44 Threats, Attacks & Vulnerabilities Practice Questions & Answers

1. 1. An investigation at a defence supplier finds a foothold established fourteen months earlier, malware that used a flaw with no vendor patch at the time, credential collection confined to engineers on one weapons programme, and no attempt to monetise anything. Which conclusion does the evidence best support?

   • A.A nation-state actor conducting espionage, shown by sustained access and a programme-specific target✓ Answer
   • B.Organised crime preparing ransomware, shown by the long dwell time before any payload was fired
   • C.An unskilled attacker whose purchased exploit kit happened to land on a valuable engineering host
   • D.An insider abusing legitimate rights, since only one programme's engineering staff were affected

   Capability and intent identify the actor, not the tooling. Fourteen months of undetected access, use of a flaw for which no patch existed, tight targeting of one weapons programme and the complete absence of monetisation are the signature of a well-resourced state-sponsored espionage operation; criminal groups monetise quickly and unskilled attackers lack both the zero-day and the patience.

   Ref QB-PGST9FSource: CompTIA Security+ Exam Objectives, Threats, Vulnerabilities and Mitigations domain: threat actor attributes (resources, sophistication) and motivations (espionage); CISA advisories on advanced persistent threat activityReport a problem with this question

2. 2. A ransomware case shows an affiliate identifier inside the ransom note, a leak site branded by a different group, negotiation through a chat portal offering a discount deadline, and encryption tooling already seen at victims in unrelated sectors. What does this structure indicate?

   • A.A nation-state operation using ransomware as cover for espionage across several unrelated sectors
   • B.A criminal enterprise selling ransomware as a service, with an affiliate using its tooling✓ Answer
   • C.A hacktivist collective publishing victim data in order to advance a political position on those sectors
   • D.An unskilled attacker who reused leaked builder code and wrote the note and the leak site himself

   Ransomware as a service splits the work: a core group builds and maintains the encryptor and the leak site while paid affiliates carry out intrusions, which is exactly why an affiliate identifier appears alongside another group's branding and why the same tooling turns up across unrelated sectors. The motivation throughout is financial gain, the defining driver of organised crime.

   Ref QB-7ZXYUFSource: CompTIA Security+ Exam Objectives, threat actors and motivations (organised crime, financial gain); CISA #StopRansomware guidance on ransomware-as-a-service affiliate operationsReport a problem with this question

3. 3. Logs show scanning from a residential address using a tool's default banner, exploit attempts for flaws patched years ago fired in alphabetical order, no effort to clear traces, and a public forum post asking what the target's error message means. Which actor profile fits?

   • A.An organised crime affiliate doing paid reconnaissance before selling the access to a buyer
   • B.An advanced persistent threat creating deliberate noise to mask a quieter second intrusion path
   • C.An insider probing from a home connection so that internal reconnaissance looks external
   • D.An unskilled attacker using prebuilt tooling, shown by blind attempts and a plea for help✓ Answer

   The discriminator is sophistication, not location. Default banners, an exhaustive alphabetical sweep of long-patched flaws, no anti-forensics and a public request for help all show an attacker running someone else's tools without understanding them, which is what the unskilled attacker category describes; capable actors tailor their attempts and hide their tracks.

   Ref QB-QG56FGSource: CompTIA Security+ Exam Objectives, threat actors: unskilled attacker (low sophistication, prebuilt tools) and level of capability as a distinguishing attributeReport a problem with this question

4. 4. Hours after a utility announces a disputed contract, its public site is defaced with a political statement and hit by a traffic flood. Internal systems are untouched, although a valid VPN credential was sitting on the defaced host. Which reading fits the evidence?

   • A.Organised crime staging extortion, with the defacement proving a deeper foothold to the victim
   • B.An unskilled attacker defacing a random target and flooding it with a rented stresser service
   • C.A nation-state rehearsing disruption of utilities while hiding intent behind political slogans
   • D.Hacktivists seeking visibility for a cause, because reachable internal access was left unused✓ Answer

   Motivation is read from what the attacker did not do. An actor after money or intelligence would have used the VPN credential to move inland; leaving it untouched while maximising public visibility, in immediate response to a policy announcement, marks a philosophical or political motivation, which is the defining driver of hacktivism.

   Ref QB-4ZVYBCSource: CompTIA Security+ Exam Objectives, threat actors and motivations: hacktivist, philosophical/political beliefs, service disruptionReport a problem with this question

5. 5. Over three weeks a senior analyst's account copies 4 GB from a research share to a personal cloud folder, always within her shift, from her assigned laptop, using rights her role already carries. She resigns the day after the final copy. What does the evidence establish?

   • A.Shadow IT, since the personal cloud folder is an unsanctioned service rather than an attack
   • B.An insider threat, since authorised rights and normal hours defeat outsider controls✓ Answer
   • C.A compromised account, since an external actor copied the analyst's usual pattern of working
   • D.Credential replay, since one captured session was reused again across the three-week period

   Every indicator points inward: her own device, her own shift, and entitlements the role legitimately grants, so nothing anomalous exists for perimeter or behavioural baselines to fire on. That combination of legitimate access with harmful intent is what makes insider activity the hardest category to detect, and the resignation supplies the motive.

   Ref QB-MG36XCSource: CompTIA Security+ Exam Objectives, threat actors: insider threat (internal, legitimate access, motivations including revenge and financial gain)Report a problem with this question

6. 6. A discovery review finds a marketing team paying for an unapproved analytics service on a corporate card, uploading customer email lists to it, and linking it to the customer database through a token one member generated. No exception was ever requested. How should this be handled?

