CompTIA Security+ Certification: Threats, Vulnerabilities, and Incident Response

Question 1

An attacker sends a fraudulent email pretending to be the CEO, urgently requesting a wire transfer. Which type of attack is this?

A. Business email compromise (BEC)

B. Pharming

C. Typosquatting

D. Watering hole attack

Explanation: Business email compromise involves impersonating a trusted executive or business partner, typically via a spoofed or compromised email account, to trick an employee into making a fraudulent payment or disclosing sensitive data.

Question 2

Which type of malware encrypts a victim's files and demands payment for the decryption key?

A. Spyware

B. Ransomware

C. Rootkit

D. Adware

Explanation: Ransomware encrypts a victim's files or locks a system, then demands a ransom payment, often in cryptocurrency, in exchange for the decryption key needed to restore access to the data.

Question 3

Which attack technique involves an attacker intercepting and potentially altering communication between two parties who believe they are communicating directly?

A. On-path (man-in-the-middle) attack

B. Credential stuffing

C. Buffer overflow

D. Privilege escalation

Explanation: An on-path attack, also known as a man-in-the-middle attack, occurs when an attacker secretly intercepts and relays communication between two parties, potentially eavesdropping on or altering the data exchanged.

Question 4

A vulnerability that is exploited before the vendor releases a patch is known as which of the following?

A. Zero-day vulnerability

B. Legacy vulnerability

C. Misconfiguration

D. Default credential vulnerability

Explanation: A zero-day vulnerability is a flaw that is discovered and potentially exploited by attackers before the software vendor is aware of it or has released a patch, giving defenders zero days to prepare.

Question 5

Which social engineering technique involves an attacker following an authorized employee through a secure door without proper credentials?

A. Shoulder surfing

B. Tailgating

C. Pretexting

D. Dumpster diving

Explanation: Tailgating occurs when an unauthorized individual follows closely behind an authorized person through a secured access point, exploiting the natural courtesy of holding a door open rather than defeating the access control technically.

Question 6

Which type of injection attack targets a database by inserting malicious SQL statements into an input field?

A. Cross-site scripting

B. SQL injection

C. LDAP injection

D. Command injection

Explanation: SQL injection exploits improperly sanitized user input by inserting malicious SQL code into a query, potentially allowing an attacker to view, modify, or delete data within the backend database.

Question 7

A buffer overflow attack primarily exploits which type of weakness?

A. Weak password policy

B. Insufficient input validation on memory allocation

C. Misconfigured firewall rules

D. Lack of network segmentation

Explanation: A buffer overflow occurs when a program writes more data to a fixed-size memory buffer than it can hold, exploiting insufficient input validation to potentially overwrite adjacent memory and execute arbitrary code.

Question 8

Which threat actor type is primarily motivated by political or social causes rather than financial gain?

A. Organized crime

B. Hacktivist

C. Insider threat

D. Script kiddie

Explanation: Hacktivists conduct cyberattacks to promote political or social agendas, such as defacing websites or leaking data to draw attention to a cause, distinguishing them from financially motivated threat actors.

Question 9

Which of the following best describes a watering hole attack?

A. Compromising a website frequently visited by a targeted group to infect its visitors

B. Sending mass phishing emails to random recipients

C. Physically stealing a laptop from an office

D. Flooding a server with traffic to cause a denial of service

Explanation: In a watering hole attack, an attacker compromises a legitimate website that members of a targeted group are known to visit, infecting the site so that visitors from the target organization become compromised.

Question 10

Which type of malware is specifically designed to hide its presence and maintain privileged access to a system?

A. Worm

B. Rootkit

C. Trojan

D. Logic bomb

Explanation: A rootkit is malicious software designed to conceal its own existence and that of other malware, often by modifying operating system components, while maintaining privileged administrative-level access for the attacker.

Question 11

Which attack exploits a trusted relationship between a website and a user's browser to perform unauthorized actions on behalf of the authenticated user?

A. Cross-site scripting (XSS)

B. Cross-site request forgery (CSRF)

C. Session hijacking

D. Clickjacking

Explanation: Cross-site request forgery tricks an authenticated user's browser into submitting an unwanted, unauthorized request to a trusted site where the user is currently logged in, exploiting the site's trust in the user's session.

Question 12

Which of the following describes malware designed to activate and execute a malicious action when a specific condition is met, such as a certain date?

