Security common traps →

A
Use a VPN when connected to public Wi-Fi
Why wrong: A VPN encrypts network traffic, not data stored on the device.
B
Install antivirus software
Why wrong: Antivirus protects against malware but does not ensure data confidentiality if the device is stolen.
C
Implement full-disk encryption
Full-disk encryption protects data at rest by encrypting the entire drive, so data is unreadable without the decryption key.
D
Require a strong password for user login
Why wrong: A strong password prevents unauthorized login but does not encrypt data at rest.

Full breakdown with real-world context →

Question 2hardmulti select

Read the full Security explanation →

A security analyst is reviewing user permissions and discovers that several users have been granted more privileges than necessary to perform their job functions. The analyst wants to apply the principle of least privilege. Which TWO actions should the analyst take? (Choose TWO.)

Trap 1: Grant full administrative access to a single IT administrator

This concentrates excessive privileges and violates least privilege.

Trap 2: Allow users to request temporary elevation of privileges for…

This is a separate control (just-in-time access) but does not directly implement least privilege; it can be part of an overall strategy but is not the primary action.

Trap 3: Remove all permissions from users and add them back only when…

This approach is impractical and would disrupt work; it is not a recommended method.

Study all Security common traps →

A
Grant full administrative access to a single IT administrator
Why wrong: This concentrates excessive privileges and violates least privilege.
B
Audit current permissions to identify unnecessary privileges
Auditing helps identify where excessive privileges exist, which is a necessary first step.
C
Create role-based access control (RBAC) groups that match job functions
RBAC aligns permissions with job roles, ensuring users have only the access needed.
D
Allow users to request temporary elevation of privileges for specific tasks
Why wrong: This is a separate control (just-in-time access) but does not directly implement least privilege; it can be part of an overall strategy but is not the primary action.
E
Remove all permissions from users and add them back only when requested
Why wrong: This approach is impractical and would disrupt work; it is not a recommended method.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Security explanation →

A help desk technician receives an alert from the security monitoring system showing multiple events like the one in the exhibit. The technician is investigating a possible brute-force attack. Based on the exhibit, which of the following is the primary attack vector being used?

Exhibit

Refer to the exhibit.

```
Event ID: 4625
Time: 2023-08-15 14:23:45
Account Name: jsmith
Failure Reason: Unknown user name or bad password.
Workstation Name: WORKSTATION-05
Logon Type: 10 (RemoteInteractive)
```

Trap 1: VPN brute-force attack

VPN logon events have different logon types (e.g., 3 for network) and are not shown here.

Trap 2: SSH brute-force attack

SSH uses Logon Type 2 or 10 but typically on port 22; RDP is more common for Windows systems.

Trap 3: Web application attack

Web application attacks are typically seen in HTTP logs, not Windows security event logs.

Study all Security common traps →

A
VPN brute-force attack
Why wrong: VPN logon events have different logon types (e.g., 3 for network) and are not shown here.
B
RDP brute-force attack
Logon Type 10 indicates a remote interactive logon, commonly used by RDP.
C
SSH brute-force attack
Why wrong: SSH uses Logon Type 2 or 10 but typically on port 22; RDP is more common for Windows systems.
D
Web application attack
Why wrong: Web application attacks are typically seen in HTTP logs, not Windows security event logs.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Security explanation →

You are the IT security administrator for a mid-sized law firm that handles sensitive client data. The firm has a mix of Windows 10 workstations, a Windows Server 2019 domain controller, and a network printer. All users have standard user accounts. The senior partner recently received a phishing email that appeared to be from a known client, requesting that he click a link to review a document. He clicked the link and entered his domain credentials on a fake login page. Shortly after, the firm's file server began encrypting files and displaying a ransom note. The incident response team isolated the infected server and restored files from backup. However, the senior partner now reports that he cannot access the file server from his workstation. He receives an 'Access Denied' message. You check his account in Active Directory and find that his account is not locked out and the password is correct. The file server is back online and accessible by other users. You verify that the senior partner's workstation has network connectivity and can ping the file server. Which of the following is the MOST likely cause of the access issue?

Trap 1: The senior partner's account was disabled by the automatic…

The scenario states the account is not locked out, so it is not disabled.

