SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
FC0-U71 · Domain 6

Security practice questions

Security is worth 19% of the FC0-U71 exam — the 2nd-heaviest of the 6 domains. The CIA triad and security frameworks, securing devices, password best practices, common encryption use cases, and securing a small wireless network. 6 fully worked examples are further down this page, answers included.

Exam weight
19%
the 2nd-heaviest of the 6 domains
Questions
62
across 2 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 6 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Security questions, fully explained

Questions from the FC0-U71 bank mapped to domain 6, with the answer key and the reasoning behind every option. None of them repeat the examples on the main FC0-U71 practice page.

Question 1Security

An attacker breaks into a supplier's email account, opens a pending invoice and changes its bank account number before the accounts team pays it. Which security goal was most directly violated by the change?

Choose one.

  • a
    Integrity Correct

    Integrity means data is accurate and has not been altered without authorization. A changed account number is a direct integrity violation.

  • b
    Confidentiality

    The attacker did read the invoice, but the change asked about is an altered account number. The harm that caused the loss is modified data, not disclosure.

  • c
    Availability

    The invoice stayed reachable and was paid on schedule, so availability was not the goal that failed.

  • d
    Authentication

    Authentication is proving who a user is at sign-in. It is a control that may have failed along the way, but the goal violated is the accuracy of the data.

The concept

Integrity is the CIA goal that data stays accurate and is changed only by authorized people.

Why that’s the answer

The attacker both read and altered the invoice, so two CIA goals are touched. The question asks about the change: an unauthorized modification to data is an integrity failure. Confidentiality covers who can read data, availability was not affected because the invoice was still paid on time, and authentication is a control rather than one of the three CIA goals.

How to reason it out
  1. Separate the two things the attacker did: read the invoice and altered it.
  2. The question asks about the alteration.
  3. An unauthorized change to data is a loss of integrity; reading it would be confidentiality.
  4. Availability held (it was paid), and authentication is a control, not a CIA goal.

Exam tip: Read without permission = confidentiality; changed without permission = integrity.

CompTIA Tech+ (FC0-U71): Security Concepts and Device Security — the lesson that teaches this.

Question 2Security

A student wants updates shared on a social networking site to be visible to people the student knows, not to the public. Which action is best?

Choose one.

  • a
    Turn on two-step sign-in

    Two-step sign-in protects the account from being taken over, but it does not change who can see the updates.

  • b
    Delete the browser cookies

    Deleting cookies removes stored site data on the student's own device; it does not change who can view updates on the site.

  • c
    Switch to private browsing

    Private browsing stops history being kept on the student's device. The updates are still public on the site.

  • d
    Edit the privacy settings Correct

    The site's privacy or audience settings decide who can see each update. Limiting the audience to friends or contacts keeps updates away from the public.

The concept

Social networking privacy is controlled by the site's audience and privacy settings, not by device or sign-in settings.

Why that’s the answer

Who sees a post is decided on the site by its audience setting. Two-step sign-in, clearing cookies and private browsing protect the account or the local device, but public posts stay public.

How to reason it out
  1. Identify the goal: limit who can view posts.
  2. That is controlled by the site's privacy/audience settings.
  3. Account and browser protections do not change post visibility.

Exam tip: Post visibility is set by the site's privacy settings, not by your browser.

CompTIA Tech+ (FC0-U71): Security Concepts and Device Security — the lesson that teaches this.

Question 3Security

A user shares a folder of tax documents with an accountant using a cloud link set to "Anyone with the link can view." Which change would best protect the documents' privacy?

Choose one.

  • a
    Change the link to allow comments instead

    Commenting is a different permission level, but the link still opens the files for anyone who has it.

  • b
    Set the link to expire after one week

    Expiry shortens the exposure, but until then anyone who has the link can still open the files.

  • c
    Move the files into a subfolder of the share

    A subfolder of a link-shared folder is shared through the same link, so nothing changes.

  • d
    Restrict access to specific named people Correct

    Granting access only to named, signed-in accounts means a forwarded or leaked link no longer opens the files.

The concept

File-sharing privacy depends on who the share is granted to; an 'anyone with the link' share works for whoever obtains the link.

Why that’s the answer

The weakness is who the share is granted to: anyone holding the link. Switching the link to commenting changes what a link holder can do, not who can see the files, and an expiry date only limits how long the link works. Restricting the share to named people makes the service check who is signing in, so a leaked link stops working.

