Loading page
40 free CompTIA Security+ SY0-701 practice questions for Domain 2, Threats, Vulnerabilities, and Mitigations, which is about 22% of the exam. Each question has the correct answer and a clear explanation. No account or signup needed.
Last updated July 2026
A specific mid-level finance employee receives a carefully tailored email referencing real internal projects to trick them into wiring funds. Which attack is this?
Correct answer: A. Spear phishing
Spear phishing targets a specific individual with personalized details. Whaling specifically targets senior executives, generic phishing is mass and untargeted, and vishing uses voice calls.
Which type of malware self-replicates and spreads across a network on its own, without needing a host file or any user action?
Correct answer: A. Worm
A worm self-propagates across systems without user interaction. A virus needs a host file and usually user action to spread, a Trojan disguises itself as legitimate software, and spyware secretly gathers information.
A user downloads what appears to be a free productivity tool, but it secretly installs a backdoor. Which type of malware is this?
Correct answer: A. Trojan horse
A Trojan disguises malicious functionality inside something that looks legitimate. A worm self-replicates, a logic bomb waits for a trigger condition, and ransomware encrypts files for extortion.
Malicious code is planted in an application and lies dormant until a specific date arrives, then deletes files. What is this called?
Correct answer: A. Logic bomb
A logic bomb is dormant code that triggers when a condition, such as a date, is met. A rootkit hides privileged access, a worm self-spreads, and a keylogger records keystrokes.
Thousands of compromised devices in a botnet simultaneously flood a company website with traffic until it goes offline. Which attack is this?
Correct answer: A. Distributed denial-of-service (DDoS)
A DDoS uses many compromised hosts (a botnet) to overwhelm a target and deny service. An on-path attack intercepts traffic, privilege escalation raises permissions, and phishing is social engineering.
An attacker uses software that systematically tries every possible character combination to guess a password. Which attack is this?
Correct answer: A. Brute-force attack
A brute-force attack tries every possible combination until it finds the password. Pass-the-hash reuses a captured hash, phishing tricks a user into revealing it, and SQL injection targets a database.
An application accepts more input than a memory buffer can hold, letting an attacker overwrite adjacent memory and run their own code. Which vulnerability is being exploited?
Correct answer: A. Buffer overflow
A buffer overflow writes past the bounds of a memory buffer, corrupting adjacent memory and potentially executing attacker code. The other options are distinct web and timing flaws.
A newly deployed network camera is compromised because it was left with the manufacturer default username and password. Which weakness allowed this?
Correct answer: A. Default or weak credentials (misconfiguration)
Leaving default credentials in place is a configuration weakness that attackers routinely exploit. A zero-day is an unknown, unpatched flaw, a supply chain attack compromises a vendor, and an insider misuses legitimate access.
Attackers compromise a trusted software vendor and insert malware into a routine product update, which then installs on every customer that updates. This is best described as a?
Correct answer: A. Supply chain attack
A supply chain attack abuses trust in a vendor or supplier to reach their customers. A watering hole compromises a site the target frequents, brute force guesses credentials, and an evil twin is a rogue wireless access point.
An attacker phones an employee, pretends to be IT support, and convinces them to read out their password. Which social engineering technique is this?
Correct answer: A. Vishing
Vishing is voice phishing, carried out over a phone call. Smishing uses SMS text messages, whaling targets executives, and tailgating is following someone through a secure door.
A security team attributes a months-long, low-and-slow intrusion to a foreign government seeking intellectual property. Which threat actor best matches this profile?
Correct answer: B. Nation-state actor
Nation-state actors often pursue espionage with advanced, persistent campaigns. Script kiddies use basic tools for notoriety, hacktivists act for ideology or publicity, and insiders abuse legitimate internal access rather than foreign-directed campaigns.
Attackers deface a company website and leave political slogans, with no attempt to steal money or data. What is the most likely motivation?
Correct answer: D. Ideological
Defacement with political messaging points to ideological or hacktivist motives. Financial gain seeks profit, espionage seeks secrets, and blackmail pressures victims with threats rather than public slogan-based vandalism.
An unskilled attacker downloads a public exploit kit and runs it against random Internet hosts. Which threat actor type is this?
Correct answer: B. Unskilled attacker
Unskilled attackers rely on ready-made tools without deep expertise. Organized crime runs coordinated profit schemes, APTs run sophisticated long-term operations, and competitors focus on business advantage, not random mass scanning.
