CompTIA Security+ — All Questions

An attacker sends an email that appears to come from the company CEO, urgently asking the finance team to wire funds to a new vendor. What type of social engineering attack is this?

• a.Business email compromise✓
• b.Watering hole attack
• c.Tailgating
• d.Vishing

Business email compromise (BEC) impersonates a trusted executive or partner to trick employees into transferring money or sensitive data. It relies on authority and urgency rather than malware. Because it uses legitimate-looking email, it often bypasses technical filters and targets human judgment.

Which malware type encrypts a victim's files and demands payment for the decryption key?

• a.Ransomware✓
• b.Adware
• c.Keylogger
• d.Rootkit

Ransomware encrypts data and extorts the victim for a decryption key, often with a payment deadline. Modern variants also exfiltrate data first to enable double extortion. Reliable offline backups are the most effective recovery control.

A user reports that their credentials worked on a fake login page that looked identical to the corporate portal. Which attack most likely occurred?

• a.Buffer overflow
• b.SQL injection
• c.Privilege escalation
• d.Phishing✓

Phishing lures users to fraudulent pages that harvest credentials by mimicking legitimate sites. The cloned portal is the classic delivery mechanism. User training and multifactor authentication reduce the impact of harvested passwords.

Which term describes a previously unknown software vulnerability for which no patch yet exists?

• a.Zero-day✓
• b.Legacy flaw
• c.Race condition
• d.Misconfiguration

A zero-day is a vulnerability unknown to the vendor and defenders, giving zero days to prepare a fix. Attackers exploiting it face no available patch. Compensating controls like segmentation and behavior-based detection help mitigate the risk.

An attacker overwhelms a web server with traffic from thousands of compromised devices, making it unavailable. What is this called?

• a.Distributed denial-of-service✓
• b.On-path replay
• c.DNS poisoning
• d.Man-in-the-middle

A distributed denial-of-service (DDoS) attack floods a target from many compromised hosts, often a botnet, exhausting bandwidth or resources. The goal is to disrupt availability rather than steal data. Rate limiting, scrubbing services, and CDNs help absorb the load.

Which type of threat actor is typically well-funded, highly skilled, and motivated by espionage on behalf of a government?

• a.Hacktivist
• b.Script kiddie
• c.Insider by accident
• d.Nation-state actor✓

Nation-state actors, often labeled advanced persistent threats, have significant resources, patience, and sophisticated tooling. Their goals include espionage, sabotage, and strategic advantage. They frequently use zero-days and long-dwell stealthy campaigns.

A disgruntled employee copies confidential designs to a USB drive before resigning. This is an example of what threat?

• a.Shadow IT
• b.Watering hole
• c.Insider threat✓
• d.Supply chain attack

An insider threat comes from someone with authorized access who misuses it, whether maliciously or negligently. The employee here abuses legitimate access to steal data. Data loss prevention, least privilege, and monitoring help detect such activity.

Which attack injects malicious database commands through unvalidated user input fields?

• a.Directory traversal
• b.SQL injection✓
• c.Session hijacking
• d.Cross-site scripting

SQL injection inserts crafted database statements through input that the application fails to sanitize. It can expose, modify, or delete data. Parameterized queries and input validation are the primary defenses.

An attacker leaves infected USB drives in a company parking lot hoping employees will plug them in. This technique is known as:

• a.Whaling
• b.Baiting✓
• c.Shoulder surfing
• d.Pretexting

Baiting entices victims with something appealing, such as a found USB drive, to trigger a compromise. Curiosity leads the victim to introduce the malware themselves. Endpoint controls that block unknown removable media reduce this risk.

Which malware disguises itself as legitimate software but performs malicious actions once installed?

• a.Logic bomb
• b.Botnet
• c.Worm
• d.Trojan✓

A Trojan masquerades as a benign or useful program to trick users into running it. Unlike a worm, it does not self-replicate; it relies on deception. Once executed it may open backdoors, steal data, or download further payloads.

A malicious program spreads across a network automatically without any user interaction. What is it?

• a.Spyware
• b.Trojan
• c.Worm✓
• d.Rootkit

A worm self-replicates and propagates across networks by exploiting vulnerabilities, requiring no user action. This makes outbreaks spread rapidly. Timely patching and network segmentation slow worm propagation.

An attacker calls an employee pretending to be IT support to trick them into revealing a password. This voice-based social engineering is called:

• a.Phishing
• b.Spooling
• c.Smishing
• d.Vishing✓

Vishing uses voice calls to manipulate victims into disclosing information or performing actions. The attacker builds a plausible pretext, often posing as a trusted party. Verification callbacks and never sharing passwords by phone are effective countermeasures.

Which attack compromises a website frequently visited by a target group to infect their systems?

• a.Rainbow table
• b.Typosquatting
• c.Pass-the-hash
• d.Watering hole✓

A watering hole attack infects a site the intended victims commonly use, so visiting it delivers malware. It targets a community indirectly through a trusted resource. Keeping browsers patched and using endpoint protection reduces exposure.

Which term describes a hidden vulnerability in a third-party component that compromises everyone who uses it?

• a.Configuration drift
• b.Insider risk
• c.Physical risk
• d.Supply chain risk✓

Supply chain risk arises when a trusted vendor, library, or hardware component is compromised, affecting downstream customers. A single tainted update can reach many organizations. Vendor assessments and software bill of materials help manage this risk.

Malware that records every keystroke a user types to capture passwords is a:

• a.Keylogger✓
• b.Rootkit
• c.Backdoor
• d.Ransomware

A keylogger captures keyboard input to steal credentials, messages, and other sensitive typed data. It can be software or hardware based. Multifactor authentication limits the damage from stolen static passwords.

An attacker registers a domain like 'goggle.com' hoping users mistype the real address. This is:

• a.DNS spoofing
• b.Typosquatting✓
• c.Pharming
• d.Session fixation

Typosquatting registers look-alike domains based on common misspellings to catch mistyped traffic. Victims may land on malicious or fraudulent pages. Users should verify URLs and organizations can defensively register close variants.

Which type of malware hides deep in the operating system to conceal its presence and maintain privileged access?

• a.Worm
• b.Adware
• c.Trojan
• d.Rootkit✓

A rootkit embeds itself at a low level, often the kernel, to hide processes and files while retaining elevated control. Its stealth makes detection and removal difficult. Secure boot and integrity monitoring help defend against rootkits.

A phishing attack that specifically targets a high-value executive is known as:

• a.Spear tailoring
• b.Vishing
• c.Whaling✓
• d.Smishing

Whaling is a form of spear phishing aimed at senior executives or high-profile targets. The lures are carefully crafted for that individual and their authority. Executive awareness training and verification procedures reduce success.

Which attack intercepts and possibly alters communication between two parties who believe they are talking directly?

• a.On-path (man-in-the-middle)✓
• b.Cross-site request forgery
• c.Brute force
• d.Denial-of-service

An on-path attack, historically called man-in-the-middle, positions the attacker between two endpoints to eavesdrop or tamper with traffic. Unencrypted channels are especially vulnerable. Strong encryption and certificate validation mitigate it.

A malicious script stored on a vulnerable web page runs in other users' browsers when they view it. This is:

• a.Stored cross-site scripting✓
• b.Clickjacking
• c.SQL injection
• d.CSRF

Stored cross-site scripting (XSS) persists malicious script on the server so it executes in every visitor's browser. It can steal session tokens or perform actions as the victim. Output encoding and input validation prevent XSS.

Which term describes exploiting a time gap between checking a resource and using it?

• a.Replay attack
• b.Race condition✓
• c.Buffer overflow
• d.Injection

A race condition, or time-of-check to time-of-use flaw, exploits the interval between validating and using a resource. An attacker changes state in that window to bypass controls. Proper locking and atomic operations prevent it.

An attacker follows an employee through a secured door without badging in. This physical attack is called:

• a.Piggyback encryption
• b.Tailgating✓
• c.Shoulder surfing
• d.Dumpster diving

Tailgating is entering a restricted area by closely following an authorized person through a controlled door. It exploits politeness and weak physical enforcement. Mantraps, turnstiles, and awareness reduce tailgating.

Which attack precomputes hashes to reverse password hashes quickly?

• a.Rainbow table attack✓
• b.Dictionary attack
• c.Credential stuffing
• d.Password spraying

A rainbow table uses precomputed hash chains to reverse unsalted password hashes efficiently. Adding a unique random salt to each password defeats this approach. Modern slow hashing functions further increase cracking cost.

An attacker tries a few very common passwords across many user accounts to avoid lockouts. This is:

• a.Brute force
• b.Pass-the-hash
• c.Rainbow table
• d.Password spraying✓

Password spraying tests a small set of common passwords across many accounts, staying under lockout thresholds. It exploits weak, reused passwords at scale. Strong password policies, MFA, and anomaly detection counter it.

A teenager with no coding ability downloads a ready-made exploit tool from a forum and launches it against a school website. Which threat actor best describes them?

• a.Hacktivist
• b.Unskilled attacker✓
• c.Nation-state APT group
• d.Organized crime

An unskilled attacker (often called a script kiddie) relies on prewritten tools and exploits without deep technical knowledge. Their capability is limited to what others have built, but automated tools still cause real damage. Motivation is often curiosity or notoriety rather than strategic gain.

A group defaces a corporation's website to protest its environmental record and posts a manifesto. What primarily motivates this threat actor?

• a.Financial gain from reselling stolen payment card data
• b.Corporate espionage
• c.Intelligence collection for a foreign government
• d.Philosophical or political beliefs✓

Hacktivists are driven by ideology, politics, or social causes rather than money. Defacement and public manifestos draw attention to their message. Recognizing motivation helps defenders anticipate targets and tactics.

Which characteristic most distinguishes an insider threat from an external attacker?

• a.Insiders can only cause harm accidentally and never act with malicious intent
• b.Insiders always possess more advanced malware and custom zero-day exploits than outsiders
• c.Insiders are exclusively motivated by financial gain and never by revenge
• d.Authorized access to systems and knowledge of internal processes✓

Insiders already hold legitimate access and understand where valuable data lives, letting them bypass perimeter defenses. This access and knowledge is their defining advantage, whether the act is malicious or negligent. Monitoring, least privilege, and DLP help detect misuse.

During analysis of a sophisticated, multi-year campaign using several zero-days and custom implants, investigators note extensive funding and patience. Which actor attribute does this indicate?

• a.Internal origin, meaning the activity almost certainly came from a current employee
• b.High resources and funding consistent with a nation-state actor✓
• c.Accidental exposure caused by a simple misconfiguration rather than an attacker
• d.Low sophistication typical of an opportunistic smash-and-grab intruder

Sustained campaigns using multiple zero-days and bespoke tooling signal significant resources and funding, a hallmark of nation-state or advanced persistent threat groups. Sophistication and capability are key attributes for attribution. This shapes the required defensive posture.

Attackers steal sensitive customer records and threaten to publish them unless the company pays. Beyond the theft, what is the attackers' primary motivation?

• a.Service disruption
• b.Blackmail✓
• c.War
• d.Ethical disclosure

Threatening to release stolen data unless paid is extortion, a blackmail motivation. This is central to double-extortion ransomware, where data is both encrypted and threatened with exposure. Understanding motivation guides negotiation and response decisions.

An employee receives a text message claiming a package could not be delivered and prompting them to tap a link to reschedule. Which attack vector is being used?

• a.A message-based vector delivered by SMS text✓
• b.An unsecured wireless network broadcasting a deceptive access point name
• c.A malicious removable USB device left in a common area to tempt an employee
• d.A vulnerable client application exposed to the internet without patches

Smishing uses SMS text messages as the delivery vector for a social engineering lure. The link typically leads to a credential-harvesting page or malware. Messaging vectors exploit trust in familiar communication channels.

A hospital still runs a critical application on an operating system that the vendor no longer patches. Why is this a significant attack vector?

• a.Unsupported systems no longer receive security updates, leaving known vulnerabilities permanently open✓
• b.Unsupported systems automatically encrypt all traffic, which slows performance unacceptably
• c.Unsupported systems require multifactor authentication that frustrates clinical staff during care
• d.Unsupported systems always run faster because they lack modern security overhead and logging

End-of-life systems stop receiving vendor patches, so newly discovered vulnerabilities are never fixed and remain exploitable. Attackers specifically target these known gaps. Isolation, compensating controls, or replacement reduce the risk.

Attackers compromise a managed service provider and use its trusted remote-management tools to reach many downstream customers. This is an example of which vector?

• a.A supply chain attack✓
• b.A credential brute-force attack
• c.An open service port
• d.A phishing campaign

Compromising a trusted provider to reach its customers is a supply chain attack. The MSP's legitimate access and tools let the attacker bypass each customer's defenses. Vendor risk assessment and least-privilege integration limit this exposure.

A caller invents a detailed story about being a new auditor who urgently needs employee records to complete a compliance deadline. Which technique underlies this approach?

• a.Shoulder surfing
• b.Baiting
• c.Pretexting✓
• d.Dumpster diving

Pretexting builds a fabricated but believable scenario to justify a request for information or access. The invented auditor role gives the attacker a reason the target will accept. Verifying identity through independent channels defeats it.

During an election, coordinated fake social media accounts deliberately spread false claims to manipulate public opinion. Which concept does this represent?

• a.Watering hole targeting
• b.Business email compromise
• c.Impersonation of a specific individual
• d.A disinformation campaign✓

Disinformation is the deliberate spread of false information to deceive or manipulate, distinct from misinformation shared without intent to harm. Coordinated inauthentic accounts amplify the false narrative. Awareness and source verification counter influence campaigns.

A fraudulent email uses a well-known bank's exact logo, colors, and formatting to convince recipients it is genuine. Which technique is central here?

• a.Pharming
• b.Brand impersonation✓
• c.Credential stuffing with breached passwords
• d.Typosquatting

Brand impersonation copies a trusted organization's visual identity to lend credibility to a scam. Victims lower their guard because the message looks official. Verifying the sender and avoiding embedded links reduces the risk.

Over several friendly conversations, an attacker casually gathers small details about a company's VPN vendor and patch schedule without ever asking directly. This technique is called:

• a.Directory traversal
• b.A logic bomb
• c.Eliciting information✓
• d.A denial-of-service attack

Eliciting information extracts useful details through seemingly innocent conversation rather than a direct request. Aggregated small facts can reveal exploitable weaknesses. Training staff to recognize probing questions limits leakage.

After opening a malicious attachment, a user's machine begins allowing an attacker to view the screen, move the mouse, and browse files remotely. Which malware is most likely present?

• a.A password-protected archive
• b.A remote access Trojan✓
• c.A logic bomb
• d.Adware

A remote access Trojan (RAT) gives an attacker interactive remote control of the infected host. It typically arrives disguised as a legitimate file and then opens a covert channel. Behavior-based detection and egress monitoring help catch its command traffic.

A departing developer inserts code that will delete production databases if their user account is ever removed from the payroll system. What kind of malware is this?

• a.A self-replicating worm
• b.A logic bomb✓
• c.A rootkit
• d.Ransomware

A logic bomb lies dormant until a specific condition or trigger is met, then executes its malicious payload. Here the trigger is the account's removal. Code reviews and separation of duties reduce the chance such code is planted.

A newly purchased laptop ships with numerous preinstalled trial programs that consume resources and expand the attack surface. What are these unwanted extras called?

• a.Bloatware✓
• b.A firmware rootkit
• c.Ransomware
• d.Spyware

Bloatware is unnecessary preinstalled software that wastes resources and can introduce vulnerabilities. It is not always overtly malicious but enlarges the attack surface. Removing it when hardening a new device is good practice.

An investigation finds malicious activity running entirely in memory through PowerShell, with no executable written to disk. Which malware characteristic does this describe?

• a.A boot sector virus
• b.Fileless malware✓
• c.A USB worm
• d.A file infector virus

Fileless malware operates in memory and abuses legitimate tools like PowerShell, leaving little on disk for signature scanners to find. This living-off-the-land approach evades many defenses. Behavioral monitoring and script logging improve detection.

While logged into their bank, a user visits a malicious page that silently submits a funds-transfer request using the user's active session. Which attack is this?

• a.Cross-site request forgery✓
• b.SQL injection
• c.A brute-force attack
• d.DNS poisoning that redirects the banking domain

Cross-site request forgery (CSRF) tricks a victim's browser into sending an unwanted authenticated request to a site where they are logged in. The site trusts the session cookie automatically. Anti-CSRF tokens and same-site cookies prevent it.

An attacker with a low-level user account exploits a flaw to gain administrator rights on the same system. What is this technique called?

• a.Data exfiltration
• b.A distributed denial-of-service attack
• c.Lateral movement
• d.Privilege escalation✓

Privilege escalation raises an attacker's permissions beyond what their account should have, often from user to administrator. It typically exploits a vulnerability or misconfiguration. Patching and least privilege limit escalation paths.

By entering '../../etc/passwd' in a URL parameter, an attacker retrieves files outside the web root. Which vulnerability is being exploited?

• a.Cross-site scripting
• b.A race condition
• c.Directory traversal✓
• d.Session replay

Directory traversal uses sequences like ../ to escape the intended directory and access unauthorized files on the server. Poor input validation of file paths enables it. Canonicalizing and validating paths prevents the attack.

A program copies user input into a fixed-size memory buffer without checking length, letting an attacker overwrite adjacent memory and run code. This is a:

• a.Phishing
• b.SQL injection
• c.Buffer overflow✓
• d.Cross-site request forgery

A buffer overflow writes more data than a buffer can hold, corrupting adjacent memory and potentially allowing arbitrary code execution. Unsafe memory handling in languages like C enables it. Bounds checking, ASLR, and DEP mitigate it.

At a coffee shop, an attacker sets up a rogue access point named identically to the shop's Wi-Fi to intercept connecting users' traffic. This is an:

• a.Jamming
• b.VLAN hopping
• c.ARP poisoning
• d.Evil twin✓

An evil twin is a rogue wireless access point impersonating a legitimate one to lure victims into connecting. Once connected, their traffic can be intercepted or manipulated. Verifying networks and using a VPN protect users on untrusted Wi-Fi.

Users typing the correct bank URL are silently sent to a fraudulent server because forged records were inserted into a resolver's cache. Which attack is this?

• a.A deauthentication attack
• b.MAC flooding
• c.DNS cache poisoning✓
• d.A replay attack

DNS cache poisoning inserts forged records into a resolver so legitimate names resolve to attacker-controlled addresses. Victims are redirected without any visible URL change. DNSSEC and cache protections defend against it.

An attacker sends small spoofed requests to open DNS resolvers, which send much larger responses to the victim's address, overwhelming it. This is an:

• a.SQL injection attack against the victim's public database interface
• b.Privilege escalation attack elevating a standard account to administrator
• c.Amplified, reflected distributed denial-of-service attack✓
• d.Cross-site scripting attack executing script in other users' browsers

A reflected, amplified DDoS spoofs the victim's address so intermediary servers send large responses to the victim, multiplying the traffic. DNS and NTP are common amplifiers. Source-address validation and scrubbing services reduce the impact.

An on-path attacker forces two systems to negotiate an obsolete, weak version of TLS so the traffic can be broken. Which cryptographic attack is this?

• a.A brute-force attack
• b.A rainbow table attack
• c.A downgrade attack✓
• d.A birthday attack

A downgrade attack coerces parties into using a weaker protocol or cipher that the attacker can defeat. Blocking legacy versions and enforcing strong minimums prevents it. This is why disabling old SSL and TLS versions matters.

Two different inputs are found that produce the same hash value, undermining a hash function's integrity guarantee. This is known as a:

• a.Collision✓
• b.A downgrade attack
• c.Salting
• d.Key stretching

A collision occurs when two different inputs hash to the same value, breaking the uniqueness a hash relies on. Birthday attacks exploit probability to find collisions faster than brute force. Moving to stronger algorithms like SHA-256 mitigates the risk.

A researcher demonstrates breaking out of a guest virtual machine to execute code directly on the underlying hypervisor. What is this class of vulnerability called?

• a.VM escape✓
• b.Data remnants
• c.Resource exhaustion
• d.VM sprawl

VM escape breaks the isolation between a guest and the hypervisor, letting an attacker affect the host or other guests. It is a severe risk in multitenant environments. Hypervisor patching and strong isolation controls reduce it.