You're right—most real Security+ exam questions are multiple choice (single or multiple

select) with answer options. Scenario-based questions (PBQs) are also included, but the core
format remains multiple choice.

Here's how you can adapt the comprehensive weekly review questions I gave you, so they
better simulate the real Security+ test experience:

Week 1: Foundation & Core Concepts (with Multiple

Choice Options)
Security Principles & CIA Triad

1. What does the “integrity” pillar of the CIA triad ensure?

o A) That systems are always available
o B) That information is accurate and unaltered
o C) That only authorized users have access
o D) That information is backed up daily
2. Which of these is NOT a characteristic of availability?
o A) Redundant hardware
o B) Frequent backups
o C) Access control lists
o D) Load balancing
3. Which scenario below best demands high confidentiality?
o A) Hosting a public web server
o B) Distributing marketing brochures
o C) Storing medical patient records
o D) Creating a user help guide

Threats & Attacks

4. What is a phishing attack?

o A) Installing malware via USB drives
o B) Pretending to be a trusted entity to obtain sensitive information
o C) Cracking password hashes
o D) Intercepting network traffic
5. Which attack manipulates users into giving up sensitive information?
o A) Man-in-the-middle
o B) Phishing
o C) Zero-day exploit
o D) DoS
6. Malware can be described as which of the following?
o A) Benign code not meant to harm
o B) Software that provides useful features only
o C) Malicious software such as viruses or ransomware
o D) A protocol used for file transfer

Cryptography & PKI

7. What is the primary function of hashing in information security?

 o A) Encrypting data
o B) Hiding information
o C) Verifying data integrity
o D) Authenticating users
8. Which of these is a symmetric algorithm?
o A) AES
o B) RSA
o C) DSA
o D) ECC
9. PKI stands for:
o A) Pretty Key Infrastructure
o B) Public Key Infrastructure
o C) Private Key Implementation
o D) Professional Key Integration

Network Security Devices & Protocols

10. Which device segments a network into different broadcast domains?

o A) Hub
o B) Switch
o C) Router
o D) Firewall
11. Which port does SSH use by default?
o A) 21
o B) 22
o C) 23
o D) 25
12. What is the primary role of a firewall?
o A) Encrypt data
o B) Block all outgoing traffic
o C) Filter network traffic and block potential threats
o D) Store passwords

Passwords & Authentication

13. Which is an example of something-you-know authentication?

o A) Password
o B) Smart card
o C) Biometric scan
o D) Security token
14. Why is Password123 a weak password?
o A) It is not long enough
o B) It is commonly used and easy to guess
o C) It uses special characters
o D) It is case-sensitive
15. What is the difference between authentication and authorization?
o A) Authentication is granting access, authorization is proving identity
o B) Authentication proves identity, authorization grants access rights
o C) Both are the same
o D) Authorization involves encryption
Here’s a continuation of the Security+ weekly review questions in multiple-choice format,
organized by week—just like the real exam. Afterward, I'll explain the process to create a
PDF as requested, since I cannot generate file downloads directly.

Week 2: Networks, IAM, Protocols (with Options)

Secure Network Design & Segmentation

1. What is a DMZ in network security?

o A) Main corporate network
o B) Secure staff intranet
o C) Isolated network for external-facing services
o D) Wireless guest network
2. How do VLANs improve security?
o A) By speeding up internet connections
o B) By physically separating devices
o C) By logically segmenting networks
o D) By scanning for malware
3. Which is a physical security control for equipment rooms?
o A) Password policy
o B) CCTV cameras
o C) Firewall configuration
o D) Antivirus software

Wireless Security
4. Why is WEP insecure?

 A) Uses weak, easily cracked encryption

 B) Uses strong protocols
 C) Is only for wired connections
 D) Is not compatible with mobile devices

5. WPA3 is more secure than WPA2 because:

o A) Requires less complex passwords
o B) Offers better brute-force protections
o C) Disables encryption
o D) Allows only guest users
6. What is a recommended way to secure access points?
o A) Use default admin credentials
o B) Hide the SSID and use WPA2/WPA3 encryption
o C) Use open authentication
o D) Set static IPs for all devices

Identity & Access Management (IAM)

7. The principle of least privilege states:

 A) All users have admin access

 B) Users only get minimum access rights needed
 C) Privileges never change
  D) Access is managed by passwords only

8. Which is an example of two-factor authentication?

o A) Password only
o B) Smart card plus PIN
o C) Username only
o D) Facial recognition only
9. Federated identity allows:
o A) Identity sharing across organizations
o B) Multiple users to share passwords
o C) Unrestricted access
o D) Single factor authentication

Secure Protocols
10. SFTP provides:
- A) Unencrypted file transfer
- B) Secure file transfer using SSH
- C) Email encryption
- D) Two-factor authentication

11. What port is used by HTTPS?

o A) 21
o B) 22
o C) 80
o D) 443
12. For secure remote administration, you should use:
o A) Telnet
o B) FTP
o C) SSH
o D) HTTP

