40 Threats, Attacks & Vulnerabilities Practice Questions & Answers
Every Threats, Attacks & Vulnerabilities practice question from the CompTIA Security+ Practice Test, with the correct answer and a short explanation.
Start practice test →1. An attacker sends a mass email pretending to be from a bank, urging recipients to click a link and enter their login credentials on a fake website. Which social-engineering attack is this?
- A.Tailgating
- B.Phishing✓ Answer
- C.Dumpster diving
- D.Shoulder surfing
Phishing uses fraudulent emails impersonating a trusted entity to trick users into revealing credentials or clicking malicious links.
2. Malware encrypts a company's files and demands payment in cryptocurrency for the decryption key. What type of malware is this?
- A.Spyware
- B.Rootkit
- C.Ransomware✓ Answer
- D.Adware
Ransomware encrypts a victim's data and demands a ransom—often in cryptocurrency—in exchange for the decryption key.
3. An attacker crafts a highly personalized email that targets the company's CFO specifically, referencing real internal projects to steal credentials. This is BEST described as:
- A.Whaling✓ Answer
- B.Vishing
- C.Smishing
- D.Pharming
Whaling is a targeted phishing attack aimed at high-value individuals such as executives (here, the CFO).
4. A web login form lets an attacker enter ' OR '1'='1 into the username field to bypass authentication. Which vulnerability does this exploit?
- A.Cross-site scripting (XSS)
- B.Buffer overflow
- C.Cross-site request forgery (CSRF)
- D.SQL injection✓ Answer
SQL injection inserts malicious SQL into an input field so that unsanitized queries alter the database logic—here, bypassing the login.
5. An attacker secretly positions themselves between a user and a server, relaying and possibly altering traffic without either party's knowledge. This is a(n):
- A.Replay attack
- B.On-path (man-in-the-middle) attack✓ Answer
- C.Denial-of-service attack
- D.Amplification attack
An on-path (man-in-the-middle) attack intercepts communication between two parties, letting the attacker read or modify the traffic in transit.
6. Attackers exploit a software flaw that the vendor is unaware of and for which no patch yet exists. This is known as a:
- A.Known vulnerability
- B.Configuration drift
- C.Zero-day vulnerability✓ Answer
- D.Legacy vulnerability
A zero-day vulnerability is unknown to the vendor and has no available patch, so defenders have had 'zero days' to fix it before exploitation.
7. Rather than guessing many passwords for one account, an attacker tries a single common password such as 'Winter2024' against many different usernames to avoid account lockouts. This is:
- A.Dictionary attack
- B.Rainbow table attack
- C.Brute-force attack
- D.Password spraying✓ Answer
Password spraying tries one or a few common passwords across many accounts, staying under lockout thresholds that a single-account brute force would trigger.
8. A botnet floods a company's web server with massive traffic from thousands of compromised devices, making the site unavailable to legitimate users. This is a:
- A.Distributed denial-of-service (DDoS) attack✓ Answer
- B.Privilege escalation
- C.SQL injection
- D.Cross-site scripting
A DDoS attack uses many compromised systems (a botnet) to overwhelm a target with traffic, denying service to legitimate users—an availability attack.
9. An attacker injects a malicious script into a website's comment field so that it later runs in the browsers of other users who view the page. This attack is:
- A.SQL injection
- B.CSRF
- C.Cross-site scripting (XSS)✓ Answer
- D.Directory traversal
Cross-site scripting (XSS) injects client-side script into a trusted page so it executes in other users' browsers; stored XSS persists in content like a comment field.
10. A disgruntled employee with legitimate access copies confidential customer data to a personal USB drive shortly before resigning. This is an example of a(n):
- A.Script kiddie
- B.Insider threat✓ Answer
- C.Hacktivist
- D.Nation-state actor
An insider threat comes from someone with authorized access—such as an employee—who misuses that access to harm the organization.