   • A.An acceptable pilot: the card statement records it, so no further action is needed for now
   • B.An insider attack: deliberate theft of data, so suspend the accounts and refer the team to legal
   • C.Shadow IT: unsanctioned but work-motivated, so inventory the service and bring it under review✓ Answer
   • D.A supply chain compromise: the vendor is hostile, so revoke the token and block its domain

   Shadow IT is unsanctioned technology adopted to get work done, not an attack; the people involved are trying to do their jobs. The risk is unmanaged attack surface and data leaving governed systems, so the correct response is to discover and inventory the service, assess it, and either sanction it under contract and controls or replace it.

   Ref QB-5Z8BHDSource: CompTIA Security+ Exam Objectives, threat actors: shadow IT (internal, unsanctioned, non-malicious) and unmanaged attack surfaceReport a problem with this question

7. 7. A supplier receives a bank-detail change inside an existing thread, sent from the buyer's finance director's own mailbox. Message authentication passes, the address and display name are genuine, and a copy sits in the director's sent items. Which conclusion fits the evidence?

   • A.Typosquatting: a lookalike domain passes authentication because the attacker registered it
   • B.Brand impersonation: the message copies the buyer's house style, which authentication misses
   • C.Business email compromise: a real mailbox was taken over, so header checks cannot help✓ Answer
   • D.Pharming: the resolver handed back an attacker address, so the reply reached a false server

   When the message originates from the legitimate mailbox, every technical authenticity check passes because the mail genuinely is authentic: the account, not the domain, is the thing that was compromised. Defences therefore have to be procedural, above all out-of-band verification of any change to payment details using a number already on file.

   Ref QB-NGEG4ESource: CompTIA Security+ Exam Objectives, human vectors: business email compromise; FBI Internet Crime Complaint Center guidance on business email compromise and out-of-band verificationReport a problem with this question

8. 8. Staff receive a text message on personal phones naming the company's payroll provider, warning that a direct deposit is suspended, and linking through a shortened address to a copy of the single sign-on page. What is this, and why is it hard to control?

   • A.Smishing: the lure arrives by carrier text on personal handsets, outside mail filtering✓ Answer
   • B.Vishing: a spoken channel is used, so mail gateway rules and attachment sandboxing do not apply
   • C.Watering hole: a site the staff already visit was altered, so the link looks completely normal
   • D.Whaling: senior executives are singled out, so ordinary awareness training rarely reaches them

   Smishing is phishing delivered by short message service. Because the message reaches a personal handset over the carrier network, the corporate mail gateway never sees it, the shortened address hides the destination, and no link rewriting or attachment sandbox applies; the practical defences are awareness, phishing-resistant authentication and an easy reporting path.

   Ref QB-AZZYCKSource: CompTIA Security+ Exam Objectives, human vectors: smishing (message-based vectors including SMS)Report a problem with this question

9. 9. Caller A tells a service desk agent he is running the quarterly access audit and needs the list of accounts holding administrator rights, naming no individual. Caller B tells the same agent that she is the vice-president of finance and demands a password reset. How are the two calls classified?

   • A.A used pretexting, an invented scenario; B used impersonation, assuming a specific identity✓ Answer
   • B.A used impersonation of the audit team; B used pretexting, because urgency was the real lever
   • C.Both used business email compromise, carried out over the telephone instead of by electronic mail
   • D.A used misinformation to shape belief; B used whaling, because a senior executive was named

   Pretexting supplies an invented situation that makes the request sound routine, and it needs no particular identity; impersonation goes further by assuming a specific persona or role whose authority the victim already accepts. Caller A leans on the story alone, caller B on the borrowed identity, which is precisely the line between the two techniques.

   Ref QB-TG76YKSource: CompTIA Security+ Exam Objectives, human vectors: pretexting and impersonation as distinct social engineering techniquesReport a problem with this question

10. 10. Four unrelated engineering firms are compromised in one week. Each infection follows a visit to the same industry association's news page, which served a malicious script only to visitors resolving from those four firms' address ranges. Which technique does the evidence show?

    • A.A phishing campaign, because each infection started with a link the engineers chose to open
    • B.A supply chain attack, because the association distributes software updates to its member firms
    • C.An on-path attack, because the script was inserted into traffic between the firms and the site
    • D.A watering hole attack, reaching chosen targets indirectly through a site they habitually use✓ Answer

    In a watering hole the attacker cannot reach the target directly, so it compromises a third-party site the target group visits by habit and serves the payload only to visitors from the intended networks. The selective delivery by address range is the giveaway: it keeps the compromise hidden from the site's other visitors and from researchers.

    Ref QB-QAGU7DSource: CompTIA Security+ Exam Objectives, human vectors: watering hole attackReport a problem with this question

11. 11. Invoices arrive from a domain that differs from the supplier's by one transposed letter. The page it hosts reproduces the supplier's logo, colours and portal layout, and presents a valid certificate issued for that lookalike domain. Which pairing describes what the attacker did?

    • A.Pharming supplied the domain; a watering hole supplied the page content that the victim trusts
    • B.Domain shadowing supplied the domain; misinformation supplied the invoice the victim then pays
    • C.Brand impersonation supplied the domain; the valid certificate supplied the identity assurance
    • D.Typosquatting supplied the domain; brand impersonation supplied the appearance the victim trusts✓ Answer

    Two techniques combine here. Typosquatting registers a misspelled or transposed version of a real domain so that a glance at the address bar reassures the reader, while brand impersonation copies the look and feel so the page reassures as well. The certificate proves only control of the lookalike domain, never that the holder is the real supplier.

    Ref QB-7TAPMCSource: CompTIA Security+ Exam Objectives, human vectors: typosquatting and brand impersonation; certificate validation confirms domain control, not organisational identityReport a problem with this question

12. 12. Within a day, dozens of newly created social accounts post identical claims that a manufacturer's product has been recalled for safety. No recall exists, the contact centre is swamped, and a fake notice carrying the firm's logo circulates. What is happening and what comes first?