How to reason it out
  1. Spot the weakness: the link works for anyone who has it.
  2. Ask which change ties access to specific people rather than to the link.
  3. A commenting link and an expiring link still open for whoever has them; a subfolder inherits the same link.
  4. Restricting to named people does tie access to identities.

Exam tip: Share sensitive files with named people, not with 'anyone with the link'.

CompTIA Tech+ (FC0-U71): Security Concepts and Device Security — the lesson that teaches this.

Question 4Security

Which of the following is an example of personally identifiable information (PII)?

Choose one.

  • a
    The average age of a store's customers

    An average is aggregate data about many customers and cannot point to one person, so it is not PII.

  • b
    A person's passport number Correct

    A passport number is unique to one person and can identify them directly, which makes it PII.

  • c
    A customer's favourite colour

    A favourite colour is about a person but is shared by huge numbers of people; on its own it identifies no one.

  • d
    A city's population figure

    A population total is aggregate data about many people and cannot identify one.

The concept

PII is any information that can identify a specific person, alone or combined with other data.

Why that’s the answer

A passport number points to exactly one person. An average age and a population total describe groups, and a favourite colour is personal but not identifying on its own.

How to reason it out
  1. Ask of each option: could this single out one specific person?
  2. Group statistics (averages, totals) cannot.
  3. A common personal preference cannot on its own.
  4. A passport number is unique to one individual, so it is PII.

Exam tip: If it can single out one person, treat it as PII.

CompTIA Tech+ (FC0-U71): Security Concepts and Device Security — the lesson that teaches this.

Question 5Security

A small online store based in the United States starts selling to customers who live in France and Germany, and it stores their names and home addresses. Which regulation would most likely apply to this data?

Choose one.

  • a
    HIPAA

    HIPAA is a US law for health information held by healthcare providers, insurers and their partners. A store's customer addresses are not covered by it.

  • b
    FERPA

    FERPA is a US law protecting student education records held by schools, not customer data held by a store.

  • c
    CCPA

    The California Consumer Privacy Act protects the personal data of California residents. Being a US company does not bring customers in France and Germany under it.

  • d
    GDPR Correct

    The General Data Protection Regulation covers personal data of people in the European Union, including when a company outside the EU sells to them.

The concept

Government regulations such as the EU's GDPR set rules for collecting and protecting personal data; GDPR follows the data subject, not the company's location.

Why that’s the answer

GDPR applies to organizations that offer goods or services to people in the EU, even if the organization is based elsewhere. CCPA is the tempting choice for a US company, but it protects California residents, not customers in France and Germany. HIPAA and FERPA cover health records and school records.

How to reason it out
  1. Note whose data it is: customers living in the EU.
  2. Recall that GDPR follows the data subject, wherever the company is based.
  3. Reject CCPA: it is about California residents, not where the company is.
  4. Rule out the sector laws for health and education records.

Exam tip: Selling to people in the EU brings their personal data under GDPR, wherever your company is.

CompTIA Tech+ (FC0-U71): Security Concepts and Device Security — the lesson that teaches this.

Question 6Security

On a first visit to a news website, a banner asks the visitor to accept or reject non-essential tracking before the site stores it in the browser. Which of the following best describes this banner?

Choose one.

  • a
    A pop-up blocker notice

    A pop-up blocker is a browser feature that stops sites opening extra windows; it does not ask about tracking.

  • b
    A certificate warning

    A certificate warning appears when the browser cannot verify a site's identity for HTTPS. It is not about tracking choices.

  • c
    A cookie consent prompt Correct

    Cookie consent banners ask visitors to allow or refuse non-essential cookies, such as tracking or advertising cookies, before they are set.

  • d
    A private browsing prompt

    Private browsing is turned on by the user in the browser; websites do not prompt for it.

The concept

Cookie consent: regulations such as GDPR and the EU ePrivacy rules require sites to ask before storing non-essential cookies.

Why that’s the answer

The banner asks permission before storing tracking data in the browser — that is exactly what a cookie consent prompt does. The other options are browser features or security warnings.

How to reason it out
  1. Note what the banner does: asks permission before tracking data is stored.
  2. Tracking data stored by sites in the browser is cookies.
  3. Asking permission for them is cookie consent.

Exam tip: A banner asking to accept or reject tracking = cookie consent.

CompTIA Tech+ (FC0-U71): Security Concepts and Device Security — the lesson that teaches this.