11. An attacker sets up a rogue Wi-Fi access point broadcasting the same SSID as a legitimate coffee-shop network to intercept users' traffic. This is called a(n):
- A.Bluesnarfing
- B.Jamming
- C.Deauthentication attack
- D.Evil twin✓ Answer
An evil twin is a rogue access point that mimics a legitimate SSID to lure users into connecting, allowing the attacker to intercept their traffic.
12. Which type of malware is specifically designed to gain and hide privileged, persistent access at the operating-system or kernel level, making it very hard to detect?
- A.Rootkit✓ Answer
- B.Adware
- C.Worm
- D.Keylogger
A rootkit embeds itself deep in the OS or kernel to maintain privileged access while hiding its presence from users and many detection tools.
13. A phishing message reads: 'Your account will be permanently deleted in 24 hours unless you verify now.' Which social-engineering principle is being exploited?
- A.Familiarity
- B.Social proof
- C.Urgency✓ Answer
- D.Consensus
Urgency pressures the target to act quickly—here, a short deadline—so they bypass careful judgment and fall for the scam.
14. Attackers compromise a trusted software vendor and insert malicious code into a legitimate product update that is then distributed to many customers. This is a:
- A.Watering hole attack
- B.Supply chain attack✓ Answer
- C.Insider attack
- D.Brute-force attack
A supply chain attack compromises a trusted vendor or component so that malicious code is delivered downstream to the vendor's many customers.
15. Which of the following BEST describes a zero-day vulnerability?
- A.A vulnerability that has been publicly documented for years but remains unpatched
- B.A flaw that is exploited before the vendor knows about it or has released a patch✓ Answer
- C.A vulnerability that automatically becomes harmless once a patch is announced
- D.A flaw that can only be exploited on the day the software is first released
The term "zero-day" means defenders and the vendor have had zero days to develop and deploy a fix, because the flaw is unknown to them when exploitation begins; that absence of a patch or signature is what makes these vulnerabilities so dangerous.
Source: CompTIA Security+ SY0-701 Objective 2.3 — zero-day vulnerabilitiesReport a problem with this question
16. A security team learns of an actively exploited zero-day in a critical server application, and no vendor patch exists yet. Which action provides the BEST immediate risk reduction?
- A.Run a signature-based antivirus scan, since signatures reliably detect zero-day exploits
- B.Apply compensating controls such as network segmentation, traffic filtering, and enhanced monitoring✓ Answer
- C.Reinstall the application from its original installation media
- D.Take no action until the vendor releases an official patch
When no patch exists, risk must be reduced through compensating controls that limit exposure and detect abnormal behavior: segmentation shrinks the attack surface, filtering blocks likely exploit paths, and behavior-based monitoring can catch exploitation that signature-based tools miss because, by definition, no signature exists yet for a zero-day.
Source: SY0-701 Objectives 2.3 and 4.5 — zero-day vulnerabilities and compensating controlsReport a problem with this question
17. Which statement correctly distinguishes CVE from CVSS?
- A.CVE and CVSS are two interchangeable names for the same vulnerability database
- B.CVE assigns severity scores, while CVSS assigns unique identifiers to vulnerabilities
- C.CVE is a wireless security protocol, while CVSS is a DNS security extension
- D.CVE uniquely identifies publicly disclosed vulnerabilities, while CVSS provides a numeric score of their severity✓ Answer
CVE (Common Vulnerabilities and Exposures) is a catalog that gives each disclosed vulnerability a unique ID so everyone refers to the same flaw, while CVSS (Common Vulnerability Scoring System) is a separate standard that rates a vulnerability's severity on a 0–10 scale; identification and scoring are deliberately separate functions.
Source: CVE program (MITRE) and CVSS specification (FIRST); SY0-701 Objective 4.3 — vulnerability analysis (CVE/CVSS)Report a problem with this question
18. In an on-path (man-in-the-middle) attack, what is the attacker's defining position?
- A.Flooding a server with traffic generated from many distributed sources
- B.Guessing a password by systematically trying every possible combination
- C.Secretly relaying and possibly altering traffic between two parties who believe they are communicating directly✓ Answer
- D.Encrypting a victim's files and demanding payment for the decryption key
An on-path attack works because the attacker inserts themselves into the communication path and proxies the traffic in both directions, so each victim believes it is talking to the other endpoint while the attacker can read, capture, or modify everything that passes through.
