Free CompTIA Security+ practice test

In an automated CI/CD pipeline, which activity examines infrastructure as code in isolation to flag misconfigurations before any resources are deployed?

An analyst reviews a web app that echoes unsanitized input in responses and also stores it for other users to view. Which two cross-site scripting types are present? (Choose two.)

A team wants staff to judge an incoming message before clicking any link in it. Which combination of signs should awareness training tell them to watch for?

A user reports that a session cookie was captured on an open wireless network after the browser sent it over an unencrypted request. Which cookie attribute stops that?

An engineer configures a new device to validate server certificates and must decide what the device needs before any chain can be checked. Where does path validation begin?

A network team loses power alerts sent as SNMP traps and needs the receiver to acknowledge each notification. Which SNMP protocol data unit provides that acknowledgement?

Drives holding sensitive records will be reused inside the organization, and data recovery must stay infeasible even against laboratory techniques. Which sanitization category applies?

A team deploys a firewall rule that makes a known injection threat harder to exploit, without removing the vulnerable code or involving a third party. Which risk strategy is being applied?

What is the approximate round-trip latency target for network links between availability zones in a region?

An organization must monitor physical access to the building housing its servers and detect physical security incidents there. Which three methods fit? (Choose three.)