Trap 2: The ransomware modified the file server's permissions to deny…

Ransomware typically encrypts files but does not alter NTFS permissions to block specific users; it uses encryption to deny access.

Trap 3: The senior partner's workstation IP address was blacklisted on the…

IP blacklisting would prevent all network communication, but the partner can ping the server, indicating the IP is not blocked.

Study all Security common traps →

A
The senior partner's password was changed during incident response, and his workstation has cached old credentials
After credential compromise, passwords are often reset. The workstation may be using cached old credentials, causing authentication failure despite network connectivity.
B
The senior partner's account was disabled by the automatic containment script
Why wrong: The scenario states the account is not locked out, so it is not disabled.
C
The ransomware modified the file server's permissions to deny access to the senior partner's account
Why wrong: Ransomware typically encrypts files but does not alter NTFS permissions to block specific users; it uses encryption to deny access.
D
The senior partner's workstation IP address was blacklisted on the file server
Why wrong: IP blacklisting would prevent all network communication, but the partner can ping the server, indicating the IP is not blocked.

Full breakdown with real-world context →

Question 5easymulti select

Read the full Security explanation →

Which TWO of the following are examples of social engineering attacks?

Trap 1: Adware

Adware is a type of malware that displays unwanted advertisements, not a social engineering attack.

Trap 2: Spoofing

Spoofing is a technical attack where an attacker masquerades as another device or user, not primarily a social engineering technique.

Trap 3: Shoulder surfing

Shoulder surfing is indeed a social engineering attack, but the question asks for exactly two correct answers; the intended correct pair is phishing and tailgating. In this version, shoulder surfing is incorrect to achieve exactly two correct.

Study all Security common traps →

A
Adware
Why wrong: Adware is a type of malware that displays unwanted advertisements, not a social engineering attack.
B
Spoofing
Why wrong: Spoofing is a technical attack where an attacker masquerades as another device or user, not primarily a social engineering technique.
C
Tailgating
Tailgating is a social engineering attack where an unauthorized person follows an authorized individual into a restricted area.
D
Phishing
Phishing is a social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
E
Shoulder surfing
Why wrong: Shoulder surfing is indeed a social engineering attack, but the question asks for exactly two correct answers; the intended correct pair is phishing and tailgating. In this version, shoulder surfing is incorrect to achieve exactly two correct.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Security explanation →

Refer to the exhibit. A security analyst reviews the NTFS permissions on the C:\Shared folder. Which user or group has the ability to delete files created by other users?

Exhibit

Refer to the exhibit.

C:\Users\Admin>icacls C:\Shared
C:\Shared Everyone:(OI)(CI)(RX)
           Admin:(OI)(CI)(F)
           Users:(OI)(CI)(M)

Successfully processed 1 files.

Trap 1: No user or group

Both Admin and Users have permissions that allow deletion.

Trap 2: Admin

Admin has Full Control (F) and can delete files, but the question asks for the group that can delete files created by other users; Admin is an individual account, not a group. However, if the question implies 'which group', then Admin is not a group. But to be precise, the correct answer is Users.

Trap 3: Everyone

Everyone has only Read & Execute (RX) permissions, which do not include the ability to delete files.

Study all Security common traps →

A
Users
Users have Modify (M) permissions, which include the ability to delete files and subfolders, even those created by other users.
B
No user or group
Why wrong: Both Admin and Users have permissions that allow deletion.
C
Admin
Why wrong: Admin has Full Control (F) and can delete files, but the question asks for the group that can delete files created by other users; Admin is an individual account, not a group. However, if the question implies 'which group', then Admin is not a group. But to be precise, the correct answer is Users.
D
Everyone
Why wrong: Everyone has only Read & Execute (RX) permissions, which do not include the ability to delete files.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Security explanation →

You are the IT administrator for a small accounting firm with 25 employees. The firm uses a Windows Server 2019 domain controller, a file server, and an email server running Microsoft Exchange. Each employee has a company-issued laptop running Windows 10. The firm recently experienced a ransomware attack that encrypted all files on the file server. The attacker demanded a ransom in Bitcoin. The firm restored the files from a backup that was taken the previous night. However, the CEO is concerned about future attacks and wants to implement additional security measures. The firm has a limited budget and cannot afford a full security suite. Which of the following is the BEST course of action to reduce the risk of another ransomware infection?