A. Logic bomb

B. Keylogger

C. Botnet

D. Backdoor

Explanation: A logic bomb is malicious code intentionally inserted into a system that lies dormant until triggered by a specific condition or event, such as a particular date or user action, at which point it executes its payload.

Question 13

A distributed denial-of-service (DDoS) attack typically involves which of the following?

A. A single attacker sending a small number of malformed packets

B. Multiple compromised systems, often a botnet, flooding a target with traffic

C. An attacker physically disconnecting network cables

D. Exploiting a single application's memory buffer

Explanation: A distributed denial-of-service attack uses a large number of compromised devices, collectively known as a botnet, to simultaneously overwhelm a target's resources or bandwidth, making the service unavailable to legitimate users.

Question 14

Which of the following best describes a pretexting attack?

A. Creating a fabricated scenario to manipulate a victim into divulging information

B. Scanning a network for open ports

C. Encrypting files for ransom

D. Intercepting wireless traffic

Explanation: Pretexting involves an attacker inventing a plausible fabricated scenario or false identity, such as posing as IT support, to gain a victim's trust and manipulate them into revealing sensitive information.

Question 15

Which vulnerability scanning approach involves authenticated access to a system to check for missing patches and configuration issues?

A. Unauthenticated (non-credentialed) scan

B. Authenticated (credentialed) scan

C. Passive scan only

D. Port scan only

Explanation: An authenticated, or credentialed, vulnerability scan logs into the target system using valid credentials, allowing it to inspect installed software versions, patch levels, and configuration settings more thoroughly than an external unauthenticated scan.

Question 16

Which of the following best describes typosquatting?

A. Registering domain names similar to legitimate ones to exploit user typing errors

B. Sending spam text messages

C. Exploiting default router credentials

D. Intercepting Bluetooth signals

Explanation: Typosquatting involves registering domain names that closely resemble popular legitimate websites, anticipating that users who mistype the correct URL will land on the malicious site, often used for phishing or malware distribution.

Question 17

Which type of attack uses previously stolen username and password pairs to attempt logins across multiple unrelated websites?

A. Credential stuffing

B. Password spraying

C. Brute-force attack

D. Rainbow table attack

Explanation: Credential stuffing leverages username and password combinations leaked from a prior data breach, automatically testing them against numerous other websites, exploiting the common practice of password reuse across accounts.

Question 18

Which of the following best describes password spraying?

A. Attempting a small number of commonly used passwords against many different user accounts

B. Trying every possible character combination against a single account

C. Using a precomputed table to reverse password hashes

D. Capturing passwords transmitted in plaintext over a network

Explanation: Password spraying attacks a large number of user accounts with a small set of commonly used passwords, spreading attempts thin to avoid triggering account lockout policies that would result from repeated attempts against a single account.

Question 19

Which of the following is a primary mitigation for SQL injection attacks?

A. Using parameterized queries and input validation

B. Disabling firewall logging

C. Increasing session timeout duration

D. Using weaker password complexity requirements

Explanation: Parameterized queries, also known as prepared statements, separate SQL code from user-supplied data, along with proper input validation, preventing malicious input from being interpreted as executable SQL commands.

Question 20

Which of the following best describes an insider threat?

A. An external attacker using stolen credentials

B. A current or former employee, contractor, or partner who misuses authorized access to cause harm

C. A nation-state sponsored attacker

D. An automated bot scanning for vulnerabilities

Explanation: An insider threat originates from individuals who have or had legitimate authorized access to an organization's systems and data, such as employees or contractors, who intentionally or unintentionally misuse that access to cause harm.

Question 21

Which term describes a group of compromised computers controlled remotely by an attacker, often used to launch coordinated attacks?

A. Botnet

B. Honeynet

C. VPN concentrator

D. Sandbox

Explanation: A botnet is a network of malware-infected devices, or "bots," remotely controlled by an attacker through a command-and-control infrastructure, commonly used to launch DDoS attacks, distribute spam, or mine cryptocurrency.

Question 22

Which of the following best describes an on-path browser attack (man-in-the-browser)?

A. Malware that infects a web browser to intercept and manipulate transactions in real time

B. An attacker physically stealing a browser bookmarks file

C. A denial-of-service attack against a web server

D. A vulnerability scan of a web application

Explanation: A man-in-the-browser attack uses malware embedded within a web browser to intercept and alter data as it is entered or displayed, such as modifying banking transaction details, without the victim's knowledge.

