4.1 Given a scenario, apply common security techniques to computing resources
Objective 4.1 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A 16-character hexadecimal session ID has its first 8 characters fixed for every user and only the last 8 characters randomly generated. How much actual entropy does this identifier provide?
The concept
Entropy counts only the parts an attacker cannot predict. A value's length says nothing on its own, because any portion that is constant, derived from something guessable, or reused across users contributes zero. For a hexadecimal string, each unpredictable character is worth four bits, and the guessing cost is two raised to that total. A structurally long token can therefore be far weaker than its size suggests.
Why this answer
Each hex character carries 4 bits of entropy; with only 8 random characters remaining, the effective entropy is 32 bits, below the required minimum.
- Correct. Eight unpredictable hex characters, four bits apiece.
- BThat figure treats the fixed prefix as if it varied. It does not.
- CAn undercount: eight hex characters carry twice that.
- DTwo hex characters would give this. The scenario leaves eight unpredictable.
Now you: objective 4.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
Disclosure, capture, prediction, brute force, or fixation of a session identifier can lead to which attack, in which an attacker fully impersonates a victim user?
Sample question 2 of 3
An attacker targets any valid user session rather than a specific privileged account, and also attempts to submit a session ID through a URL query string to bypass cookie protections. Which combination best describes this risk?
Sample question 3 of 3
A DevOps team wants infrastructure as code misconfigurations and exposed secrets found across GitHub and GitLab repositories correlated with cloud security context for remediation prioritization. Which capability provides this?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Operations
- 4.2 4.2 Explain the security implications of proper hardware, software, and data asset management
- 4.3 4.3 Explain various activities associated with vulnerability management
- 4.6 4.6 Given a scenario, implement and maintain identity and access management
- 4.7 4.7 Explain the importance of automation and orchestration related to secure operations
- 4.8 4.8 Explain appropriate incident response activities
- 4.9 4.9 Given a scenario, use data sources to support an investigation