1. Home
2. All questions
3. Identity

CompTIA Security+ study material: Identity

84 questions of the 611 in the CompTIA Security+ quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 77. A service will only let users register if they also consent to their data being used for unrelated marketing analysis. What is wrong with this?
2. 78. An identity proofing system wrongly rejects a legitimate applicant. What must the provider offer?
3. 203. A system records which administrator changed a firewall rule and when. Which of the three AAA functions does this serve?
4. 217. An API key was accidentally committed to a Git repository and the commit was reverted an hour later. What must still be done?
5. 245. A relying party needs to know only whether a user is over eighteen. Which approach best satisfies privacy expectations?
6. 253. A service proofs users at a high level but allows single-factor login. Which NIST assurance components describe these two choices?
7. 254. Which authenticator arrangement satisfies AAL3?
8. 255. An application is being assessed at AAL2. What must its verifier offer users?
9. 256. A vendor claims their fingerprint-only login is multi-factor authentication. What is wrong with that claim?
10. 257. Which biometric arrangement does NIST prefer, and why?
11. 258. Under the current NIST digital identity guidelines, what is the minimum length for a password used as the only authentication factor?
12. 259. A policy requires every password to contain an uppercase letter, a digit and a symbol. What is NIST's current guidance?
13. 260. Under current NIST guidance, when must a verifier force a password change?
14. 261. When checking a new password against a blocklist, what must be compared?
15. 262. A team proposes expanding its password blocklist to a billion entries. Why does NIST consider this of little additional benefit?
16. 263. How must a verifier store passwords so they resist offline attack?
17. 264. What is the minimum salt length NIST specifies for stored passwords, and what does the salt achieve?
18. 265. NIST suggests an additional keyed operation over the stored password hash. Where should that secret key live?
19. 266. Which two authenticator types are classed as not phishing-resistant? Choose two.
20. 267. An attacker repeatedly requests a new out-of-band code hoping to reset the failed-attempt counter. What does NIST require?
21. 268. Before sending an authentication code over the telephone network, which two risk indicators should a verifier consider? Choose two.
22. 269. A service offers only SMS codes as its second factor. Beyond the interception risk, what NIST requirement does this miss?
23. 270. An organisation wants to use cloud-synced passkeys to meet AAL3. Why will this fail?
24. 271. What does the AAL3 requirement to demonstrate authentication intent mean in practice?
25. 272. At AAL2, what does NIST recommend for the overall session timeout and the inactivity timeout?
26. 273. How does an inactivity timeout differ from an overall session timeout?
27. 274. A login arrives from an unexpected country, so the system prompts for an extra check. Does the geolocation signal count as an authentication factor?
28. 275. A service uses strong multi-factor authentication but never learns the user's real name. Is this consistent with NIST guidance?
29. 276. At IAL1, how should attributes the subscriber supplies be treated?
30. 277. A user changes the phone number that receives their authentication codes. How should the system treat this operation?
31. 278. What does the AAL2 requirement for replay resistance prevent?
32. 279. Which combination represents two genuinely distinct authentication factors?
33. 280. Why does adding a security question to a password login not meaningfully improve resistance to credential stuffing?
34. 281. Why is a FIDO2 security key resistant to a convincing look-alike login page?
35. 282. An attacker with a valid password triggers repeated push approvals until the user taps accept. Which control most directly counters this?
36. 283. A login form replies "no such user" for unknown addresses and "incorrect password" for known ones. What does this enable?
37. 284. Besides the login form, which two flows commonly leak whether an address is registered? Choose two.
38. 285. At which moment must an application regenerate the session identifier to prevent session fixation?
39. 286. Which two cookie attributes protect a session identifier, and what does each achieve? Choose two.
40. 287. Which property must a session identifier have?
41. 288. A logout function deletes the session cookie in the browser but leaves the server-side session valid. What is the risk?
42. 289. Why should a session identifier never be carried in the URL?
43. 290. What does single sign-on actually change about how applications authenticate users?
44. 291. Which two security benefits does federation give a relying party? Choose two.
45. 292. What does the Federation Assurance Level describe?
46. 293. An attacker captures a valid assertion from one relying party and presents it to a second. Which assertion property prevents this from working?
47. 294. Which two assertion properties let a relying party reject a stale or already-used assertion? Choose two.
48. 295. Which protocol carries identity assertions as signed XML and is the long-standing choice for enterprise web single sign-on?
49. 296. A developer uses the presence of a valid OAuth 2.0 access token as proof of the user's identity. Why is this a mistake?
50. 297. Domain logons begin failing after a server's clock drifts by several minutes. Which authentication protocol explains this symptom?
51. 298. Which protocol is preferred for administering network devices because it separates authentication, authorisation and accounting and encrypts the whole payload?
52. 299. Which server usually sits behind 802.1X port-based network access control?
53. 300. An employee leaves and their accounts remain active for six weeks. Which process failed?
54. 301. Why does driving account provisioning from an authoritative HR source reduce risk?
55. 302. Which activity is designed to discover privilege creep?
56. 303. A service account cannot use an interactive multi-factor prompt. What should it rely on instead?
57. 304. What property of a secrets manager most reduces the value of a leaked credential?
58. 305. Which user behaviour does a password manager most directly eliminate?
59. 306. Which two properties must a password reset link have? Choose two.
60. 307. Why does certificate-based authentication resist network capture better than a password?
61. 308. A smart card requires a PIN before it will sign an authentication challenge. How many factors does this represent?
62. 309. Which biometric measure describes the rate at which impostors are wrongly accepted?
63. 310. Users complain that a fingerprint reader rejects them too often, so the sensitivity is lowered. What is the security consequence?
64. 311. An application creates a local account the first time the identity provider asserts a user. What is this called, and what problem does it solve?
65. 312. Why must AAL3 authenticators use public-key cryptography to protect the authentication secret?
66. 313. Which reauthentication limits does NIST associate with AAL3?
67. 314. A federal service will display personal information to signed-in users. What minimum assurance level applies?
68. 315. At every assurance level, what does NIST require of the channel between the claimant and the verifier?
69. 316. What are the minimum requirements for an out-of-band authentication secret?
70. 317. A one-time password is truncated to six digits. What obligation does that place on the verifier?
71. 318. Which single control does OWASP identify as the most valuable defence for user accounts?
72. 319. Why are hard-coded credentials in a container image particularly dangerous?
73. 356. A relying party requests the full user profile when it only needs a department name. What principle does this violate?
74. 363. With credential vaulting and automatic rotation, why can an administrator not reuse the password they just used?
75. 412. What is the main security difference between wireless personal mode and enterprise mode?
76. 456. An attacker tries the password "Autumn2026!" against several thousand accounts, one attempt each. Which attack is this, and why does it work?
77. 457. Which user behaviour makes credential stuffing effective?
78. 462. An attacker captures an authentication exchange on the network and replays it later to log in. Which property would have prevented this?
79. 463. How does session hijacking differ from credential theft?
80. 479. A keylogger is installed on a user's workstation. Which control most directly limits the damage?
81. 491. After gaining access, an adversary adds an SSH key and a group membership to the compromised account. Which technique is this, and what does it achieve?
82. 523. Why do the credentials held by an automation platform deserve particular protection?
83. 556. Why does NIST apply stricter FIPS 140 requirements to verifiers than to authenticators?
84. 587. Which two are identification and authentication failures? Choose two.