Trap 1: Ensure all systems are patched monthly.

Patching addresses known vulnerabilities, but ransomware can exploit zero-days or be delivered via social engineering without exploiting a vulnerability.

Trap 2: Deploy an email spam filter to block phishing emails.

Email filtering can reduce phishing attacks, but ransomware can also be delivered through other vectors such as malicious websites or USB drives.

Trap 3: Conduct annual security awareness training for all employees.

Training helps users recognize threats, but it is not foolproof and does not provide a technical barrier against all ransomware variants.

Study all Security common traps →

A
Ensure all systems are patched monthly.
Why wrong: Patching addresses known vulnerabilities, but ransomware can exploit zero-days or be delivered via social engineering without exploiting a vulnerability.
B
Implement application whitelisting on all workstations.
Application whitelisting allows only approved programs to run, blocking ransomware executables even if they are downloaded.
C
Deploy an email spam filter to block phishing emails.
Why wrong: Email filtering can reduce phishing attacks, but ransomware can also be delivered through other vectors such as malicious websites or USB drives.
D
Conduct annual security awareness training for all employees.
Why wrong: Training helps users recognize threats, but it is not foolproof and does not provide a technical barrier against all ransomware variants.

Full breakdown with real-world context →

Question 8mediumdrag order

Read the full Security explanation →

Drag and drop the steps to shut down a Windows 10 computer properly into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 9mediummatching

Read the full Security explanation →

Match each troubleshooting step to its order in the CompTIA A+ methodology.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Step 1

Step 2

Step 3

Step 5

Question 10easymultiple choice

Read the full Security explanation →

A user wants to ensure data confidentiality. Which action is most appropriate?

Trap 1: Change password

Changing password protects account access but does not encrypt files; data remains readable.

Trap 2: Share with everyone

Sharing with everyone reduces confidentiality and increases risk of unauthorized access.

Trap 3: Delete files

Deleting files removes them but does not protect data in use or in transit; it also may not securely erase data.

Study all Security common traps →

A
Encrypt files
Encryption transforms data into an unreadable format without a key, ensuring confidentiality.
B
Change password
Why wrong: Changing password protects account access but does not encrypt files; data remains readable.
C
Share with everyone
Why wrong: Sharing with everyone reduces confidentiality and increases risk of unauthorized access.
D
Delete files
Why wrong: Deleting files removes them but does not protect data in use or in transit; it also may not securely erase data.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Security explanation →

Which of the following is an example of a strong password?

Trap 1: 123456

Sequential numbers are easily guessed and widely used.

Trap 2: abc123

Combinations of common words and sequential numbers are weak.

Trap 3: password

Common words like 'password' are easily guessed and weak.

Study all Security common traps →

A
123456
Why wrong: Sequential numbers are easily guessed and widely used.
B
Cr@zy8#s
This password uses uppercase, lowercase, numbers, and symbols, making it strong.
C
abc123
Why wrong: Combinations of common words and sequential numbers are weak.
D
password
Why wrong: Common words like 'password' are easily guessed and weak.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Security explanation →

A company wants to prevent unauthorized physical access to its server room. Which control is best?

Trap 1: Firewall

A firewall controls network traffic, not physical entry.

Trap 2: Antivirus

Antivirus protects against malware, not physical access.

Trap 3: Encryption

Encryption protects data on storage, not physical access to the room.

Study all Security common traps →

A
Firewall
Why wrong: A firewall controls network traffic, not physical entry.
B
Antivirus
Why wrong: Antivirus protects against malware, not physical access.
C
Biometric lock
Biometrics verify identity based on physical characteristics, restricting entry to authorized personnel.
D
Encryption
Why wrong: Encryption protects data on storage, not physical access to the room.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Security explanation →

An employee receives an email from 'IT Support' asking for his password due to 'system maintenance'. This is an example of:

Trap 1: Baiting

Baiting offers something enticing, like a free download, whereas this email asks for password directly.

Trap 2: Tailgating

Tailgating is physically following someone into a secure area.