Source: SY0-701 Objective 2.4 — on-path attacksReport a problem with this question
19. How does ARP poisoning enable an on-path attack inside a local network?
- A.It overwhelms the DHCP server so that clients cannot obtain IP addresses
- B.It replaces TLS certificates stored in the browser's trust store
- C.It cracks the Wi-Fi passphrase by analyzing captured handshakes
- D.It sends forged ARP replies so victims associate the gateway's IP address with the attacker's MAC address✓ Answer
ARP has no authentication, so any host can answer "who has this IP?" with a lie; by continuously sending forged replies that bind the gateway's IP to the attacker's MAC, the attacker causes victims' traffic to flow through the attacker's machine, establishing the on-path position.
Source: SY0-701 Objective 2.4 — on-path attacks / ARP poisoningReport a problem with this question
20. Which attack downgrades a victim's connection from HTTPS to unencrypted HTTP so an on-path attacker can read the traffic in cleartext?
- A.DNS amplification
- B.SSL stripping✓ Answer
- C.Bluejacking
- D.Pass-the-hash
SSL stripping is a downgrade attack: the on-path attacker maintains an HTTPS session with the real server but serves the victim plain HTTP, rewriting links so the victim never upgrades to TLS; because the victim's leg of the connection is unencrypted, credentials and data are exposed. HSTS (HTTP Strict Transport Security) is the standard defense.
Source: SY0-701 Objective 2.4 — downgrade attacks (SSL stripping); RFC 6797 (HSTS)Report a problem with this question
21. An attacker inserts a forged record into a DNS resolver's cache so that users requesting a legitimate bank's domain are silently sent to a malicious IP address. What is this attack called?
- A.MAC flooding
- B.Domain hijacking
- C.DNS zone transfer
- D.DNS (cache) poisoning✓ Answer
DNS cache poisoning corrupts the resolver's stored answers rather than the domain's actual registration: once the forged record is cached, every client using that resolver receives the attacker's IP for the legitimate name until the record expires, which is why DNSSEC's cryptographic signing of DNS responses is the primary countermeasure.
Source: SY0-701 Objective 2.4 — DNS attacks (DNS poisoning); DNSSEC (RFC 4033)Report a problem with this question
22. Attackers compromise a company's registrar account and change the domain's registration details and name servers, taking control of where the domain resolves. This is BEST described as:
- A.Cross-site scripting
- B.Subdomain enumeration
- C.DNS cache poisoning
- D.Domain hijacking✓ Answer
Domain hijacking attacks the registration layer itself: by taking over the registrar account, the attacker changes the authoritative name servers, so every resolver worldwide gets attacker-controlled answers — unlike cache poisoning, which only corrupts one resolver's temporary cache.
Source: SY0-701 Objective 2.4 — DNS attacks (domain hijacking)Report a problem with this question
23. A rogue wireless access point broadcasts the same SSID as a legitimate coffee-shop hotspot so nearby users unknowingly connect to it. Which attack is this?
- A.RF jamming
- B.Evil twin✓ Answer
- C.Bluesnarfing
- D.NFC relay attack
An evil twin impersonates a trusted network at the radio level: because Wi-Fi clients identify networks primarily by SSID and often auto-connect to the strongest matching signal, the attacker's AP becomes the victim's gateway, giving the attacker an on-path position to capture credentials and traffic.
Source: SY0-701 Objective 2.4 — wireless attacks (rogue access point / evil twin)Report a problem with this question
24. Why does an attacker send spoofed 802.11 deauthentication frames to clients of a Wi-Fi network?
- A.To force clients to disconnect and reconnect, enabling handshake capture or pushing them onto an evil twin✓ Answer
- B.To assign the clients invalid IP addresses
- C.To decrypt WPA3-encrypted traffic directly in real time
- D.To increase the legitimate access point's transmit power
Legacy 802.11 management frames are unauthenticated, so an attacker can forge deauthentication frames that the client obeys; the forced reconnection lets the attacker capture the WPA handshake for offline cracking or lure the client to a rogue AP. IEEE 802.11w Protected Management Frames (mandatory in WPA3) mitigate this by authenticating management frames.