    • A.A phishing campaign built on a fake notice: block the linked domain and reset customer passwords
    • B.A disinformation campaign run by fake accounts: issue an authoritative denial and preserve the posts✓ Answer
    • C.A hacktivist denial of service on support: rate limit the contact centre and open an availability case
    • D.Brand impersonation of the logo only: file a trademark complaint and treat it as a marketing matter

    Coordinated false claims pushed by throwaway accounts to damage an organisation are a disinformation campaign, a human vector listed alongside phishing. The immediate response is to correct the record from an authoritative channel the audience already trusts and to capture the posts and account details as evidence before they are deleted.

    Ref QB-PA5H2CSource: CompTIA Security+ Exam Objectives, human vectors: misinformation and disinformationReport a problem with this question

13. 13. Branded USB drives appear in the staff car park. One inserted into an isolated test machine registers itself as a keyboard, types a command and opens a connection to an external host. Which conclusion and control pairing is correct?

    • A.A trojan hidden in a document on the drive: require an antivirus scan before any file may be opened
    • B.A worm spreading by automatic execution of files: disable autorun for all removable media volumes
    • C.A removable device attack posing as a keyboard: enforce port control over the device classes accepted✓ Answer
    • D.A hardware keylogger built into the drive: inspect workstation ports for unauthorised attachments

    The drive is not carrying a file that someone must open; it declares itself a human interface device and injects keystrokes the moment it is plugged in, so scanning files and disabling autorun both miss it entirely. Only a control that decides which device classes a port may accept, backed by policy on found media, actually blocks this vector.

    Ref QB-6TXBFBSource: CompTIA Security+ Exam Objectives, threat vectors: removable device; mitigation by configuration enforcement and disabling portsReport a problem with this question

14. 14. An employee reports that ten minutes ago she typed her username, password and a one-time code into a page opened from an email link. She has already changed the password. What must follow, and why is the password change by itself insufficient?

    • A.Revoke her live sessions and re-enrol her tokens, because the attacker may already hold a session✓ Answer
    • B.Purge the message from every mailbox, because further clicks are the only remaining exposure here
    • C.Rebuild her workstation from the image, because entering a code proves malicious code is resident
    • D.Block the sending address at the gateway, because otherwise the same campaign will simply repeat

    A site that relays credentials and the one-time code in real time completes the login itself and keeps the resulting session cookie, which survives a later password change because the session was already authenticated. Containment therefore means invalidating active sessions and refresh tokens, re-enrolling the factor, and then reviewing what that session did.

    Ref QB-NAS6VASource: CompTIA Security+ Exam Objectives, indicators of malicious activity: credential replay and concurrent session usage; NIST SP 800-61 guidance on containmentReport a problem with this question

15. 15. A message to three members of one team names a live internal project and their manager, and attaches a signature-request file that opens a credential page. Gateway reputation feeds show nothing. Which conclusion and response fit best?

    • A.Targeted spear phishing built on research: report it so all three recipients can be checked at once✓ Answer
    • B.Bulk phishing that merely mentions a project: deleting the message is enough and no report is needed
    • C.Whaling, since a manager is named: escalate only if an executive mailbox was among those targeted
    • D.Business email compromise, given the internal detail: treat the manager's mailbox as already breached

    Accurate internal detail and a recipient list of three show reconnaissance-driven spear phishing rather than a bulk run, and low volume is exactly why reputation feeds have nothing yet. Prompt reporting is the control that matters: it lets the team pull the message, check whether the other recipients submitted credentials, and block the infrastructure.

    Ref QB-5TKZ9ASource: CompTIA Security+ Exam Objectives, human vectors: phishing and targeted variants; NIST SP 800-61 on user reporting as a precursor and incident detection sourceReport a problem with this question

16. 16. Between 02:00 and 05:00, sixty servers are infected. Telemetry shows every infection began with an inbound connection to a file-sharing service port from an already infected host, no user was signed in, and no message or document was opened. Which conclusion does this support?

    • A.A trojan: users installed a disguised program earlier and it activated on a timer during the night
    • B.A virus: an infected file ran on each host, opened by a scheduled job rather than by any person
    • C.A worm: it spreads by exploiting a network service, so no user action is needed at those hours✓ Answer
    • D.A logic bomb: dormant code already on all sixty servers fired at a set hour without any network path

    The separating test between the malware families is what the spread requires. A virus needs a host file to be executed and a trojan needs a user to install it, whereas a worm propagates on its own by exploiting a reachable network service, which is the only family consistent with host-to-host infection at night with nobody signed in.

    Ref QB-MAEUP9Source: CompTIA Security+ Exam Objectives, indicators of malicious activity: malware attacks (worm, virus, trojan); NIST glossary definition of a worm as self-replicating without user actionReport a problem with this question

17. 17. Before files were encrypted, flow records show 300 GB leaving a file server over an encrypted web session to a consumer storage provider across two nights, and shadow copies and the backup catalogue were deleted minutes before the ransom note appeared. What does this change?

    • A.The deleted copies prove a wiper and not ransomware, so no usable decryption key is likely to exist
    • B.Only availability was harmed, so restoring from offline copies closes the incident with nothing further
    • C.The outbound transfer proves an insider, so the response should centre on investigating employees
    • D.A data breach also occurred, so notification and legal duties apply even if backups restore everything✓ Answer

    Bulk outbound transfer before encryption is the signature of double extortion: the attacker keeps a copy to sell or publish whether or not the ransom is paid. That makes the event a confidentiality incident as well as an availability one, so regulatory and contractual notification obligations are triggered and restoring from backup does not end the matter.