Trap 3: Pretexting

Pretexting involves creating a fabricated scenario, but phishing often uses urgency; however, this is specifically phishing as it uses email and impersonation.

Study all Security common traps →

A
Baiting
Why wrong: Baiting offers something enticing, like a free download, whereas this email asks for password directly.
B
Phishing
The email impersonates IT support and requests sensitive information, typical of phishing.
C
Tailgating
Why wrong: Tailgating is physically following someone into a secure area.
D
Pretexting
Why wrong: Pretexting involves creating a fabricated scenario, but phishing often uses urgency; however, this is specifically phishing as it uses email and impersonation.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full wireless explanation →

A small business wants to secure its wireless network. Which configuration provides the strongest encryption?

Trap 1: WPA

WPA improves on WEP but is still less secure than WPA2 and WPA3.

Trap 2: WEP

WEP is outdated and easily cracked due to weak encryption.

Trap 3: WPA2

WPA2 is strong but has been superseded by WPA3, which is more secure.

Study all Security common traps →

A
WPA
Why wrong: WPA improves on WEP but is still less secure than WPA2 and WPA3.
B
WEP
Why wrong: WEP is outdated and easily cracked due to weak encryption.
C
WPA2
Why wrong: WPA2 is strong but has been superseded by WPA3, which is more secure.
D
WPA3
WPA3 offers stronger encryption and improved security features over older standards.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Security explanation →

After a ransomware attack, which step should be taken FIRST in the incident response process?

Trap 1: Notify law enforcement

Notifying authorities is important but should happen after containment to avoid delay.

Trap 2: Restore from backup

Restoring from backup is part of recovery but should occur after containment and assessment.

Trap 3: Pay the ransom

Paying does not guarantee data recovery and encourages further attacks.

Study all Security common traps →

A
Notify law enforcement
Why wrong: Notifying authorities is important but should happen after containment to avoid delay.
B
Disconnect affected systems from network
Disconnecting stops the spread and limits damage, a crucial first step.
C
Restore from backup
Why wrong: Restoring from backup is part of recovery but should occur after containment and assessment.
D
Pay the ransom
Why wrong: Paying does not guarantee data recovery and encourages further attacks.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full Security explanation →

Which principle ensures that data is not modified by unauthorized users?

Trap 1: Authentication

Authentication verifies identity, but does not inherently prevent data modification.

Trap 2: Confidentiality

Confidentiality prevents unauthorized disclosure, not modification.

Trap 3: Availability

Availability ensures data is accessible when needed, not protection from modification.

Study all Security common traps →

A
Authentication
Why wrong: Authentication verifies identity, but does not inherently prevent data modification.
B
Confidentiality
Why wrong: Confidentiality prevents unauthorized disclosure, not modification.
C
Availability
Why wrong: Availability ensures data is accessible when needed, not protection from modification.
D
Integrity
Integrity ensures data is not altered by unauthorized means.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full Security explanation →

A user wants to prevent unauthorized access to their laptop if stolen. Which is the best method?

Trap 1: Antivirus

Antivirus scans for malware but does not prevent access to files if stolen.

Trap 2: Use a strong password

A strong password protects login but can be bypassed by booting from another OS or removing the drive.

Trap 3: Firewall

A firewall controls network traffic but does not protect data on a stolen device.

Study all Security common traps →

A
Antivirus
Why wrong: Antivirus scans for malware but does not prevent access to files if stolen.
B
Use a strong password
Why wrong: A strong password protects login but can be bypassed by booting from another OS or removing the drive.
C
Firewall
Why wrong: A firewall controls network traffic but does not protect data on a stolen device.
D
Enable BitLocker
BitLocker encrypts the entire drive, protecting data even if the laptop is stolen.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Security explanation →

Which type of malware replicates itself across a network without user interaction?

Trap 1: Virus

A virus requires user interaction (e.g., opening a file) to spread.

Trap 2: Ransomware

Ransomware encrypts files for ransom but usually requires user action to execute.

Trap 3: Trojan

A Trojan disguises itself as legitimate software but typically does not self-replicate.

