CompTIA ITF+ ITF+ Information Security Principles 2 — Questions and Answers
Question 1: A user receives an email claiming their bank account will be suspended unless they click a link and verify their credentials. What type of attack is this?
- Pharming
- Phishing (Correct answer)
- Vishing
- Smishing
Correct answer: Phishing
Phishing uses deceptive emails that impersonate trusted entities to trick users into revealing credentials.
Question 2: Which of the following BEST describes the principle of least privilege?
- Users should share accounts to reduce administrative overhead
- Users should only have the minimum access rights needed to perform their job (Correct answer)
- Administrators should have access to all systems for troubleshooting
- Passwords should be the shortest length possible for convenience
Correct answer: Users should only have the minimum access rights needed to perform their job
Least privilege limits user access rights to only what is necessary, reducing the attack surface.
Question 3: What is the purpose of multi-factor authentication (MFA)?
- To allow users to log in without a password
- To require verification from two or more different categories of credentials (Correct answer)
- To store passwords in multiple locations for redundancy
- To encrypt data during transmission
Correct answer: To require verification from two or more different categories of credentials
MFA requires proof from at least two categories: something you know, have, or are — making unauthorized access much harder.
Question 4: A company stores customer credit card numbers in plain text in a database. Which security control is MOST needed?
- Firewall
- Encryption (Correct answer)
- Antivirus
- Physical lock
Correct answer: Encryption
Encryption converts sensitive data into an unreadable format, protecting it even if the database is compromised.
Question 5: Which of the following is an example of 'something you are' in authentication?
- PIN number
- Smart card
- Fingerprint scan (Correct answer)
- Security token
Correct answer: Fingerprint scan
Biometrics like fingerprints represent 'something you are' — a physical or behavioral characteristic unique to the user.
Question 6: What does a VPN primarily provide for remote workers?
- Faster internet speeds
- A secure, encrypted tunnel over a public network (Correct answer)
- Free access to geo-restricted content
- Automatic malware removal
Correct answer: A secure, encrypted tunnel over a public network
A VPN creates an encrypted tunnel that protects data as it travels across untrusted networks like the internet.
Question 7: An attacker intercepts and alters communication between two parties without their knowledge. What type of attack is this?
- Denial of service
- Man-in-the-middle (Correct answer)
- SQL injection
- Brute force
Correct answer: Man-in-the-middle
A man-in-the-middle attack secretly intercepts and potentially alters communications between two parties.
CompTIA ITF+ ITF+ Information Security Principles 2
A user receives an email claiming their bank account will be suspended unless they click a link and verify their credentials.
What type of attack is this?