Week 3: Risk, Host, App Security (with Options)

Risk Management

1. Which defines a threat in risk management?

o A) A weakness in a system
o B) A potential danger exploits a vulnerability
o C) A software update
o D) An audit report
2. What is “residual risk”?
o A) Risk completely removed
o B) Risk remaining after controls are applied
o C) Unidentified risk
o D) All resource risk
3. Which is NOT a step in risk management?
o A) Risk assessment
o B) Risk monitoring
o C) Marketing evaluation
 o D) Risk mitigation

Security Assessment & Tools

4. Which tool scans for open ports?

 A) Password manager
 B) Port scanner
 C) VPN client
 D) Intrusion prevention system

5. Penetration testing is best described as:

o A) Auditing software licenses
o B) Simulating an attack to find vulnerabilities
o C) Developing encryption algorithms
o D) Training new employees
6. Vulnerability scanners are used to:
o A) Patch vulnerabilities automatically
o B) Detect known security weaknesses
o C) Encrypt hard drives
o D) Segment networks

Incident Response
7. Which is a phase in incident response?

 A) Investigation only
 B) Containment
 C) User education
 D) Software installation

8. On detecting an incident, your first step should be:

o A) Monitor business impact
o B) Document incident
o C) Contain the incident
o D) Run a backup
9. Why document security incidents?
o A) For regulatory compliance and future prevention
o B) To share on social media
o C) To increase network traffic
o D) For hardware troubleshooting

Secure System & Application Design

10. System hardening is:
- A) Allowing all services by default
- B) Disabling unnecessary features and services
- C) Installing new software weekly
- D) Encrypting only application code

11. Which is an operating system hardening measure?

o A) Creating guest accounts
o B) Updating and removing unused services
 o C) Disabling antivirus
o D) Disabling firewalls
12. Why are application patches important?
o A) Slow down systems
o B) Fix vulnerabilities and improve security
o C) Increase social engineering risk
o D) Allow remote access

Week 4: Advanced Topics & Mock Exam (with Options)

Social Engineering & Physical Security

1. Tailgating into a building can be prevented by:

o A) CCTV only
o B) Mantraps or security guards
o C) Free Wi-Fi
o D) Visitor badges only
2. “Vishing” is:
o A) Phishing by email
o B) Social engineering via phone call
o C) A wireless attack
o D) Malware propagation
3. Physical server room security includes:
o A) Software updates
o B) Locked doors and access controls
o C) Wireless security
o D) Web filters

Crypto Attacks & Countermeasures

4. A brute force attack tries to:

 A) Trick a user into revealing a password

 B) Guess every possible password or key
 C) Encrypt files with ransomware
 D) Sniff network traffic

5. To defend against rainbow table attacks, use:

o A) Strong firewall rules
o B) Salting passwords before hashing
o C) Two-factor authentication only
o D) Wireless encryption
6. A man-in-the-middle attack:
o A) Steals data from backup drives
o B) Intercepts and possibly alters communication between two parties
o C) Compromises a server’s hard drive
o D) Is a type of DDoS

Cloud, Virtualization, Mobile Security

7. Which cloud model offers most control over virtual machines and OS?
  A) SaaS
 B) IaaS
 C) PaaS
 D) DaaS

8. A risk with BYOD is:

o A) Improved compliance
o B) Data leakage if a device is lost/stolen
o C) More secure admin access
o D) Easier patching
9. A good mobile device security measure is:
o A) No device encryption
o B) Strong device PIN and remote wipe capabilities
o C) Sharing credentials via SMS
o D) Using outdated OS versions

Review/Exam Strategy
10. Using timed practice exams helps:
- A) Increase panic levels
- B) Simulate real test conditions and boost time management
- C) Slow down learning
- D) Provide exam answers

11. If unsure about a question on test day, best strategy is:

o A) Skip and never return
o B) Make the best guess and flag for review
o C) Ask the proctor for help
o D) Choose ‘A’ for every uncertain answer
12. The Pomodoro technique involves:
o A) Studying all day without breaks
o B) Alternating short focused study with regular breaks
o C) Eating after every module
o D) Reviewing with a group only
 Answer Keys for Weekly Multiple-Choice Practice Sets
Week 1: Foundation & Core Concepts
1. B
2. C
3. C
4. B
5. B
6. C
7. C
8. A
9. B
10. C
11. B
12. C
13. A
14. B
15. B

Week 2: Networks, IAM, Protocols

1. C
2. C
3. B
4. A
5. B
6. B
7. B
8. B
9. A
10. B
11. D
12. C

Week 3: Risk, Host, App Security

1. B
2. B
3. C
4. B
5. B
6. B
7. B
8. C
9. A
10. B
11. B
12. B

Week 4: Advanced Topics & Mock Exam

1. B
2. B
3. B
4. B
5. B
6. B
7. B
8. B
9. B
10. B
11. B
12. B