1500 Questions | CompTIA SecurityX Certification 2026

Evaluating network architecture, components, and protocols.

Deploying robust network defenses against modern attack vectors.

Domain 2.0: Compliance and Operational Security (19%)

Implementing strict data protection and data classification handling.

Executing high-level incident response and disaster recovery protocols.

Domain 3.0: Threats and Vulnerabilities (16%)

Utilizing industry-standard tools like OpenVAS, Nessus, and Wireshark.

Identifying and mitigating malware variants (viruses, worms, trojans, rootkits) and social engineering tactics.

Domain 4.0: Application, Data and Host Security (21%)

Securing mobile and cloud-based application infrastructures.

Applying advanced data encryption concepts and cryptographic methods.

Domain 5.0: Access Control and Identity Management (18%)

Managing account lifecycles, password complexities, and group policies.

Configuring robust user authentication, authorization, and data protection mechanisms.

B) Implementing a Zero Trust architecture with micro-segmentation.

C) Upgrading the network to use a traditional demilitarized zone (DMZ).

D) Configuring dynamic VLAN assignment on all access switch ports.

E) Enabling Network Address Translation (NAT) across all internal subnets.

F) Implementing a network-based intrusion detection system (NIDS) in sniffer mode.

Correct Answer: B

Explanation:

Option A is incorrect: A perimeter firewall only protects the boundary between the internal network and the outside world. It does not stop lateral movement once an attacker is already inside.

Option C is incorrect: A DMZ isolates public-facing servers from the internal network but does not stop lateral movement within the internal user segments.

Option D is incorrect: Dynamic VLANs assign users to specific networks based on credentials but do not inherently prevent lateral movement if the attacker has already compromised a valid user device within that VLAN.

Option E is incorrect: NAT hides internal IP addresses from external networks; it provides no internal segmentation or lateral movement prevention.

Option F is incorrect: A NIDS in sniffer mode only detects and alerts on malicious traffic; it does not actively block or contain lateral movement.

B) Enforcing a strict Data Classification Policy document.

C) Implementing an Endpoint Data Loss Prevention (DLP) solution.

D) Restricting access using Role-Based Access Control (RBAC).

E) Configuring a Security Information and Event Management (SIEM) system.

F) Enabling full disk encryption (FDE) via BitLocker on all corporate endpoints.

Correct Answer: C

Explanation:

Option A is incorrect: EDR focuses on detecting and responding to malicious behavior and malware activities on endpoints, not data exfiltration based on policy compliance.

Option B is incorrect: A policy document is an administrative control, not a technical control that can automatically block a physical data transfer.

Option D is incorrect: RBAC limits what data a user can access within an application, but it does not stop them from transferring files they already have legitimate access to view.

Option E is incorrect: A SIEM aggregates and analyzes log data for security alerts, but it does not proactively block a file transfer to a USB drive in real-time.

Option F is incorrect: FDE protects data at rest if the entire laptop is lost or stolen, but it does not prevent a logged-in user from copying unencrypted files to an external drive.

B) A passive network vulnerability scan using OpenVAS.

C) A brute-force attack simulated via Hydra.

D) Automated exploitation using the Metasploit Framework.

E) Protocol analysis and packet capture using Wireshark.

F) Wireless cracking using the Aircrack-ng suite.

Correct Answer: B

Explanation:

Option A is incorrect: While Nessus is a vulnerability scanner, active credentialed scans actively probe ports and can sometimes cause performance degradation on sensitive legacy equipment if not carefully configured. Passive scanning is safer for zero disruption.

Option C is incorrect: Hydra is an active password cracking tool that generates heavy traffic and can lock out accounts, disrupting operations.

Option D is incorrect: Metasploit is an exploitation framework used to actively break into systems, which frequently crashes unstable production systems.

Option E is incorrect: Wireshark is a packet analyzer used to look at traffic data, but it does not automatically map or identify infrastructure-wide system vulnerabilities.

Option F is incorrect: Aircrack-ng is exclusively used for auditing wireless network security, not general enterprise infrastructure vulnerability scanning.

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app