A ransomware gang encrypts hospital systems and demands cryptocurrency, treating attacks as a business. Which threat actor best fits?
Correct answer: C. Organized crime
Profit-driven ransomware operations align with organized crime. Hacktivists pursue causes, shadow IT is unauthorized internal tooling, and nation-state spying prioritizes intelligence over public extortion business models.
Which attribute most clearly distinguishes an advanced persistent threat from a casual opportunistic attacker?
Correct answer: B. Long-term stealthy presence in the environment
APTs emphasize prolonged, stealthy access and goals. Malware use is common to many actors, social media focus is not defining, and ransom demands describe criminal extortion more than every APT campaign.
After a public controversy, anonymous groups claim responsibility for leaking internal emails to damage the brand. Which actor type fits best?
Correct answer: B. Hacktivist
Public, cause-driven leaks to shame an organization are classic hacktivism. Insiders already have access but the claim and activism frame matter, script kiddies lack this political purpose, and data owners manage classification, not attacks.
An executive receives a fake invoice email that appears to come from the CFO and authorizes a large wire transfer. Which attack is this?
Correct answer: C. Business email compromise
BEC uses impersonation of executives or vendors to drive fraudulent payments. Watering holes compromise sites users trust, credential stuffing replays leaked passwords, and DNS poisoning redirects name resolution.
Employees visit an industry news site that attackers compromised to serve malware only to that company's visitors. What attack is this?
Correct answer: B. Watering hole
A watering hole infects a site the target group already visits. Whaling targets executives with email fraud, typosquatting registers lookalike domains, and pass-the-hash reuses NTLM hashes for authentication.
A user mistypes a bank URL and lands on a lookalike domain that harvests credentials. Which vector was used?
Correct answer: A. Typosquatting
Typosquatting relies on similar domain names that catch typing errors. Bluejacking sends unsolicited Bluetooth messages, ARP spoofing poisons local LAN mappings, and directory traversal reads files outside web roots.
An attacker leaves infected USB drives in a company parking lot, hoping staff plug them into workstations. Which vector is this?
Correct answer: C. Removable media
USB baiting abuses removable media as the entry path. API RCE is remote software abuse, on-path attacks intercept network traffic, and XSS injects scripts into web pages.
A coffee shop guest creates a free Wi-Fi SSID that matches the cafe name and captures logins. What is this attack?
Correct answer: B. Evil twin
An evil twin is a rogue access point mimicking a legitimate SSID. War driving maps wireless networks, MAC flooding overwhelms switch CAM tables, and session fixation forces a known session ID on a victim.
An attacker watches a user type a PIN at a kiosk without the user's knowledge. Which technique is this?
Correct answer: A. Shoulder surfing
Shoulder surfing is direct observation of secrets. Dumpster diving recovers discarded documents, pretexting invents a story to extract information, and a hoax spreads false warnings without necessarily watching input.
Attackers try a few common passwords against thousands of accounts to avoid lockouts. Which attack is this?
Correct answer: C. Password spraying
Password spraying uses few passwords across many accounts. Classic dictionary attacks hammer one account with many words, rainbow tables reverse unsalted hashes offline, and birthday attacks target hash collisions.
A web app builds file paths from user input and lets an attacker read /etc/passwd by inserting ../ sequences. Which vulnerability is this?
Correct answer: A. Directory traversal
Directory traversal escapes the intended directory with path tricks. XXE abuses XML entity resolution, CSRF forces unwanted authenticated requests, and race conditions exploit timing between concurrent operations.
An application checks a file's permissions, then an attacker swaps the file before it is opened. Which vulnerability class is this?
Correct answer: A. Time-of-check to time-of-use
TOCTOU races the gap between validation and use. Integer overflow wraps numeric values, pointer dereference mishandles null or invalid pointers, and side channels leak secrets via timing or power.
A guest virtual machine breaks isolation and executes code on the underlying hypervisor host. What vulnerability was exploited?
Correct answer: A. VM escape
VM escape crosses the guest-to-host boundary. Sprawl is uncontrolled growth of instances, resource pooling is a cloud design trait, and live migration moves VMs without inherently breaking isolation.
A server still runs an OS that the vendor no longer supports with security updates. Which vulnerability does this represent?
Correct answer: D. End-of-life system
Unsupported end-of-life systems cannot receive patches and remain exposed. Certificate pinning issues affect TLS clients, open wireless is a network crypto problem, and input validation flaws are a different software class.
Developers hard-code a shared database password inside a mobile app package that anyone can decompile. Which vulnerability is this?