    Ref QB-4T8P49Source: CompTIA Security+ Exam Objectives, malware attacks (ransomware) and indicators including resource inaccessibility; CISA #StopRansomware guidance on data theft and double extortionReport a problem with this question

18. 18. A database administrator resigned two months ago. Today a stored job, created by him and running under a service account, checks whether his own account still exists and, finding it removed, drops a set of tables. What is this, and which control would have caught it first?

    • A.A worm: self-spreading code; network segmentation between database and application tiers
    • B.A logic bomb: code fired by a condition; peer review of scheduled jobs during offboarding✓ Answer
    • C.A rootkit: hidden persistent code; boot-time integrity scanning of the database servers
    • D.Ransomware: a destructive payload; immutable backup copies kept offline from the estate

    A logic bomb is code planted in advance that stays inert until a condition is met, here the disappearance of the author's own account. Because it lives in an ordinary scheduled job rather than in a malicious binary, antivirus has nothing to detect; reviewing and re-owning automation as part of offboarding is what surfaces it.

    Ref QB-KA3HH8Source: CompTIA Security+ Exam Objectives, malware attacks: logic bomb; mitigation by access control review and decommissioning of accounts and automationReport a problem with this question

19. 19. A host's own tools list forty running processes and show no unusual connections, while a memory image captured from outside the operating system lists forty-three, one of them holding an open socket to an external address. What does the discrepancy indicate?

    • A.The memory image is stale, because a live host always reports its own process list accurately
    • B.A keylogger is running in user space and conceals itself by renaming its own running process
    • C.A rootkit at kernel level is filtering what the host's own interfaces report back to the analyst✓ Answer
    • D.Spyware has switched off logging, so the host's counts are right but the log entries are gone

    A rootkit operates at or below the level of the operating system and intercepts the calls that enumerate processes, files and connections, so any tool that asks the compromised kernel receives a sanitised answer. Comparing that answer with an out-of-band source such as a memory image or an offline scan is the standard way to expose it.

    Ref QB-3TVBX7Source: CompTIA Security+ Exam Objectives, malware attacks: rootkit; NIST glossary description of rootkits subverting operating system reportingReport a problem with this question

20. 20. Three users on one floor have had passwords used from outside the company. Endpoint scans are clean, no unfamiliar processes or outbound sessions exist on their machines, and all three type on wired keyboards at shared hot desks. What should drive the next step?

    • A.A software keylogger is evading the scanner, so send memory images to the antivirus vendor for analysis
    • B.Credential replay is under way, so shorten session lifetimes on the applications those users reach
    • C.A hardware keylogger may sit between keyboard and port, so inspect the physical connections there✓ Answer
    • D.Browser spyware is installed, so remove the extensions and clear every credential saved in the profile

    Software running on the endpoint would leave something for scanning, process listing or network telemetry to find. A keystroke logger implemented in hardware sits on the cable or in the port, captures input before the operating system ever sees it and stores or transmits it independently, so only physical inspection of shared desks can rule it out.

    Ref QB-ACTNYVSource: CompTIA Security+ Exam Objectives, malware attacks: keylogger; threat vector of removable and attached hardware devicesReport a problem with this question

21. 21. New laptops ship with a manufacturer's update utility that runs as a privileged service, is used by no business process, and fetches its instructions over an unauthenticated channel. Which characterisation and action fit the finding?

    • A.Bloatware widening the attack surface: strip it from the standard build image before deployment✓ Answer
    • B.A trojan planted in the supply chain: quarantine the whole batch and notify law enforcement now
    • C.A rootkit shipped by the vendor: reflash the firmware of every machine before it is issued to staff
    • D.Spyware gathering telemetry: leave the utility in place and block its domains at the web gateway

    Bloatware is preinstalled software the organisation never asked for and does not use; it is not malicious, but a privileged service that takes instructions over an unauthenticated channel is exactly the kind of unnecessary component an attacker abuses. Removing unnecessary software from the build is the listed hardening step that closes it.

    Ref QB-TUYTJWSource: CompTIA Security+ Exam Objectives, malware attacks: bloatware; hardening technique of removing unnecessary softwareReport a problem with this question

22. 22. One workstation opens an encrypted web connection to the same external host every sixty minutes, give or take a few seconds, with a nearly constant request size and almost nothing returned, continuing through nights and weekends. The domain was registered eleven days ago. What does the pattern indicate?

    • A.A misconfigured monitoring agent: unattended hours explain traffic with no user at the keyboard
    • B.Command and control beaconing: a regular interval and a constant size fit an implant reporting in✓ Answer
    • C.A legitimate software update check: vendors poll hourly and newly registered domains are normal
    • D.Bulk data exfiltration in progress: a steady schedule fits a staged transfer of very large files

    Beaconing is recognised by its shape rather than its content: a fixed interval with small random jitter, a near-constant request size, minimal response data and no dependence on working hours describe an implant asking a controller for instructions. Exfiltration would show large asymmetric outbound volume, and update checks follow user and patch cycles.

    Ref QB-9CFBTUSource: CompTIA Security+ Exam Objectives, indicators of malicious activity: command and control traffic and resource consumption indicators; NIST SP 800-61 on identifying precursors and indicators in network trafficReport a problem with this question

23. 23. A service copies a hostname field of attacker-controlled length from a packet into a fixed 64-byte array on the stack without checking that length. Crash dumps show the saved return address replaced by attacker-supplied bytes and the instruction pointer diverted into the stack. Which finding fits, and which platform defenses raise the cost of exploiting it?

    • A.A memory injection into a signed process; code signing and kernel driver blocking are the platform defenses.
    • B.A time-of-check to time-of-use race condition; file locking and atomic opens are the platform defenses.
    • C.A stack buffer overflow past the array; address randomization and execution prevention are the platform defenses.✓ Answer
    • D.An integer overflow inside the allocator; guard pages and heap slab isolation are the platform defenses.

    Writing more bytes than the allocated array holds corrupts whatever sits next to it on the stack, and the saved return address is the classic target because overwriting it redirects execution to attacker-chosen bytes. Address space layout randomization makes the target address unpredictable and execution prevention marks the stack non-executable, so both attack the exploitation step rather than the coding defect; the defect itself is fixed by bounding the copy.

    Ref QB-SUMGDVSource: CompTIA Security+ exam objectives (application vulnerabilities: buffer overflow); CWE-121 stack-based buffer overflowReport a problem with this question

24. 24. A privileged backup utility calls an access-check function to confirm the invoking user may read a path, then a moment later opens that same path by name. An attacker repeatedly replaces the path with a symbolic link to a protected file in the interval between the two calls and obtains its contents. Which finding fits, and what removes it?

    • A.A time-of-check to time-of-use race, removed by opening the file once and testing the descriptor that was opened.✓ Answer
    • B.A directory traversal, removed by rejecting any path that resolves outside the permitted backup directory.
    • C.A privilege escalation from the privileged binary, removed by dropping elevated rights before any file work.
    • D.A malicious update of the utility, removed by verifying the vendor signature before the binary is installed.

    The check and the use are two separate operations on a name rather than one operation on an object, so the state can change in the gap between them; that non-atomic sequence is what makes time-of-check to time-of-use a race condition rather than a plain logic error. Opening once and then inspecting the returned descriptor binds the decision to the object actually opened, so a later substitution of the name has nothing left to influence.

    Ref QB-CCHBBYSource: CompTIA Security+ exam objectives (race conditions: time-of-check/time-of-use); CWE-367Report a problem with this question

25. 25. An endpoint tool reports that a signed operating-system process holds a private memory region marked readable, writable and executable, and is beaconing outbound every five minutes. The executable on disk still matches the vendor's published hash, and no new service or driver was installed. Which conclusion fits the evidence?

    • A.The vendor executable was replaced by a malicious update, so the hash recorded on disk no longer applies.
    • B.The code runs inside the memory of a trusted process, so disk integrity checks still pass.✓ Answer
    • C.The kernel carries a hidden toolkit below the operating system, so the process list is falsified.
    • D.The platform firmware runs an implant before boot, so that memory belongs to the platform.

    Memory injection places attacker code into the address space of a process that is already running and already trusted, which is why the file on disk is untouched and its hash still validates. The tell is a private region that is writable and executable at the same time inside a process that has no legitimate reason to generate code, so detection has to come from runtime memory and network behavior rather than from file integrity.

    Ref QB-VUPGWYSource: CompTIA Security+ exam objectives (application vulnerabilities: memory injection)Report a problem with this question

26. 26. A web log records the request GET /invoice?id=7%20OR%201%3D1-- and the application returned every invoice row in the table instead of one. Which finding does the log line support, and which fix addresses the cause rather than the symptom?

    • A.Cross-site scripting in the page output, fixed by encoding untrusted values when they are rendered.
    • B.Injection into the database query, fixed by parameterized statements that bind input only as data.✓ Answer
    • C.A request forgery from another origin, fixed by a per-request token the attacker's page cannot read.
    • D.A directory traversal in the file layer, fixed by canonicalizing the path before any access decision.

    The decoded parameter is 7 OR 1=1--, which turns the record filter into a condition that is always true and comments out whatever followed, so the application returns the whole table; that behavior identifies input being concatenated into the query text. Parameterized statements send the query structure and the values separately, so the same characters can never be parsed as query logic, which is why filtering quotes or keywords only narrows the symptom.

    Ref QB-BC6Z5XSource: CompTIA Security+ exam objectives (web-based: SQL injection); CWE-89Report a problem with this question

27. 27. Every visitor who opens one product page has their session cookie sent to an unfamiliar host. The page template is unchanged in the repository; the payload arrives from a customer review saved in the database months ago and written into the page without encoding. Which finding fits, and what stops it?

    • A.A session replay by an on-path device, stopped by issuing a fresh session token after each valid login.
    • B.Reflected cross-site scripting, stopped by refusing requests whose query string contains script markup.
    • C.Injection into the database query, stopped by binding all review text through parameterized statements.
    • D.Stored cross-site scripting, stopped by encoding stored values on output and restricting script sources.✓ Answer

    The script lives in the application's own data store and is served to every later viewer with no crafted link involved, which is the defining shape of stored cross-site scripting rather than the reflected variety that needs one poisoned request per victim. The payload executes in each visitor's browser under the site's origin, so it can read that visitor's cookie; encoding on output and a policy that restricts which script sources may run both break the execution step.

    Ref QB-UUB6RXSource: CompTIA Security+ exam objectives (web-based: cross-site scripting); CWE-79Report a problem with this question

28. 28. An administrator with a valid session in the payroll application opens an unrelated web page in another browser tab. That page silently submits a form to the payroll application's add-user endpoint, and the request succeeds because the browser attached the session cookie. Which attack is this, and which control defeats it?

    • A.An on-path interception, defeated by requiring the application to be reached only over an encrypted channel.
    • B.Cross-site request forgery, defeated by a token tied to the session that the third-party page cannot read.✓ Answer
    • C.Credential replay of a captured token, defeated by rejecting authentication material that has been seen before.
    • D.Stored cross-site scripting, defeated by encoding every untrusted value at the point where the page is built.

    The application authorized a state-changing request purely because a valid session cookie rode along with it, so the attacker never needed the credential itself, only the victim's authenticated browser. An anti-forgery token placed in the request body and checked server-side cannot be read or guessed by a page on another origin, which is why it, rather than encryption of the channel, is the control that matches this mechanism.