Source: SY0-701 Objective 2.4 — wireless attacks (deauthentication); IEEE 802.11w Protected Management FramesReport a problem with this question
25. Flooding the 2.4 GHz band with radio noise so that legitimate Wi-Fi clients cannot communicate is an attack against which security property?
- A.Integrity
- B.Non-repudiation
- C.Confidentiality
- D.Availability✓ Answer
RF jamming is a wireless denial-of-service: by raising the noise floor, it prevents legitimate radios from decoding each other's signals, denying use of the service; nothing is read (confidentiality) or altered (integrity) — users simply cannot communicate, which is the definition of an availability attack in the CIA triad.
Source: SY0-701 Objective 2.4 — wireless attacks (RF jamming); CIA triad (Objective 1.2)Report a problem with this question
26. A web application's login log shows a user submitted the input: ' OR '1'='1' -- . Which attack does this indicate?
- A.Cross-site request forgery
- B.Buffer overflow
- C.Directory traversal
- D.SQL injection✓ Answer
The payload closes the intended string with a quote, appends the always-true condition '1'='1', and comments out the rest of the query with --; if the application concatenates this input into its SQL statement, the WHERE clause evaluates true for every row, classically bypassing authentication — the signature pattern of SQL injection.
Source: SY0-701 Objective 2.4 — application attacks (SQL injection); OWASP Top 10 A03 InjectionReport a problem with this question
27. Which coding practice is the MOST effective defense against SQL injection?
- A.Blocking the attacker's IP address at the firewall
- B.Using parameterized queries (prepared statements) together with input validation✓ Answer
- C.Hiding database error messages from end users
- D.Encrypting the database files at rest
Parameterized queries fix the root cause: user input is bound as data to placeholders and is never parsed as SQL code, so injected syntax cannot change the query's structure; hiding errors, blocking IPs, or encrypting at rest may slow attackers but leave the injectable code path intact.
Source: OWASP SQL Injection Prevention Cheat Sheet; SY0-701 Objective 2.4 — injection attacksReport a problem with this question
28. What distinguishes stored (persistent) XSS from reflected XSS?
- A.Stored XSS requires physical access to the web server
- B.A stored payload is saved by the application (e.g., in a comment field) and served to every visitor, while a reflected payload is bounced back only from a single crafted request✓ Answer
- C.Stored XSS executes on the server, while reflected XSS executes only on network routers
- D.Reflected XSS persists in the site's database indefinitely
The persistence of the payload is the distinguishing factor: stored XSS writes the malicious script into the application's data store so it is delivered automatically to every user who views the page, making it far more scalable, whereas reflected XSS requires tricking each victim into clicking a specially crafted link that echoes the script back once.
Source: SY0-701 Objective 2.3 — web-based vulnerabilities (cross-site scripting); OWASP XSS classificationReport a problem with this question
29. A web server log shows the request: GET /view?file=../../../etc/passwd . Which attack is being attempted?
- A.Cross-site scripting
- B.Session replay
- C.LDAP injection
- D.Directory traversal✓ Answer
The repeated ../ sequences walk up out of the web application's intended document directory toward the filesystem root, aiming to read /etc/passwd — a file outside the web root; exploiting the application's failure to canonicalize and validate file-path input is the defining mechanism of directory traversal.