Correct answer: B. Hardcoded credentials
Secrets embedded in client packages are hardcoded credentials. Memory injection places code into processes, replay resubmits captured traffic, and VLAN hopping abuses switch tagging on LANs.
A cloud storage bucket holding customer exports is left publicly listable by mistake. Which vulnerability best describes this?
Correct answer: C. Misconfiguration
Public cloud buckets are a classic misconfiguration. Rootkits hide in firmware or OS layers, buffer overflows corrupt memory, and bluejacking is a Bluetooth messaging nuisance, not storage ACL errors.
SIEM alerts show a user authenticating from New York and Tokyo within ten minutes. Which indicator is this?
Correct answer: B. Impossible travel
Impossible travel flags authentications too far apart for realistic movement. Beaconing is periodic C2 callbacks, MAC spoofing fakes hardware addresses, and certificate expiration is a PKI lifecycle issue.
Network sensors detect a host sending brief HTTPS connections to the same rare domain every five minutes for days. What does this most suggest?
Correct answer: B. Command-and-control beaconing
Regular, low-volume callbacks to an unusual domain often indicate C2 beaconing. Certificate renewal is not typically a multi-day fixed interval pattern, SMTP relay issues affect mail flow, and DHCP starvation exhausts IP leases.
An analyst finds security event logs on a server were cleared shortly after a suspicious service was installed. Why is this concerning?
Correct answer: A. It may indicate anti-forensics after compromise
Clearing logs after suspicious changes is a common anti-forensics indicator. Patch health, scan success, and encryption at rest do not explain deliberate log deletion timed with new services.
Outbound DNS queries contain unusually long subdomain labels with high entropy toward an external domain. What activity is most likely?
Correct answer: A. Data exfiltration via DNS tunneling
Long, high-entropy DNS labels often hide exfiltrated data in tunnels. Resolver caching is normal and short-lived, ARP poisoning is Layer 2 spoofing, and SPF only authenticates email senders.
Host telemetry shows a user's browser spawning PowerShell that downloads a remote script and disables Windows Defender. What is the best classification?
Correct answer: A. Malicious script execution indicator
Browser-to-PowerShell download and security product disablement are strong malware execution indicators. Browser updates, secure boot success, and token enrollment do not match this process chain.
File integrity monitoring reports unexpected changes to system binaries and a new scheduled task running at logon. What should the analyst suspect?
Correct answer: D. Persistence after endpoint compromise
Altered system binaries plus logon tasks are classic persistence indicators. Defragmentation, classification labels, and NTP skew do not rewrite critical binaries or add attacker-style scheduled tasks.
Developers add server-side checks that reject unexpected characters in form fields before processing. Which mitigation is this?
Correct answer: D. Input validation
Input validation blocks malformed or malicious data at entry. Segmentation isolates networks, disk encryption protects stored data, and job rotation is a personnel control against fraud, not request filtering.
An administrator disables SMBv1 and blocks unused high-risk ports on servers after a threat briefing. What mitigation approach is this?
Correct answer: B. Hardening by reducing exposed services
Turning off outdated protocols and unused ports hardens systems and shrinks exposure. Insurance transfers financial risk, MOUs set cooperation intent, and steganography hides messages rather than securing servers.
Security policy forces browsers to open untrusted downloads only inside a restricted virtual desktop with no access to corporate file shares. Which technique is this?
Correct answer: B. Isolation
Running risky content in a sealed environment is isolation. Load balancing spreads traffic, tokenization replaces sensitive values with surrogates, and key escrow stores cryptographic keys with a trusted party.
To stop malware that spreads through macros, the team configures Office so macros from the Internet are blocked by default. Which mitigation is this?
Correct answer: B. Configuration enforcement
Blocking dangerous application features by policy is configuration enforcement, one of the SY0-701 mitigation techniques. VLAN hopping is a network attack, homomorphic encryption computes on ciphertext, and warm sites support disaster recovery capacity.
After detecting malware on a laptop, responders remove it from the LAN and place it on a forensic analysis VLAN. What mitigation step is this?
Correct answer: D. Containment through quarantine
Isolating an infected host is containment via quarantine. Tabletop exercises practice response verbally, risk acceptance leaves risk untreated, and certificate pinning validates TLS certificates in clients.
SecPlus Mastery covers all five SY0-701 domains with over 1,000 practice questions, timed mock exams, and spaced review that targets your weak spots so you walk in ready.
Original practice questions aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.