    Ref QB-EC8ZN2Source: CompTIA Security+ exam objectives (application attacks: forgery); CWE-352 cross-site request forgeryReport a problem with this question

29. 29. Server logs show repeated requests to a document viewer of the form file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd, and one response was unusually large. The developer's proposed fix rejects any parameter containing the literal characters ../. Which assessment is correct?

    • A.The finding is command injection, and the fix fails because the interpreter receives the parameter unchanged.
    • B.The finding is an injection into the query, and the fix works once quoting is applied to the parameter.
    • C.The finding is directory traversal, and the fix fails because encoded sequences are decoded after the check.✓ Answer
    • D.The finding is a buffer overflow in the viewer, and the fix works because the input length is now bounded.

    The parameter is percent-encoded, so %2e%2e%2f is the same traversal sequence written in a form that contains no literal ../ at the moment a string comparison would run; the platform decodes it afterwards and the file is read from outside the document root. A pattern check placed before decoding therefore misses the attack, and the reliable order is to decode and canonicalize the path first, then compare the resolved result against the directory the viewer is permitted to serve.

    Ref QB-XUD693Source: CompTIA Security+ exam objectives (application attacks: directory traversal); CWE-22Report a problem with this question

30. 30. A network diagnostics page takes a host value and builds the string ping -c 4 <host>, which it hands to a command interpreter. An audit request supplies 8.8.8.8; cat /etc/passwd and the response body includes account entries. Which change removes the class of flaw rather than one payload?

    • A.Strip semicolons and pipe characters from the host value before the command string is assembled.
    • B.Run the diagnostics page under an unprivileged account so the command can read fewer files.
    • C.Escape the whole host value in double quotes so the interpreter treats it as a single word.
    • D.Invoke the program directly, passing the host as a separate argument with no interpreter.✓ Answer

    The flaw exists because user text is concatenated into a string that a command interpreter then parses, so the interpreter, not the application, decides where one command ends and the next begins. Executing the program directly with the value delivered as a discrete argument means no shell parsing happens at all, which closes every metacharacter at once; removing selected characters or quoting leaves the parsing step in place and repeatedly proves bypassable.

    Ref QB-FGH7HESource: CompTIA Security+ exam objectives (application attacks: injection); CWE-78 OS command injectionReport a problem with this question

31. 31. A monitoring agent is updated through the vendor's normal update service. The package carries a valid vendor signature, but within hours every updated host begins contacting an unfamiliar domain and staging archives of local files. Which description fits, and which practice would have limited the damage?

    • A.A zero-day flaw in the agent's parser; add signature detection for the domain and the archive file format.
    • B.An unpatched vulnerability exploited before the fix; shorten the patch window so updates are applied sooner.
    • C.A malicious update delivered through a trusted channel; stage releases to a small ring and watch its egress first.✓ Answer
    • D.A rogue installer downloaded from a look-alike site; require that updates come only from the vendor's service.

    Nothing about the delivery was abnormal: the channel was the vendor's own and the signature validated, which is precisely what defines a malicious update as distinct from a spoofed download, because trust in the publisher was itself the delivery mechanism. Since signature checking cannot detect it, the practical defense is procedural — release to a limited group first and observe its outbound behavior before the change reaches the rest of the estate.

    Ref QB-XYB2XDSource: CompTIA Security+ exam objectives (application: malicious update; supply chain: software provider)Report a problem with this question

32. 32. A managed service provider holds a standing domain administrator account in each customer tenant for remote support. Attackers compromise the provider's management console and use those accounts to deploy tooling across many customers at once. Which mitigation addresses the structural problem?

    • A.Require the provider to carry a recognized security certification and annual third-party attestation.
    • B.Replace standing provider accounts with scoped access granted for a fixed window and logged per session.✓ Answer
    • C.Encrypt customer data at rest so the provider's tooling cannot read the files it copies off hosts.
    • D.Add multifactor authentication to every employee mailbox and remote access account at the customer.

    The damage scaled because a single compromise inherited permanent, broad privilege in every tenant at the same moment, so the structural defect is the standing high-privilege account rather than the provider's diligence or the customer's own login controls. Granting narrow access only for the duration of an approved task, and recording each session, means a stolen console yields little standing power and leaves an audit trail that shows what was used.

    Ref QB-GGVHPFSource: CompTIA Security+ exam objectives, Objectives 2.2 and 2.3 (supply chain: managed service providers, service provider); NIST SP 800-161 third-party access practicesReport a problem with this question

33. 33. A machining controller runs an operating system the vendor no longer supports, and production cannot be interrupted to replace the controller for eighteen months. Which course of action treats the real exposure during that period?

    • A.Confine it to a restricted network zone that permits only the few flows it needs, and monitor those flows.✓ Answer
    • B.Install a current endpoint protection suite on it and rely on updated signatures to block known attacks.
    • C.Apply community-built patches for the abandoned system so the known flaws are closed in place.
    • D.Record the gap as accepted risk with an owner and a review date, leaving the configuration unchanged.

    An unsupported platform will receive no further fixes, so the vulnerability cannot be removed and the only lever left is reducing what can reach it and what it can reach. Segmentation with a tight allow list of flows plus monitoring is the recognized compensating control for end-of-life and legacy systems; unofficial patches are unverifiable against a vendor baseline, and simply documenting acceptance changes nothing about the exposure.

    Ref QB-YYPC4FSource: CompTIA Security+ exam objectives (hardware: end-of-life, legacy) and (segmentation, isolation)Report a problem with this question

34. 34. Camera management logs show successful administrator sign-ins to forty devices from one internal workstation between 03:10 and 03:25, with no failed attempts preceding any of them and no password reset recorded. What does the absence of failed attempts most strongly suggest, and what should be corrected?