Source: SY0-701 Objective 2.4 — application attacks (directory traversal)Report a problem with this question
30. Which mechanism allows a cross-site request forgery (CSRF) attack to succeed?
- A.The DNS resolver returns a spoofed record for the target site
- B.The victim's browser automatically attaches the session cookie to a forged request sent to a site where the user is already authenticated✓ Answer
- C.The attacker cracks the victim's TLS session key
- D.The web server's memory buffer is overflowed with oversized input
CSRF abuses the browser's ambient authority: cookies are sent automatically with requests to their origin regardless of which page triggered the request, so a malicious page can make the victim's browser issue a state-changing request (like a funds transfer) that the server treats as legitimate; anti-CSRF tokens and SameSite cookies break this by requiring proof the request came from the genuine site.
Source: SY0-701 Objective 2.4 — application attacks (forgery/CSRF); OWASP CSRF Prevention Cheat SheetReport a problem with this question
31. Which vulnerability occurs when a program writes more data into a fixed-length memory region than it can hold, potentially overwriting adjacent memory such as a function's return address?
- A.Buffer overflow✓ Answer
- B.Race condition
- C.Memory leak
- D.Cross-site scripting
A buffer overflow happens when bounds are not checked on a write: excess bytes spill past the buffer's end and can overwrite control data such as the saved return address, letting an attacker redirect execution to injected code; defenses like ASLR, stack canaries, and memory-safe languages target exactly this mechanism.
Source: SY0-701 Objective 2.3 — application vulnerabilities (buffer overflow / memory injection)Report a problem with this question
32. A program verifies that a file is safe and then opens it a moment later; in that gap, an attacker swaps the file for a symbolic link to a sensitive system file. Which vulnerability is being exploited?
- A.Buffer overflow
- B.Improper certificate validation
- C.Privilege creep
- D.Time-of-check to time-of-use (TOCTOU) race condition✓ Answer
A TOCTOU race condition exists because the security check and the actual use are two separate, non-atomic operations: the system's state can legally change in the window between them, so the attacker wins the race by altering the resource after it is checked but before it is used; making check-and-use atomic eliminates the window.
Source: SY0-701 Objective 2.3 — race conditions (time-of-check/time-of-use)Report a problem with this question
33. During an audit, a network appliance is found to still be using the manufacturer's default administrator username and password. Which vulnerability class does this represent?
- A.Misconfiguration (default credentials)✓ Answer
- B.Zero-day vulnerability
- C.Cryptographic downgrade
- D.Race condition
Default credentials are a misconfiguration, not a software flaw: the device works as designed, but the operator failed to harden it, and because vendor default logins are published in manuals and scanned for by automated tools, anyone can authenticate as administrator; changing defaults is a baseline hardening step.
Source: SY0-701 Objective 2.3 — misconfiguration vulnerabilities (default credentials); Objective 2.5 hardeningReport a problem with this question
34. A cloud storage bucket containing customer records is discovered to be readable by anyone on the internet. What is the MOST likely root cause?
- A.A zero-day flaw in the cloud provider's hypervisor
- B.An on-path attack against the provider's TLS connections
- C.A DNS poisoning attack redirecting users to the bucket
- D.A permissions misconfiguration (open permissions) made by the customer✓ Answer
Under the cloud shared responsibility model, access policies on storage objects are the customer's responsibility, and publicly exposed buckets are overwhelmingly caused by operators setting or leaving open permissions rather than by provider compromises; this "open permissions" misconfiguration is a named vulnerability class on the exam.
Source: SY0-701 Objective 2.3 — cloud-specific vulnerabilities and misconfiguration (open permissions)Report a problem with this question
35. Why are consumer IoT devices so frequently recruited into botnets?
- A.They use encryption too strong for administrators to manage
- B.They only run firmware that is cryptographically signed by verified vendors
- C.They often ship with hardcoded or default credentials and rarely receive security patches✓ Answer
- D.They cannot connect to the internet without explicit user approval for each session
IoT devices combine weak defaults with weak lifecycle support: hardcoded or unchanged default passwords let attackers log in at scale over the internet, and because many devices lack update mechanisms or vendor support, known flaws stay exploitable for years — the exact recipe botnets like Mirai used to conscript hundreds of thousands of devices.