Question 23

Which of the following describes a race condition vulnerability?

A. A flaw in which the outcome of a process depends on the timing of uncontrollable events, potentially leading to unintended behavior

B. A misconfigured access control list

C. A weakness in encryption key length

D. An unpatched operating system

Explanation: A race condition occurs when the behavior of software depends on the relative timing of concurrent operations, and an attacker who manipulates that timing, such as in a time-of-check to time-of-use (TOCTOU) scenario, can cause unintended or exploitable behavior.

Question 24

Which of the following best describes a supply chain attack?

A. Compromising a trusted third-party vendor or component to gain access to the ultimate target

B. Physically intercepting delivery trucks

C. Flooding a network with excessive traffic

D. Guessing weak administrative passwords

Explanation: A supply chain attack targets a trusted vendor, software provider, or component manufacturer whose products or services are integrated into the target organization, allowing the attacker to compromise many downstream victims through a single point of entry.

Question 25

Which of the following best describes privilege escalation?

A. Gaining a higher level of access than originally authorized

B. Encrypting a victim's files for ransom

C. Flooding a server with connection requests

D. Physically bypassing a locked door

Explanation: Privilege escalation occurs when an attacker exploits a vulnerability or misconfiguration to gain a higher level of access or permissions than originally granted, such as moving from a standard user account to administrative or root access.

Question 26

Which of the following is an example of an application programming interface (API) attack?

A. Abusing an unsecured or poorly authenticated API endpoint to access or manipulate data

B. Disconnecting a network cable

C. Physically stealing a server

D. Sending an unsolicited fax

Explanation: API attacks exploit weaknesses such as broken authentication, excessive data exposure, or lack of rate limiting in application programming interfaces, allowing attackers to access, manipulate, or exfiltrate data through the exposed endpoints.

Question 27

Which of the following best describes a rogue access point?

A. An unauthorized wireless access point installed on a network without approval

B. A properly configured guest Wi-Fi network

C. A VPN gateway

D. A network intrusion detection sensor

Explanation: A rogue access point is an unauthorized wireless device connected to a network, either maliciously installed by an attacker or unknowingly by an employee, creating an unmonitored entry point that bypasses normal network security controls.

Question 28

Which of the following best describes an evil twin attack?

A. A malicious wireless access point disguised as a legitimate one to intercept user traffic

B. A malware variant that duplicates itself across a network

C. A phishing email sent from a spoofed domain

D. A brute-force attack against an encrypted file

Explanation: An evil twin is a fraudulent wireless access point set up to mimic a legitimate network's SSID, tricking users into connecting so the attacker can intercept credentials and other sensitive data transmitted over the fake network.

Question 29

Which mitigation technique involves regularly applying vendor-released fixes to close known vulnerabilities?

A. Patch management

B. Data masking

C. Network segmentation

D. Tokenization

Explanation: Patch management is the systematic process of identifying, testing, and deploying software updates and fixes released by vendors, directly addressing known vulnerabilities before they can be exploited by attackers.

Question 30

Which of the following best describes a directory traversal attack?

A. Manipulating file path input to access files and directories outside the intended web root

B. Overloading a server's CPU with excessive requests

C. Intercepting DNS queries

D. Exploiting weak Wi-Fi encryption

Explanation: Directory traversal exploits insufficient validation of file path input, allowing an attacker to use sequences such as "../" to navigate outside the intended web root directory and access restricted files on the server.

Question 31

Which of the following describes an indicator of compromise (IoC)?

A. A forensic artifact suggesting a system may have been breached, such as unusual outbound traffic

B. A formal risk acceptance document

C. A scheduled maintenance window

D. An employee's job title

Explanation: An indicator of compromise is a piece of forensic evidence, such as unusual network traffic patterns, unexpected file modifications, or known malicious file hashes, that suggests a system or network may have already been compromised.

Question 32

Which of the following best describes a downgrade attack?

A. Forcing a system to use a weaker, more vulnerable protocol or cipher instead of a stronger available option

B. Reducing an employee's account privileges

C. Lowering firewall logging verbosity

D. Decreasing network bandwidth allocation

Explanation: A downgrade attack manipulates the negotiation process between a client and server to force the use of an older, weaker encryption protocol or cipher suite, making the resulting communication easier for the attacker to intercept or decrypt.

Question 33

Which of the following best describes a memory leak vulnerability?

