How should I use these Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security domain.

FC0-U61 · topic practice

Security practice questions

Practise CompTIA ITF+ FC0-U61 Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Security

Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Security practice questions

What to know about Security

Common Security exam traps

Security questions

Which of the following best describes the principle of confidentiality in the CIA triad?

A company implements a policy requiring employees to use a password and a one-time code sent to their mobile phone when logging into the corporate network. Which security concept is being employed?

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains urgent language and threats of account closure. What type of attack is this?

Which of the following is the strongest password?

A security analyst discovers that a file on a server has been modified without authorization. However, the system logs show that the modification was made by an authenticated user who had legitimate access to the file. Which aspect of the CIA triad has been violated?

Which of the following malware types is characterized by self-replication without needing to attach to a host file?

A company wants to ensure that sensitive documents are not readable if a laptop is stolen. Which of the following provides the best protection?

What is the primary purpose of a password manager?

An attacker gains physical access to a building by following an employee through a secured door without using a badge. This is an example of which social engineering technique?

Which of the following is the best practice for creating strong passwords?

A user downloads a free game from an untrusted website. After installation, the user's computer begins displaying pop-up advertisements frequently. Which type of malware is most likely installed?

An organization uses a security model where users are granted the minimum permissions necessary to perform their job functions. This model is known as:

Which TWO of the following are effective measures to protect against ransomware attacks? (Select two.)

Which THREE of the following are examples of multi-factor authentication? (Select three.)

Which TWO of the following are recommended practices for physical security in an office environment? (Select two.)

Which of the following best describes the principle of least privilege?

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The user notices the email address is slightly misspelled (e.g., 'support@bankk.com' instead of 'support@bank.com'). Which type of attack is this?

An organization implements a security control that requires users to swipe a smart card and then enter a PIN to access a secure facility. Which combination of authentication factors does this represent?

Which of the following is a characteristic of a worm in the context of malware?

A company wants to protect its network from unauthorized external access. Which of the following devices should be configured to filter traffic based on port and protocol?

Track your progress over time

Start a Security only practice session

Related FC0-U61 topic practice pages

IT Concepts and Terminology practice questions

Infrastructure practice questions

Applications and Software practice questions

Software Development practice questions

Database Fundamentals practice questions

Security practice questions

Software Development Concepts practice questions

FC0-U61 fundamentals practice questions

FC0-U61 scenario practice questions

FC0-U61 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid