CompTIA Security+ — All Questions

A company's confidential files are exposed because a cloud storage bucket was set to allow public access. Which root cause best describes this?

• a.A zero-day vulnerability with no vendor patch available
• b.A cryptographic weakness
• c.A security misconfiguration✓
• d.A supply chain compromise

Misconfiguration is a leading cause of cloud data exposure, such as leaving storage publicly readable. The technology worked as configured; the settings were wrong. Secure baselines, automated checks, and least privilege prevent it.

Logs show a user account signing in from New York and, eight minutes later, from Singapore. Which indicator of compromise does this represent?

• a.A blocked-content alert
• b.High CPU use
• c.Impossible travel✓
• d.Out-of-cycle logging

Impossible travel flags logins from geographically distant locations within a timeframe too short to physically travel. It strongly suggests stolen credentials used from two places. Conditional access and risk-based authentication respond to it.

A security analyst notices a single user account with many simultaneous active sessions from different countries. This is best classified as which indicator?

• a.Normal single sign-on behavior expected when a user opens multiple applications
• b.Scheduled maintenance activity that briefly duplicates sessions during failover
• c.Legitimate load balancing distributing the user's requests across data centers
• d.Concurrent session usage suggesting account compromise✓

Multiple concurrent sessions from disparate locations for one account indicate possible credential theft or sharing. It is a recognized indicator of malicious activity. Session monitoring and forced re-authentication help contain it.

During an assessment, a networked camera is found reachable from the internet using the manufacturer's default username and password. Which two weaknesses combine here?

• a.A cryptographic downgrade combined with a hash collision in the login process
• b.A cross-site scripting flaw combined with a cross-site request forgery weakness
• c.A logic bomb paired with a self-propagating worm on the device firmware
• d.An exposed open service and unchanged default credentials✓

Internet-exposed services running default credentials are trivially compromised because the passwords are publicly documented. Attackers scan for exactly this combination. Changing defaults and restricting exposure closes the gap.

An attacker registers 'micros0ft-support.com' to catch users who mistype or misread the legitimate domain. This technique is:

• a.Watering hole targeting
• b.Pharming
• c.Typosquatting✓
• d.Vishing

Typosquatting registers look-alike or misspelled domains to capture users who err when typing or reading a URL. The fraudulent site may harvest credentials or deliver malware. Defensive domain registration and user vigilance help.

Hundreds of infected corporate hosts periodically beacon to the same external server that issues them instructions. What does this server represent?

• a.A content delivery network node
• b.A reverse proxy
• c.A command-and-control server✓
• d.A certificate authority

A command-and-control (C2) server directs a botnet of compromised hosts, sending commands and receiving stolen data. Regular beaconing to one destination is a classic indicator. Blocking C2 domains and inspecting egress traffic disrupts it.

A financially motivated, well-organized group operates ransomware as a business, complete with affiliates and support portals. Which threat actor type is this?

• a.Organized crime✓
• b.An unskilled attacker
• c.An accidental insider
• d.Hacktivists

Organized crime groups are professional, financially motivated actors that run cybercrime like a business. Ransomware-as-a-service with affiliates reflects this structure. Their profit motive drives high-volume, opportunistic targeting.

A marketing team signs up for an unapproved cloud app and uploads customer data without involving security. Which internal risk does this illustrate?

• a.Shadow IT✓
• b.An evil twin access point
• c.Espionage
• d.A supply chain attack

Shadow IT is technology adopted by staff without organizational approval or oversight. It bypasses security review, creating unmanaged data exposure and compliance gaps. Discovery tools and clear policies bring it under control.

An employee gets a call from someone claiming to be the help desk, who asks them to read back a one-time code just sent to their phone. Which attack is underway?

• a.A watering hole attack staged on a website the employee routinely visits
• b.Vishing aimed at capturing a multifactor authentication code✓
• c.Smishing delivered through a fraudulent text message rather than a phone call
• d.A brute-force attempt against the employee's password on the login portal

Vishing uses a phone call and a convincing pretext to trick the victim into revealing information such as a one-time passcode. Capturing that code lets the attacker defeat multifactor authentication. Never sharing codes and verifying callers defeats it.

A visitor holds the door and an unauthorized person walks in after them, with the visitor's knowing cooperation. Which term best fits this scenario?

• a.Dumpster diving
• b.Piggybacking✓
• c.Shoulder surfing
• d.Tailgating

Piggybacking is unauthorized entry with the consent or cooperation of an authorized person, distinguishing it from tailgating, which occurs without that person's knowledge. Both defeat physical access controls. Access vestibules and awareness reduce them.

Within minutes, an infection spreads from one server to hundreds across the network with no user clicking anything, exploiting a single unpatched service. Which malware behavior is this?

• a.A worm exploiting a vulnerability to self-propagate✓
• b.A Trojan that must be manually executed by each user before it can run
• c.Ransomware whose only action is to encrypt files on the initially infected host
• d.Adware that displays pop-ups but does not move between networked systems

A worm self-replicates and spreads automatically by exploiting vulnerabilities, needing no user interaction. Rapid network-wide propagation from one flaw is its signature. Prompt patching and segmentation slow it.

A directory-enabled login form fails to sanitize input, letting an attacker alter the LDAP query to bypass authentication. This is a form of:

• a.Replay
• b.Injection✓
• c.Protocol downgrade
• d.Denial of service

Injection attacks insert crafted input that a system interprets as commands, whether SQL, LDAP, or XML. Unvalidated input to the directory query enables authentication bypass. Input validation and parameterized queries are the defense.

A banking function checks an account balance and then, a moment later, completes a withdrawal; an attacker exploits the delay to withdraw twice. Which flaw is this?

• a.A buffer overflow overwriting adjacent memory beyond a fixed-size array
• b.A cross-site scripting flaw running attacker script in another user's browser
• c.A time-of-check to time-of-use race condition✓
• d.A misconfiguration that left an administrative interface exposed to the internet

A time-of-check to time-of-use (TOCTOU) race condition exploits the gap between validating a condition and acting on it. The attacker changes state within that window to cause double spending. Atomic operations and locking prevent it.

On a local network, an attacker sends forged replies associating their MAC address with the gateway's IP so traffic flows through their machine. This is:

• a.Deauthentication
• b.ARP poisoning✓
• c.DNS cache poisoning
• d.Smurf attack

ARP poisoning forges address resolution replies to redirect local traffic through the attacker, enabling on-path interception. It works because ARP has no authentication. Dynamic ARP inspection and static entries mitigate it.

A user's browsing habits, form entries, and typed passwords are being secretly collected and sent to a third party. Which malware category fits best?

• a.Spyware✓
• b.Worm
• c.Logic bomb
• d.Ransomware

Spyware covertly gathers information about a user's activity and transmits it without consent. Keystroke capture and browsing surveillance are common behaviors. Reputable endpoint protection and cautious software installation reduce exposure.

A rival firm secretly funds intruders to steal a company's unreleased product blueprints. What is the primary motivation behind this activity?

• a.Service disruption
• b.Revenge
• c.Ideological protest
• d.Espionage✓

Espionage seeks to steal confidential information such as trade secrets or intellectual property, often for competitive or strategic advantage. Competitor-sponsored theft is a classic case. Data protection and insider monitoring defend against it.

Malware is hidden inside what appears to be an ordinary image file, executing when a vulnerable viewer opens it. Which attack vector does this use?

• a.An unsecure wireless network broadcasting a deceptive access point name nearby
• b.A phone-based social engineering call impersonating internal technical support
• c.An exposed remote-desktop port left open to the public internet without a firewall
• d.A file-based vector using a malicious image✓

File-based vectors deliver malware inside documents, images, or other files that exploit a flaw in the handling application. The lure looks harmless, encouraging the victim to open it. Patching viewers and scanning attachments reduce risk.

Servers suddenly run at maximum CPU and electricity costs spike, later traced to unauthorized cryptocurrency mining software. Which indicator first signaled this?

• a.A missing-logs alert
• b.Abnormal resource consumption✓
• c.A blocked-content notification
• d.An account lockout

Unusual resource consumption, such as sustained maximum CPU or unexpected power draw, can indicate cryptojacking or other unauthorized processes. Baselining normal utilization makes anomalies visible. Investigation confirms whether it is malicious.

Employees remove the manufacturer's built-in restrictions on their mobile devices to install unauthorized apps. Why does this increase organizational risk?

• a.It permanently encrypts the device so corporate data can never be recovered later
• b.It removes built-in security protections, expanding the device's attack surface✓
• c.It forces the device to use only vendor-signed applications from the official store
• d.It automatically enrolls the device into mobile device management for tighter control

Jailbreaking or rooting removes the vendor's security controls, allowing unsigned apps and undermining the device's protections. This enlarges the attack surface and can bypass MDM policy. Blocking rooted devices from corporate resources mitigates it.

Attackers compromise a niche industry forum that engineers at a target company visit daily, planting malware to infect those specific visitors. This is a:

• a.Credential stuffing
• b.Watering hole attack✓
• c.Smishing campaign
• d.Business email compromise

A watering hole attack compromises a site frequented by the intended victims so that visiting it delivers malware. It targets a community indirectly through a trusted resource. Endpoint protection and patching reduce exposure.

Antivirus reports a clean system, yet certain processes and files are invisible to the operating system's own tools while an attacker retains privileged access. Which malware is most consistent with this?

• a.Adware
• b.A macro virus
• c.A phishing email
• d.A rootkit✓

A rootkit hides its presence at a low level, concealing processes and files while maintaining privileged control. Its stealth is why standard tools show a clean system. Secure boot, integrity checks, and offline scanning help detect it.

An attacker floods the 2.4 GHz band with noise so that nearby Wi-Fi clients cannot maintain a connection. Which attack is this?

• a.ARP poisoning
• b.An evil twin
• c.Wireless jamming✓
• d.A downgrade attack

Jamming intentionally interferes with wireless signals to deny service by overwhelming the frequency with noise. It targets availability rather than data. Spectrum monitoring and directional antennas help locate and mitigate it.

Which statement about threat actor attributes is accurate for exam purposes?

• a.External actors are always more sophisticated and better funded than any insider could be
• b.Only nation-state actors ever have any financial motivation for their operations at all
• c.Actors vary in resources, sophistication, and whether they operate internally or externally✓
• d.Level of sophistication is irrelevant when categorizing and defending against threat actors

Threat actors differ along attributes such as internal versus external origin, resources and funding, and level of sophistication and capability. These attributes shape likely targets and tactics. Profiling them guides proportionate defenses.

A vendor's email account is compromised and used to send a genuine-looking invoice with changed bank details to the customer's accounts payable team. This is best described as:

• a.A rainbow table attack
• b.A watering hole attack
• c.Business email compromise✓
• d.A denial-of-service attack against the accounts payable mail gateway

Business email compromise abuses a trusted or spoofed email account to trick staff into transferring funds or changing payment details. Using a real compromised vendor account makes it especially convincing. Out-of-band verification of banking changes stops it.

Attackers exploit a flaw in widely used software before the vendor is even aware of it, so no patch exists. What is this called?

• a.A zero-day vulnerability✓
• b.An end-of-life condition
• c.A misconfiguration
• d.A supply chain compromise

A zero-day is a previously unknown vulnerability with no available patch, giving defenders zero days to prepare. Attackers value it because existing defenses may not detect the exploit. Segmentation and behavioral detection provide compensating protection.

An attacker captures a valid session token from unencrypted traffic and reuses it to access the victim's authenticated account. This is a:

• a.Buffer overflow
• b.Distributed denial-of-service attack
• c.SQL injection
• d.Session replay attack✓

A replay attack captures a valid credential or token and resubmits it to gain unauthorized access. Unencrypted sessions and predictable tokens make it possible. Encryption, nonces, and short-lived tokens defeat replay.

An attacker overwhelms a switch's address table with thousands of fake MAC addresses, causing it to broadcast traffic to all ports. Which attack is this?

• a.Evil twin
• b.MAC flooding✓
• c.DNS poisoning
• d.A reflected amplification attack

MAC flooding fills a switch's content addressable memory with bogus addresses, forcing it to fail open and broadcast frames, which the attacker can then sniff. It exploits limited table size. Port security limiting learned MACs prevents it.

A penetration test flags that an application still protects passwords using unsalted MD5. Why is this a vulnerability?

• a.MD5 encrypts data so strongly that recovering forgotten passwords becomes impossible
• b.MD5 requires specialized hardware security modules that most servers do not include
• c.MD5 is cryptographically broken and, unsalted, is highly vulnerable to fast cracking✓
• d.MD5 is far too slow, which noticeably degrades the application's login performance

MD5 is a deprecated hash with known collision weaknesses, and without salting it is quickly cracked using precomputed tables. Password storage should use slow, salted algorithms like bcrypt or Argon2. Using broken cryptography is a recognized vulnerability.

A recently fired administrator uses retained credentials to sabotage systems out of anger. What is the primary motivation?

• a.Revenge✓
• b.Espionage
• c.Ethical
• d.Financial gain

Revenge motivates a disgruntled individual to cause harm, often after a perceived wrong such as termination. Prompt deprovisioning of access on offboarding is the key control. Motivation helps predict insider risk.

An analyst finds that a server's security logs stop for a two-hour window that coincides with suspicious file changes. Which indicator does the gap represent?

• a.Excessive resource consumption from an unauthorized cryptocurrency mining process
• b.Missing logs suggesting an attacker cleared traces of their activity✓
• c.A blocked-content event where the web filter denied access to a prohibited site
• d.Impossible travel between two logins occurring in an implausibly short timeframe

Missing or gapped logs are a red flag that an attacker may have deleted records to hide activity. The gap aligning with suspicious changes strengthens that inference. Centralized, tamper-resistant logging preserves evidence.

A device is compromised through an unauthenticated Bluetooth pairing exploit while in a crowded public space. Which category of attack vector is this?

• a.A message-based vector
• b.A default-credential vector
• c.A supply chain vector
• d.An unsecure network vector✓

Unsecure network vectors include wired, wireless, and Bluetooth connections that lack proper protection. Open or weakly secured Bluetooth can allow unauthorized pairing and exploitation. Disabling unused radios and requiring authentication reduce exposure.

An attacker convincingly poses as a specific senior manager and pressures IT to reset that manager's password. Which technique is central to this attack?

• a.Tailgating
• b.Impersonation✓
• c.Dumpster diving
• d.Shoulder surfing

Impersonation involves pretending to be a specific, often authoritative person to manipulate a target into acting. The claimed identity and urgency pressure the help desk to comply. Strong identity verification procedures defeat it.

Opening a spreadsheet enables its embedded macros, which then infect the user's template so every new file carries the malicious code. Which malware type is this?

• a.A worm
• b.A rootkit
• c.A macro virus✓
• d.A denial-of-service tool

A macro virus embeds in documents and executes through the application's macro feature, often spreading via shared templates and files. It requires the user to enable or run the macro. Disabling macros by default and user caution mitigate it.

A trusted software vendor's update mechanism is subverted so that a signed update secretly installs a backdoor on all customers. Which risk does this exemplify?

• a.A brute-force attack that guessed the update server's administrative password
• b.A cross-site scripting flaw in the vendor's public customer support web portal
• c.A misconfiguration where an administrator mistakenly exposed an internal service
• d.A supply chain attack through a compromised software update✓

Subverting a vendor's build or update process to distribute malicious code is a supply chain attack that abuses established trust. A single tainted update can reach many organizations at once. Code signing integrity and vendor assurance help defend against it.

Attackers gain access to a company's domain registrar account and change its DNS records to point the website and email to their own servers. This is:

• a.Hash collision
• b.A deauthentication attack
• c.Domain hijacking✓
• d.MAC flooding

Domain hijacking takes control of a domain's registration or DNS configuration, letting attackers redirect web and email traffic. It often follows a registrar account compromise. Registrar locks and strong account security prevent it.

A batch of network devices is found to contain an unauthorized chip added during manufacturing that could exfiltrate data. Which vulnerability category is this?

• a.An end-of-life condition
• b.A hardware supply chain compromise✓
• c.A zero-day OS flaw
• d.A software misconfiguration applied by the receiving organization after delivery

Hardware supply chain compromises insert malicious components during manufacturing or distribution before the product reaches the buyer. Such implants are hard to detect and abuse deep trust. Trusted suppliers and hardware inspection reduce the risk.