    • A.An unknown flaw in the web interface was used, so add signature detection for the exploit pattern.
    • B.A captured authentication token was replayed, so bind each session to a nonce and a timestamp.
    • C.A spraying run stayed under the lockout limit, so lower the threshold and alert on distributed tries.
    • D.The devices still answer to documented factory credentials, so set unique passwords on every unit.✓ Answer

    Forty first-attempt successes with no guessing traffic means the credential was already known rather than discovered, and the credential an attacker can know in advance for an embedded fleet is the manufacturer's documented default. Because the default requires no exploit and no guessing, the correcting control is setting distinct credentials on each unit, which is exactly why default password changes sit in the hardening list.

    Ref QB-DGTH6CSource: CompTIA Security+ exam objectives (default credentials) and (default password changes)Report a problem with this question

35. 35. A laptop is wiped and reimaged from known-good media twice, and both times the same implant is active within minutes of first boot, before the endpoint agent starts. Replacing the drive makes no difference. Which explanation and control pair fit the evidence?

    • A.Code persists in the imaging media; file hashing of the image and an offline build host address it.
    • B.Code persists in the platform firmware; signed firmware updates and measured boot with attestation address it.✓ Answer
    • C.Code persists in a network appliance; segmentation of the client subnet and egress filtering address it.
    • D.Code persists in a scheduled task; configuration enforcement and a hardened build baseline address it.

    Survival across a full reimage and a drive swap rules out anything stored in the file system or on the disk, leaving code that lives in writable platform firmware and executes before the operating system loads. The controls therefore have to act at that layer: only signed firmware images may be written, and measured boot records each stage into a hardware register so an attestation check can reveal that the pre-boot state no longer matches the expected one.

    Ref QB-VYMCKBSource: CompTIA Security+ exam objectives (hardware: firmware) and (hardening); UEFI secure boot and measured bootReport a problem with this question

36. 36. A cloud tenant provisions new block storage and finds fragments of another customer's records in areas of the volume it never wrote. Guest isolation held: no tenant reached the hypervisor or another guest's memory. Which vulnerability is this, and why is the nearest alternative wrong?

    • A.Virtual machine escape, because reading another tenant's data proves the guest boundary was crossed.
    • B.An insecure direct object reference, because the tenant addressed a volume it was not entitled to.
    • C.A cryptographic failure, because the unwritten areas of the volume were left without encryption at rest.
    • D.Resource reuse, because reallocated storage carried residual data rather than isolation being broken.✓ Answer

    Resource reuse is a data-remnant problem: shared capacity is released by one tenant and handed to another without being cleared, so old content is visible through an entirely legitimate allocation. Virtual machine escape is a different failure in which a guest breaks out of its isolation to reach the hypervisor or host, and nothing here crossed that boundary, which is why sanitizing on reallocation and encrypting tenant volumes are the fixes rather than hardening the hypervisor.

    Ref QB-EG6VBDSource: CompTIA Security+ exam objectives (virtualization: resource reuse, virtual machine escape)Report a problem with this question

37. 37. An investigator finds that a marketing object-storage container was left readable by anonymous callers and that search engines had indexed the files. No credential was stolen, no software flaw was used, and the provider's platform behaved exactly as documented. How should this be classified and assigned?

    • A.A supply chain weakness owned by the provider, since its default policy allowed public listing.
    • B.A cryptographic weakness owned by the customer, since the container was served without encryption.
    • C.A zero-day in the storage service, since files were retrieved by parties with no account at all.
    • D.A misconfiguration owned by the customer, since access policy sits on the customer's side of the model.✓ Answer

    Nothing was exploited: the service enforced the access policy it was given, and that policy permitted anonymous reads, which makes this a misconfiguration rather than a vulnerability in the platform. Under the shared responsibility division the provider secures the infrastructure while the customer configures identity, access policy and data settings, so both the finding and the remediation belong to the customer.

    Ref QB-WYYPRCSource: CompTIA Security+ exam objectives (cloud-specific vulnerabilities; misconfiguration); cloud shared responsibility modelReport a problem with this question

38. 38. Clients reach an internal portal through a device that rewrites the handshake so both sides settle on an obsolete protocol version with an export-grade cipher, after which the traffic is readable. Which attack is this, and which server-side change removes the opportunity?

    • A.A downgrade attack, removed by refusing obsolete versions and weak suites so no fallback exists.✓ Answer
    • B.A collision attack, removed by replacing the certificate's signing hash with a stronger function.
    • C.A credential replay, removed by adding a nonce and a timestamp to every authentication exchange.
    • D.A birthday attack, removed by lengthening the session key so the search space becomes too large.

    A downgrade attack does not break the strong cryptography; it manipulates negotiation so the parties never use it, settling instead on a version or cipher suite that is already known to be weak. The countermeasure is therefore configuration rather than key strength: when the server offers no obsolete versions and no weak suites, there is nothing to fall back to and the negotiation either succeeds at full strength or fails outright.

    Ref QB-KGXH7KSource: CompTIA Security+ exam objectives (cryptographic attacks: downgrade)Report a problem with this question

39. 39. A researcher generates large numbers of candidate documents until two of them hash to the same digest under a legacy hash function, then uses the pair to swap one signed contract for another. Which statement assigns the two terms correctly?

    • A.The matching digests are the birthday attack; the search through candidates is called the collision.
    • B.Both terms name the same event, so collision and birthday attack are interchangeable descriptions.
    • C.The matching digests are a preimage; the search that found the pair is a rainbow table lookup.
    • D.The matching digests are the collision; the search that exploits probability is the birthday attack.✓ Answer

    A collision is the condition in which two different inputs map to one digest, while the birthday attack is the technique for finding such a pair efficiently, exploiting the birthday paradox so that roughly the square root of the output space must be searched rather than the whole of it. A preimage attack is a different goal entirely, since it starts from a given digest and looks for an input that produces it.