What FC0-U71 domain 6 tests, topic by topic

The official exam guide breaks Security into 2 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published FC0-U71 practice questions per topic in Security
TopicWhat it coversQuestions
Security Concepts and Device SecurityOfficial CompTIA Tech+ FC0-U71 objectives (document v4.0): 6.1 "Explain fundamental security concepts and frameworks." — examples: Confidentiality, integrity,, and availability, Privacy, Social networking sites, Email, File sharing, Instant messaging, Personally identifiable, information (PII), Government regulations, (e.g., General Data Protection, Regulations [GDPR]), Cookie consent, Authentication, authorization,, accounting, and non-, repudiation concepts, Authentication, Single factor, Multifactor, Single sign-on, Authorization, Permissions, ▪, Administrator vs. user accounts, Least privilege model. 6.2 "Explain methods to secure devices and security best practices." — examples: Security awareness, Social engineering, Phishing, Malicious or compromised content, Securing devices (mobile/, workstation), Authentication, Anti-malware, Firewall, Patching/updating, Physical device security, Cable locks, USB locks, Device use best practices, Licensing, Open source vs. proprietary, Subscription vs. one-time, purchase vs. perpetual, Product keys and serial numbers, Software sources, Researching and validating, legitimate sources, Original equipment, manufacturer (OEM) websites, vs. third-party websites, Application stores, Removal of software, Unwanted.30
Passwords, Encryption and Wireless SecurityOfficial CompTIA Tech+ FC0-U71 objectives (document v4.0): 6.3 "Explain password best practices." — examples: Password length, Password complexity, Password history, Password expiration, Password reuse across sites, Password managers, Password privacy, Password reset process, Changing default usernames, and passwords, Enabling passwords, Accounting, Logs, Location tracking, Web browser history, Unnecessary, Malicious, Software piracy, Safe browsing practices, Certificates, Valid, Invalid, Privacy considerations, Social networking sites, Email, File sharing, Instant messaging, AI. 6.4 "Identify common use cases for encryption." — examples: Plain text vs. ciphertext, Data at rest, File level, Disk level, Mobile device, Data in transit, Email, HTTPS, VPN, Mobile application. 6.5 "Given a scenario, configure security settings for a small wireless network." — examples: Changing the service set identifier (SSID), Changing the default password, Encrypted vs. unencrypted, Open, Pre-shared key, Wireless Protected Access (WPA), Wireless Protected Access 2 (WPA2), Wireless Protected Access 3 (WPA3).32
Total62

Revise Security before you drill it

CompTIA Tech+ (FC0-U71): Security Concepts and Device SecurityObjectives 6.1 and 6.2 are tested with short definitions ("Which of the following best describes…") and everyday scenarios in which a workplace or home user describes a problem or need and you choose the concept, control or action that fits. Distractors come from the same category, so expect to separate near-twins: the three CIA goals; the four access-control concepts; the authentication methods; email recipient fields and file-sharing options; personal vs aggregate data and the different privacy laws; necessary vs optional cookies; social engineering vs other threats; the device-protection layers and the two physical locks; license models and product identifiers; and trusted vs untrusted software sources and removal methods. Harder items combine two requirements, and only one option satisfies both. Read every qualifier — best, most likely, most directly — and the exact requirement in the stem.CompTIA Tech+ (FC0-U71): Password Best Practices, Encryption Use Cases and Wi-Fi SecurityObjectives 6.3 to 6.5 are tested with short definitions ("Which of the following best describes…") and everyday home, office and travel scenarios. Distractors are real items from the same category, so you must separate near-twins: length vs complexity, history vs expiration vs lockout, a password manager vs other ways of remembering passwords, file-level vs disk-level encryption, at-rest vs in-transit protection, HTTPS vs VPN vs email encryption, end-to-end vs server-side encryption, admin password vs SSID vs Wi-Fi passphrase, open vs pre-shared key, and WPA vs WPA2 vs WPA3 vs mixed modes. Harder items combine two facts, such as the limits of one protection when another is missing. Read every qualifier — best, most likely, first — and the exact requirement in the stem.

Other FC0-U71 domains

Domain 2: Infrastructure24% of the exam · 75 questionsDomain 3: Applications and Software18% of the exam · 53 questionsAll FC0-U71 practice questionsMixed sessions across all 6 domains — the way the real exam interleaves them.

Security: your questions

Security is domain 6 of the FC0-U71 exam guide and carries 19% of the scored content — the 2nd-heaviest of the 6 domains. On a 70-question paper that works out to roughly 13 questions, though CompTIA does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official FC0-U71 exam guide.