A. A program failing to release memory it no longer needs, potentially leading to resource exhaustion

B. A firewall misconfiguration allowing unauthorized traffic

C. A weak encryption algorithm

D. An expired digital certificate

Explanation: A memory leak occurs when a program fails to properly release memory that is no longer in use, gradually consuming available system resources and potentially causing performance degradation or a denial-of-service condition over time.

Question 34

Which of the following best describes a birthday attack in cryptography?

A. Exploiting the mathematical probability of hash collisions to find two inputs producing the same hash

B. Guessing a user's date of birth to reset a password

C. Flooding a mail server with messages

D. Intercepting unencrypted VoIP calls

Explanation: A birthday attack exploits the birthday paradox in probability theory, seeking to find two different inputs that produce the same hash output (a collision) faster than would be expected, potentially undermining the integrity guarantees of a weak hashing algorithm.

Question 35

Which of the following best describes a man-in-the-middle downgrade of HTTPS to HTTP known as SSL stripping?

A. An attacker intercepts and forces a connection to use unencrypted HTTP instead of HTTPS

B. A server automatically renews its SSL certificate

C. A browser blocks mixed content warnings

D. A user manually disables encryption

Explanation: SSL stripping is a form of on-path attack in which the attacker intercepts a user's initial connection attempt and silently downgrades it from encrypted HTTPS to unencrypted HTTP, allowing the attacker to view transmitted data in plaintext.

Question 36

Which type of malware self-replicates and spreads across networks without requiring a host file or user interaction?

A. Virus

B. Worm

C. Trojan

D. Spyware

Explanation: A worm is a standalone piece of malicious software that self-replicates and propagates across networks independently, exploiting vulnerabilities to spread from system to system without needing to attach itself to another program or requiring user action.

Question 37

Which of the following best describes a keylogger?

A. Software or hardware that records keystrokes to capture sensitive information such as passwords

B. A tool used to encrypt outbound network traffic

C. A device used to physically lock server room doors

D. A program that manages software licensing

Explanation: A keylogger covertly records every keystroke a user types, allowing an attacker to capture sensitive information such as usernames, passwords, and other confidential data entered on the compromised device.

Question 38

Which of the following best describes a false positive in the context of security monitoring?

A. An alert indicating malicious activity when no actual threat exists

B. A real attack that goes undetected

C. A confirmed and validated security incident

D. A scheduled system reboot

Explanation: A false positive occurs when a security monitoring tool, such as an IDS or antivirus program, generates an alert or flags activity as malicious when, in fact, no genuine threat or malicious behavior is present.

Question 39

Which of the following best describes a false negative in the context of security monitoring?

A. A security tool fails to detect and alert on actual malicious activity

B. A security tool generates too many benign alerts

C. A user successfully authenticates with valid credentials

D. A patch is successfully applied to a system

Explanation: A false negative occurs when a security tool fails to detect and report genuinely malicious activity, allowing an actual threat to go unnoticed, which is generally considered more dangerous than a false positive.

Question 40

Which of the following describes a vulnerability that results from software still running after its vendor has stopped providing security updates?

A. End-of-life (EOL) / unsupported system vulnerability

B. Zero-day vulnerability

C. Misconfiguration vulnerability

D. Weak cipher vulnerability

Explanation: When software or hardware reaches end-of-life, the vendor no longer releases security patches, leaving any newly discovered vulnerabilities permanently unaddressed and making continued use a significant and growing security risk.

Question 41

Which of the following best describes the purpose of threat intelligence feeds?

A. To provide up-to-date information on known threats, indicators, and attacker tactics to improve defenses

B. To automatically patch vulnerable systems

C. To generate employee performance reviews

D. To manage physical access badges

Explanation: Threat intelligence feeds aggregate current, actionable information about emerging threats, malicious IP addresses, malware signatures, and attacker tactics, techniques, and procedures, helping organizations proactively strengthen their defenses.

Question 42

Which of the following best describes a smishing attack?

A. Phishing conducted through SMS text messages

B. Phishing conducted through voice calls

C. Phishing targeting a specific high-value individual

D. Phishing that uses a fraudulent QR code

Explanation: Smishing is a form of phishing delivered via SMS text messages, often containing malicious links or urgent requests designed to trick recipients into revealing personal information or installing malware on their mobile device.

Question 43

Which of the following best describes vishing?