Which set of characteristics is the strongest indicator that an email is a phishing attempt?

• a.A calendar invite from a coworker whose address matches the corporate directory
• b.A digitally signed message from a known colleague sent during normal business hours
• c.An internal newsletter with no links, delivered on its regular weekly schedule again
• d.Urgent tone, a mismatched sender domain, and a link to an unfamiliar login page✓

Classic phishing indicators include manufactured urgency, sender addresses that do not match the claimed organization, and links to unexpected credential pages. Recognizing these cues lets users avoid the lure. Reporting suspicious mail improves defenses.

After remediation, responders discover the attacker left a hidden service that allows them to return later without authenticating normally. What is this called?

• a.A logic bomb
• b.A backdoor✓
• c.A rogue access point
• d.Adware

A backdoor provides covert, persistent access that bypasses normal authentication, letting an attacker return at will. It is often installed to survive initial remediation. Thorough eradication and integrity monitoring are needed to remove it.

An intrusion shows an attacker maintaining stealthy access for over a year, moving slowly and avoiding detection while collecting sensitive data. This dwell pattern is most characteristic of:

• a.A hacktivist
• b.An unskilled attacker
• c.An advanced persistent threat✓
• d.An opportunistic criminal seeking a quick payout

Advanced persistent threats, often nation-state actors, prioritize long-term stealthy access and patient data collection. Extended dwell time with low-and-slow tactics is a defining trait. Detecting them requires behavioral analytics and threat hunting.

An attacker posts flyers with QR codes that lead to a credential-harvesting site disguised as a parking payment portal. Which emerging technique is this?

• a.Vishing conducted over the phone using a spoofed caller identity and a pretext
• b.Quishing, which is phishing delivered through a malicious QR code✓
• c.Tailgating into a restricted area behind an employee holding a valid access badge
• d.A logic bomb embedded in the parking system to execute on a future trigger date

Quishing uses QR codes to direct victims to malicious sites, exploiting trust and the fact that the destination is hidden until scanned. It sidesteps some link filters. Previewing the URL and using caution with public QR codes helps.

An organization worries that staff installing apps from outside the official store could introduce malware. Which practice raises this specific risk?

• a.Sideloading applications from unofficial or unverified sources✓
• b.Enrolling all devices in mobile device management for centralized policy control
• c.Enforcing screen locks with a strong passcode and a short inactivity timeout
• d.Requiring full-disk encryption on every mobile device that stores any company data

Sideloading installs apps from sources outside the vetted official store, bypassing the platform's app review. This raises the chance of installing malicious or trojanized software. Restricting installation sources through MDM reduces the risk.

To slow attackers who steal a password database, developers deliberately use a hashing scheme that is computationally expensive per guess. What is this defensive technique called?

• a.Key stretching✓
• b.Certificate pinning
• c.Tokenization
• d.Steganography

Key stretching applies a deliberately slow, resource-intensive function so each password guess costs more, blunting brute-force and dictionary attacks. Algorithms like bcrypt, scrypt, and PBKDF2 implement it. Combined with salting, it strengthens stored credentials.

A company discovers that internal server names and employee emails are freely searchable online, aiding attacker reconnaissance. This exposure is an example of:

• a.A race condition exploiting the timing gap between a check and a subsequent use
• b.A zero-day vulnerability with no vendor patch available to remediate it just yet
• c.Information available through open-source intelligence✓
• d.A downgrade attack forcing negotiation of a weaker cryptographic protocol version

Open-source intelligence (OSINT) is information gathered from publicly available sources, which attackers use during reconnaissance. Exposed names and emails ease targeting and phishing. Limiting public exposure and monitoring for leaks reduce the aid to attackers.

A phishing email succeeds largely because it claims an account will be closed within one hour unless the recipient acts immediately. Which social engineering principle is being exploited?

• a.Authority
• b.Urgency✓
• c.Trust
• d.Social proof

Urgency pressures victims to act quickly before thinking critically, a core social engineering principle. Artificial deadlines short-circuit careful verification. Training users to slow down and verify defeats manufactured urgency.