Study all Security common traps →

A
Virus
Why wrong: A virus requires user interaction (e.g., opening a file) to spread.
B
Ransomware
Why wrong: Ransomware encrypts files for ransom but usually requires user action to execute.
C
Worm
Worms self-propagate across networks without human intervention.
D
Trojan
Why wrong: A Trojan disguises itself as legitimate software but typically does not self-replicate.

Full breakdown with real-world context →

Question 19mediummulti select

Read the full Security explanation →

Which TWO of the following are examples of social engineering attacks?

Trap 1: DDoS

A DDoS attack overwhelms a server with traffic, not social engineering.

Trap 2: Brute force

A brute force attack attempts many password combinations, typically automated.

Trap 3: Man-in-the-middle

MITM intercepts communications, often technical rather than social.

Study all Security common traps →

A
DDoS
Why wrong: A DDoS attack overwhelms a server with traffic, not social engineering.
B
Shoulder surfing
Shoulder surfing involves observing a user's screen or keyboard to capture information.
C
Brute force
Why wrong: A brute force attack attempts many password combinations, typically automated.
D
Man-in-the-middle
Why wrong: MITM intercepts communications, often technical rather than social.
E
Phishing
Phishing uses deceptive emails or messages to trick users into revealing credentials.

Full breakdown with real-world context →

Question 20hardmulti select

Read the full Security explanation →

Which THREE of the following are best practices for creating secure passwords?

Trap 1: Use the same password for all accounts for memorability

Reusing passwords increases risk if one account is compromised.

Trap 2: Use personal information like birthdate

Personal info is easy to guess or obtain via social engineering.

Study all Security common traps →

A
Use the same password for all accounts for memorability
Why wrong: Reusing passwords increases risk if one account is compromised.
B
Change password every 90 days
Regular changes limit the window of exposure if stolen.
C
Use at least 8 characters
Longer passwords are harder to crack.
D
Use personal information like birthdate
Why wrong: Personal info is easy to guess or obtain via social engineering.
E
Include a mix of uppercase, lowercase, numbers, symbols
Diverse character sets increase complexity.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Security sessions

Start a Security only practice session

Every question in these sessions is drawn from the Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Security questions →Mixed FC0-U61 session

Frequently asked questions

What does the FC0-U61 exam test about Security?: Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other FC0-U61 topics?: Use the topic links above to move to related areas, or go back to the FC0-U61 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the FC0-U61 exam covers. They are not copied from any real exam or dump site.

Security only

10 questions 20 questions 30 questions 50 questions

Mixed FC0-U61 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All FC0-U61 questions Security domain overview FC0-U61 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Security practice questions

What to know about Security

Common Security exam traps

Security questions

A security analyst is reviewing user permissions and discovers that several users have been granted more privileges than necessary to perform their job functions. The analyst wants to apply the principle of least privilege. Which TWO actions should the analyst take? (Choose TWO.)

A help desk technician receives an alert from the security monitoring system showing multiple events like the one in the exhibit. The technician is investigating a possible brute-force attack. Based on the exhibit, which of the following is the primary attack vector being used?

Exhibit

Which TWO of the following are examples of social engineering attacks?

Refer to the exhibit. A security analyst reviews the NTFS permissions on the C:\Shared folder. Which user or group has the ability to delete files created by other users?

Exhibit

Drag and drop the steps to shut down a Windows 10 computer properly into the correct order.

Match each troubleshooting step to its order in the CompTIA A+ methodology.

A user wants to ensure data confidentiality. Which action is most appropriate?

Which of the following is an example of a strong password?

A company wants to prevent unauthorized physical access to its server room. Which control is best?

An employee receives an email from 'IT Support' asking for his password due to 'system maintenance'. This is an example of:

A small business wants to secure its wireless network. Which configuration provides the strongest encryption?

After a ransomware attack, which step should be taken FIRST in the incident response process?

Which principle ensures that data is not modified by unauthorized users?

A user wants to prevent unauthorized access to their laptop if stolen. Which is the best method?

Which type of malware replicates itself across a network without user interaction?

Which TWO of the following are examples of social engineering attacks?

Which THREE of the following are best practices for creating secure passwords?

Track your progress over time

Start a Security only practice session

Related FC0-U61 topic practice pages

IT Concepts and Terminology practice questions

Infrastructure practice questions

Applications and Software practice questions

Software Development Concepts practice questions