CompTIA Security+ Threats, Vulnerabilities, and Mitigations Practice Questions

1. Shortly after a government announces a controversial policy, its public website is defaced with political slogans and the attackers post a manifesto claiming responsibility. No data was stolen and no ransom was demanded. Which threat actor is most likely responsible?

Objective 2.1

Show answer

Answer: B. Hacktivist

Hacktivists are driven by political or philosophical beliefs and often use defacement to publicize a cause. Organized crime is financially motivated, so an attack with no theft or ransom does not fit.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

2. What term describes employees or departments using cloud services, devices or software without the IT department's knowledge or approval?

Objective 2.1

Show answer

Answer: A. Shadow IT

Shadow IT is unapproved technology adopted by staff, often with good intentions, that bypasses the organization's security controls. It is not insider sabotage, because there is usually no intent to cause harm.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

3. Which phishing variant uses SMS text messages to trick users into clicking malicious links or revealing information?

Objective 2.2

Show answer

Answer: C. Smishing

Smishing is phishing delivered by SMS text message. Vishing is the voice-call version, so it is the closest but wrong channel.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

4. An attacker wants to compromise engineers at a well-defended aerospace firm. Instead of attacking the firm directly, the attacker infects an industry forum that those engineers visit regularly. What type of attack is this?

Objective 2.2

Show answer

Answer: C. Watering hole

A watering hole attack compromises a third-party site the targets already trust and visit. Typosquatting relies on users mistyping an address and landing on a look-alike domain, not on infecting a real site they visit on purpose.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

5. An attacker registers "examp1e-bank.com", with the number 1 in place of the letter l, hoping users will mistype or misread the real bank's address. What is this technique called?

Objective 2.2

Show answer

Answer: D. Typosquatting

Typosquatting (URL hijacking) registers look-alike domains that catch typing or reading mistakes. Domain hijacking means taking control of the legitimate domain's registration, which is not what happened here.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

6. A web server log shows a login request where the username field contains the string "admin' OR '1'='1' --". Which vulnerability is the attacker attempting to exploit?

Objective 2.3

Show answer

Answer: B. SQL injection

The quote, the always-true OR '1'='1' condition and the comment marker are classic SQL injection, aimed at changing the database query so authentication is bypassed. Cross-site scripting injects script code that runs in other users' browsers, not SQL that runs on the database.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

7. A program checks that a user may write to a temporary file and, a moment later, opens and writes to it. Between those two steps an attacker replaces the file with a link to a protected system file. Which vulnerability is this?

Objective 2.3

Show answer

Answer: C. Time-of-check to time-of-use (TOCTOU) race condition

A TOCTOU race condition exploits the gap between checking a resource and using it, so the thing used is not the thing that was checked. Memory injection inserts code into a running process's memory, which is not what happened here.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

8. Which virtualization vulnerability lets code running inside a guest virtual machine break out and interact with the hypervisor or with other virtual machines on the same host?

Objective 2.3

Show answer

Answer: D. VM escape

VM escape breaks the isolation between a guest and the hypervisor, which is the most serious virtualization flaw. Resource reuse is when leftover memory or disk data from one VM becomes readable by another; it leaks data but does not break out of the VM.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

9. A SIEM shows that a user signed in from Chicago at 09:05 and then from Singapore at 09:40 the same morning, with no VPN in use. Which indicator does this most likely represent?

Objective 2.4

Show answer

Answer: D. Impossible travel

Nobody can physically travel from Chicago to Singapore in 35 minutes, so impossible travel suggests the account's credentials are being used by someone else. Account lockout would show repeated failed logins, not two successful ones far apart.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

10. Authentication logs show one failed login on each of 400 different accounts, every attempt using the password "Spring2026!". An hour later the same pattern repeats with a different password. Which attack is taking place?

Objective 2.4

Show answer

Answer: B. Password spraying

Password spraying tries a few common passwords across many accounts, slowly enough to avoid lockout thresholds. A brute force attack tries many passwords against one account, which would show many failures on a single username.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

11. A retailer's self-service kiosks should only ever run the check-in application. Which mitigation best prevents malware or any other unapproved software from executing on them?

Objective 2.5

Show answer

Answer: A. Application allow list

An application allow list lets only explicitly approved programs run and blocks everything else by default. Full-disk encryption protects data if a device is stolen, but it does nothing to stop a program from executing.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

12. A company's building management sensors cannot run endpoint security software. To limit the damage if one is compromised, the team moves them to their own network and adds firewall rules that let only the management server reach them. Which mitigation technique is this?

Objective 2.5

Show answer

Answer: A. Segmentation

Segmentation places devices on a separate network so a compromise cannot spread easily to the rest of the environment. Hardening changes the configuration of the devices themselves, such as disabling unneeded services, which is not what the team did here.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

CompTIA Security+ · Domain 2 · 22% of the examThreats, Vulnerabilities, and Mitigations

1. Shortly after a government announces a controversial policy, its public website is defaced with political slogans and the attackers post a manifesto claiming responsibility. No data was stolen and no ransom was demanded. Which threat actor is most likely responsible?

2. What term describes employees or departments using cloud services, devices or software without the IT department's knowledge or approval?

3. Which phishing variant uses SMS text messages to trick users into clicking malicious links or revealing information?

4. An attacker wants to compromise engineers at a well-defended aerospace firm. Instead of attacking the firm directly, the attacker infects an industry forum that those engineers visit regularly. What type of attack is this?

5. An attacker registers "examp1e-bank.com", with the number 1 in place of the letter l, hoping users will mistype or misread the real bank's address. What is this technique called?

6. A web server log shows a login request where the username field contains the string "admin' OR '1'='1' --". Which vulnerability is the attacker attempting to exploit?

7. A program checks that a user may write to a temporary file and, a moment later, opens and writes to it. Between those two steps an attacker replaces the file with a link to a protected system file. Which vulnerability is this?

8. Which virtualization vulnerability lets code running inside a guest virtual machine break out and interact with the hypervisor or with other virtual machines on the same host?

9. A SIEM shows that a user signed in from Chicago at 09:05 and then from Singapore at 09:40 the same morning, with no VPN in use. Which indicator does this most likely represent?

10. Authentication logs show one failed login on each of 400 different accounts, every attempt using the password "Spring2026!". An hour later the same pattern repeats with a different password. Which attack is taking place?

11. A retailer's self-service kiosks should only ever run the check-in application. Which mitigation best prevents malware or any other unapproved software from executing on them?

12. A company's building management sensors cannot run endpoint security software. To limit the damage if one is compromised, the team moves them to their own network and adds firewall rules that let only the management server reach them. Which mitigation technique is this?