UUS Practice Tests⌕ Search
IT Certifications

CompTIA Security Pro Competency Assessment Practice Test

The CompTIA Security Pro Competency Assessment practice page focuses on practical security decisions involving identity, data protection, application security, and incident response. Its questions use workplace scenarios such as recognizing a suspicious sign-in request, verifying signed software, limiting the impact of a compromised account, and containing a suspected ransomware infection.

Exam overview

Exam providerCompTIA
Exam codeNot listed
CategoryIT Certifications

About the CompTIA Security Pro Competency Assessment Exam

Security work requires matching a control to the risk it is meant to reduce. Practice scenarios address phishing response, least privilege, secure disposal of encrypted devices, and initial investigation of repeated failed logins. They also touch on wireless authentication with individual identities, parameterized database queries to reduce SQL injection risk, and digital signatures for integrity and sender verification. Another useful distinction is between validating that a control operates as intended and attempting to exploit a weakness. For each scenario, identify the asset or process at risk, determine what evidence is available, and select a response proportionate to the immediate threat. These decisions reflect tasks performed in security administration and operations, including account protection, secure software handling, log triage, and incident containment.

Sample Practice Questions

Review a selection from this exam's published US Practice Tests practice bank.

Question 1

A user receives an unexpected email asking them to sign in through a link to prevent account suspension. What is the safest response?

  1. AOpen the link in a private browser window
  2. BReply asking the sender to confirm the request
  3. CNavigate to the organization’s known sign-in page independently and report the email
  4. DForward the email to coworkers to ask whether it looks legitimate
Show answerCorrect answer: C

An unexpected message that pressures the recipient to sign in may be phishing. Using a known address or bookmark avoids the potentially malicious link, and reporting the message helps the security team investigate.

Question 2

A security administrator needs to verify that a downloaded software file matches the publisher’s signed release. Which method best supports both integrity and publisher authenticity?

  1. ACompare the file size with the size listed on an unrelated website
  2. BVerify the file’s digital signature using a trusted publisher certificate
  3. COpen the file in a text editor and inspect its first lines
  4. DRename the file to include the publisher’s name
Show answerCorrect answer: B

A valid digital signature, checked against a trusted certificate and expected publisher identity, can provide evidence that the file has not been altered and was signed by the associated publisher. File names and sizes do not establish authenticity.

Question 3

Which control most directly limits the damage if an application account is compromised?

  1. AGrant the account only the permissions needed for its assigned tasks
  2. BRequire users to change their passwords every week
  3. CStore application logs on the same server
  4. DAllow the account to use administrator privileges for convenience
Show answerCorrect answer: A

Least privilege reduces the actions and resources available to a compromised account, limiting potential impact. The other choices do not provide the same direct restriction on access.

Question 4

A company is planning to dispose of an encrypted laptop that may contain sensitive business data. Which action most reliably addresses the risk that the data could be recovered from the device?

  1. ADelete the user’s desktop shortcuts
  2. BRemove the laptop from the asset inventory
  3. CUse an approved media sanitization process appropriate to the storage device
  4. DRename the laptop before disposal
Show answerCorrect answer: C

An approved sanitization process is designed to make stored data unrecoverable or to render the storage media unusable, depending on the method and device. Administrative changes such as renaming or inventory removal do not erase data.

Question 5

A server’s security log shows repeated failed sign-in attempts from an unfamiliar external address. What is the most useful initial step for the security team?

  1. AReview the event details and correlate them with other relevant logs
  2. BErase the log to prevent disclosure of the attempts
  3. CAssume the account was compromised and publish the password
  4. DDisable logging on the server to reduce storage use
Show answerCorrect answer: A

Reviewing and correlating logs helps determine the scope, timing, and context of the activity, including whether any attempts succeeded. Preserving logs supports investigation and response.

Question 6

An organization is deploying a wireless network for employees and wants to protect access using individual user identities rather than one shared passphrase. Which approach is most suitable?

  1. AUse enterprise wireless authentication integrated with an authentication server
  2. BUse an open wireless network and hide its network name
  3. CUse one shared password posted in a staff area
  4. DAllow devices to connect without authentication and rely on signal range
Show answerCorrect answer: A

Enterprise wireless authentication can validate individual users or devices through a central authentication service, supporting individual credentials and access management.

Question 7

A public-facing web application accepts user input that is later included in database queries. Which development practice most directly helps prevent SQL injection?

  1. AUse parameterized queries rather than building queries by concatenating input
  2. BHide the database server’s name in the application interface
  3. CRequire users to submit longer input strings
  4. DStore database passwords in client-side code
Show answerCorrect answer: A

Parameterized queries separate SQL instructions from user-provided values, reducing the chance that input will be interpreted as executable query syntax. Hiding server details does not correct unsafe query construction.

How to use this practice test

Access is free. The practice session presents up to 20 random questions from the available bank of 50 and shows results when the session ends. Use missed or uncertain answers to identify which security decisions need closer review, such as distinguishing integrity checks from publisher authentication or containment from investigation.

Preparation tips

  • For suspicious sign-in messages, verify requests through a separate trusted channel rather than following embedded links.
  • Compare hashing with digital signatures: consider what each can establish about file integrity, sender authenticity, or both.
  • Review least-privilege and account-scoping controls, and explain how each limits damage after credential compromise.
  • Practice choosing immediate ransomware containment steps that isolate the affected endpoint from shared resources.
  • For web input and wireless access scenarios, connect parameterized queries and individual-identity authentication to the specific risks they address.
Official sourceOfficial exam page ↗