Source: SY0-701 Objective 2.3 — hardware/IoT vulnerabilities (firmware, end-of-life, default credentials)Report a problem with this question
36. Which consideration MOST distinguishes securing OT/SCADA industrial control systems from securing typical IT systems?
- A.OT protocols always encrypt their traffic by default
- B.Availability and physical safety take priority, downtime for patching is often unacceptable, so segmentation and compensating controls are emphasized✓ Answer
- C.A compromised OT system has no physical or safety consequences
- D.OT systems are patched far more frequently than IT systems
Industrial systems invert the usual IT priority order: continuous, safe physical operation comes first, and many controllers run legacy software that cannot be rebooted or patched without halting production, so risk is managed by isolating OT networks from IT, restricting access, and monitoring — compensating for the inability to patch on a normal cycle.
Source: SY0-701 Objectives 2.3 and 3.1 — ICS/SCADA, RTOS and embedded system security considerationsReport a problem with this question
37. Which of the following activities is an example of gathering open-source intelligence (OSINT)?
- A.Planting a hardware keylogger inside the target's office
- B.Purchasing stolen credentials from a dark-web marketplace
- C.Intercepting a target organization's internal email traffic
- D.Reviewing a target company's public website, social media profiles, and DNS records✓ Answer
OSINT is defined by its sources, not its purpose: it uses only information that is legally and publicly accessible — websites, social media, public DNS and registration data, news, filings — which is why both attackers (reconnaissance) and defenders (threat intelligence) can gather it without intrusion; the other options involve interception, criminal markets, or physical trespass.
Source: SY0-701 Objective 4.3 — threat intelligence identification methods (OSINT)Report a problem with this question
38. In cyber threat intelligence (CTI) sharing, what is the relationship between STIX and TAXII?
- A.STIX is a structured language for describing threat information, and TAXII is the protocol for transporting and exchanging it✓ Answer
- B.STIX encrypts malware samples, while TAXII decrypts them for analysis
- C.Both are vulnerability severity scoring systems maintained by NIST
- D.TAXII defines the data format, while STIX is the transport protocol
The two standards split the problem cleanly: STIX (Structured Threat Information eXpression) defines a common machine-readable format for describing indicators, TTPs, and campaigns, while TAXII (Trusted Automated eXchange of Intelligence Information) defines how that STIX content is transported between producers and consumers over HTTPS — format versus delivery.
Source: OASIS STIX/TAXII standards; SY0-701 Objective 4.3 — threat feeds and information sharingReport a problem with this question
39. What is the MITRE ATT&CK framework?
- A.A legal standard used to prosecute cybercrime
- B.A certification program for penetration testers
- C.A knowledge base of real-world adversary tactics, techniques, and procedures used to model and detect attacker behavior✓ Answer
- D.A vulnerability scanning tool maintained by CISA
ATT&CK organizes observed adversary behavior into a matrix of tactics (the attacker's goals, such as persistence or exfiltration) and techniques (how each goal is achieved), all derived from real-world incident reporting; this shared vocabulary lets defenders map detections, run threat hunting, and emulate specific adversaries consistently.
Source: MITRE ATT&CK framework (attack.mitre.org); SY0-701 Domain 2 — threat actor TTPsReport a problem with this question
40. Which of the following is BEST classified as an indicator of compromise (IoC)?
- A.A vendor's published schedule of quarterly patch releases
- B.An employee's completed security awareness training record
- C.The organization's minimum password length policy
- D.A file hash matching known malware found on a host, or outbound connections to a known command-and-control IP address✓ Answer
An IoC is a forensic artifact that provides evidence an intrusion has occurred or is occurring — typical types include malicious file hashes, C2 IP addresses and domains, unusual outbound traffic, registry changes, and anomalous account behavior; schedules, training records, and policies are administrative artifacts that indicate nothing about compromise.
Source: SY0-701 Objective 2.4 — indicators of malicious activity (IoC types)Report a problem with this question
Practice questions based on the CompTIA Security+ SY0-701 exam objectives. This is an independent study tool, not affiliated with or endorsed by CompTIA, and does not grant certification. About Security+ →