A. Phishing conducted through voice calls or voicemail

B. Phishing conducted through malicious email attachments

C. Phishing that targets executives specifically

D. Phishing conducted through malicious USB drives

Explanation: Vishing, or voice phishing, uses phone calls, often impersonating trusted entities like a bank or IT department, to manipulate victims into disclosing sensitive information or performing fraudulent actions verbally.

Question 44

Which of the following best describes whaling?

A. A highly targeted phishing attack aimed at senior executives or high-profile individuals

B. A phishing attack sent indiscriminately to thousands of random recipients

C. A malware attack targeting mobile devices

D. A denial-of-service attack against a web server

Explanation: Whaling is a highly targeted and personalized form of spear phishing that specifically targets senior executives or other high-value individuals, leveraging their authority and access to attempt large-scale fraud or data theft.

Question 45

Which of the following best describes a firmware vulnerability?

A. A flaw within the low-level software embedded in hardware devices that can be exploited to gain persistent, hard-to-detect access

B. A weakness in an organization's password policy

C. A misconfigured cloud storage bucket permission

D. A phishing email targeting employees

Explanation: Firmware vulnerabilities exist within the low-level software embedded directly in hardware components, and because firmware is rarely updated and operates below the operating system, exploits here can grant attackers persistent, difficult-to-detect control.

Question 46

Which of the following best describes an unsecured or default configuration vulnerability?

A. A system left with vendor default settings, such as default passwords, unchanged after deployment

B. A vulnerability that only exists in cloud environments

C. A cryptographic flaw in an outdated algorithm

D. A social engineering technique targeting new employees

Explanation: Default configuration vulnerabilities occur when systems are deployed with unchanged factory default settings, such as default administrator usernames and passwords, which are widely known and easily exploited by attackers if not properly hardened.

Question 47

Which of the following best describes a business email compromise variant known as invoice fraud?

A. An attacker impersonates a vendor to redirect legitimate invoice payments to a fraudulent account

B. An attacker floods a mail server with spam invoices

C. An attacker encrypts an organization's accounting files for ransom

D. An attacker physically intercepts printed invoices

Explanation: Invoice fraud is a form of business email compromise in which an attacker impersonates a known vendor or supplier, sending altered banking details so that a legitimate payment is unknowingly redirected to an account controlled by the attacker.

Question 48

Which of the following best describes a brute-force attack?

A. Systematically attempting every possible combination of characters until the correct password is found

B. Using social engineering to trick a user into revealing a password

C. Exploiting a software vulnerability to bypass authentication entirely

D. Intercepting a password during transmission over an unencrypted channel

Explanation: A brute-force attack systematically tries every possible combination of characters until the correct password or key is discovered, a method that can be slow against long, complex passwords but is effective against weak ones.

Question 49

Which of the following mitigations is most effective against brute-force login attempts?

A. Account lockout policies and rate limiting

B. Disabling antivirus software

C. Increasing network bandwidth

D. Removing multifactor authentication

Explanation: Account lockout policies and rate limiting restrict the number of authentication attempts allowed within a given time frame, significantly slowing or blocking automated brute-force attacks against user accounts.

Question 50

Which of the following best describes a cross-site scripting (XSS) attack?

A. Injecting malicious client-side scripts into a trusted website that are then executed in other users' browsers

B. Injecting malicious SQL commands into a database query

C. Overloading a server with excessive traffic

D. Guessing an administrator's password

Explanation: Cross-site scripting occurs when an attacker injects malicious client-side script, typically JavaScript, into a trusted website that is then unknowingly executed in the browsers of other users who visit the compromised page.

Question 51

Which of the following best describes threat hunting?

A. Proactively searching for signs of undetected threats within an environment rather than waiting for alerts

B. Automatically blocking all inbound traffic by default

C. Conducting an annual compliance audit

D. Training employees on phishing awareness

Explanation: Threat hunting is a proactive security practice in which analysts actively search through networks and systems to detect and isolate advanced threats that may have evaded existing automated security tools and alerts.

Question 52

Which of the following best describes a man-made environmental threat as opposed to a natural one?

A. Arson or intentional power outage caused by a person

B. Earthquake

C. Hurricane

D. Volcanic eruption

Explanation: Man-made environmental threats result from deliberate or accidental human actions, such as arson, vandalism, or intentional disruption of utilities, distinguishing them from naturally occurring environmental threats like earthquakes or hurricanes.