    Ref QB-3ZRCMJSource: CompTIA Security+ exam objectives (cryptographic attacks: collision, birthday)Report a problem with this question

40. 40. Two password databases are stolen. In the first, every password was hashed together with a long random value stored beside it and unique to that account; in the second, the same hash function was used with no such value. The attacker's precomputed tables crack the second set quickly and are useless against the first. Which statement explains the difference?

    • A.The stored value encrypts each digest, so a key must be recovered before guessing can start.
    • B.The stored value is unique per account, so one precomputed table covers no account at all.✓ Answer
    • C.The stored value must remain secret, so the first database is safe only while it stays unknown.
    • D.The stored value lengthens each password, so guessing exceeds what the tables were built for.

    A precomputed table is only useful when the same password always produces the same digest, and a per-account salt breaks that assumption by making the stored digest depend on the account as well as the password. The salt therefore does not need to be secret, and it is stored in the clear: its work is to force the attacker to run a separate guessing effort against every single account instead of reusing one table across all of them.

    Ref QB-APQAM8Source: CompTIA Security+ exam objectives (cryptographic vulnerabilities); NIST SP 800-63B password storage with saltingReport a problem with this question

41. 41. Authentication logs show one failed attempt against each of 840 distinct accounts over six hours, always with the same common password, and no account reached its lockout threshold. Which pattern is this, and what does its shape reveal about the attacker's intent?

    • A.Password spraying, whose one-try-per-account pattern is chosen to stay under the lockout threshold.✓ Answer
    • B.Brute forcing of one account, whose many tries per account are expected to trigger lockout quickly.
    • C.Credential replay of captured hashes, whose successful reuse leaves no failed attempts in the log.
    • D.Concurrent session abuse, whose parallel logins from one account reveal a shared set of credentials.

    The distinguishing feature is the direction of the fan-out: brute force sends many passwords at one account and trips lockout almost immediately, while spraying sends one or two likely passwords across a wide set of accounts precisely so that no individual counter reaches its limit. Because per-account thresholds cannot see the pattern, detection depends on correlating failures across accounts from a single source, and lockout tuning alone will not catch it.

    Ref QB-T6WF79Source: CompTIA Security+ exam objectives (password attacks: spraying, brute force)Report a problem with this question

42. 42. An attacker on an access VLAN has been sending unsolicited address-resolution replies that bind the gateway's network address to the attacker's own hardware address, placing the attacker between hosts and the gateway. The switching platform must stop this without changes on the hosts. Which configuration pairing does that?

    • A.Authenticate each connecting device at the port before any data frames are allowed onto the VLAN.
    • B.Limit each access port to one learned hardware address and shut the port when a second appears.
    • C.Validate address resolution replies against the trusted assignment bindings the switch has recorded.✓ Answer
    • D.Prune unused VLANs from every trunk so the attacker's frames cannot cross between access segments.

    Address resolution has no authentication of its own, so the only place to judge a reply is against an independent record of which network address legitimately belongs to which port and hardware address. Switches build that record by observing address assignment and then inspecting each reply against it, dropping bindings that contradict the record; port security counts addresses rather than checking claims, and port authentication proves who connected without constraining what they then assert.

    Ref QB-BP3NS9Source: CompTIA Security+ exam objectives (network attacks: on-path attack); dynamic ARP inspection validated against address-assignment bindingsReport a problem with this question

43. 43. A company's public name resolvers are being used in an attack: 60-byte queries arrive carrying a forged source address, and 3,000-byte answers are sent to a victim that never asked for them. Which change to the company's own resolvers stops them being used this way?

    • A.Sign every zone the company publishes so forged answers can be detected by validating clients.
    • B.Raise the record lifetime on every zone so fewer queries reach the resolvers in a given hour.
    • C.Refuse recursive queries from outside clients and rate-limit identical answers to any one address.✓ Answer
    • D.Block inbound echo traffic at the edge so the flood cannot reach the resolvers in the first place.

    Two mechanisms are being combined here: the forged source address makes the resolver send its reply to a third party, and the fifty-fold size difference between query and answer multiplies the volume that arrives there. The organization cannot stop the spoofing upstream, but it can stop being a usable amplifier by answering recursive queries only for its own clients and by limiting how often an identical answer is sent to one destination.

    Ref QB-U69TCASource: CompTIA Security+ exam objectives (DDoS: amplified, reflected; DNS attacks); BCP 38 source address validationReport a problem with this question

44. 44. A wireless survey finds an access point with an open network, physically plugged into a wall jack in a meeting room and bridging straight onto the internal user VLAN. It does not imitate the corporate network name. Which finding fits, and which control at the wall jack prevents a repeat?

    • A.A rogue access point on the wired network; require device authentication on the port before it forwards.✓ Answer
    • B.A deauthentication attack against corporate clients; require management frame protection on the network.
    • C.An evil twin impersonating the corporate network; require that clients validate the server certificate.
    • D.A misconfigured guest network on the controller; require that guest traffic leave through its own gateway.

    An evil twin works by impersonating a known network name so clients associate with it by mistake, and this device makes no such claim — its whole effect comes from being attached to the wired network without authorization, which is the definition of a rogue access point. Because the exposure enters through the physical port, the control belongs there: port-based authentication leaves the jack unable to forward user traffic until the connected device has proved its identity.

    Ref QB-CPEYXASource: CompTIA Security+ exam objectives (unsecure networks: wireless) and (wireless attacks); IEEE 802.1X port-based network access controlReport a problem with this question

Practice questions based on the CompTIA Security+ SY0-701 exam objectives. This is an independent study tool, not affiliated with or endorsed by CompTIA, and does not grant certification. About Security+ →