CompTIA Security+ — All Questions

A teenager with no coding ability downloads a ready-made exploit tool from a forum and launches it against a school website. Which threat actor best describes them?

• a.Hacktivist
• b.Unskilled attacker✓
• c.Nation-state APT group
• d.Organized crime

An unskilled attacker (often called a script kiddie) relies on prewritten tools and exploits without deep technical knowledge. Their capability is limited to what others have built, but automated tools still cause real damage. Motivation is often curiosity or notoriety rather than strategic gain.

A group defaces a corporation's website to protest its environmental record and posts a manifesto. What primarily motivates this threat actor?

• a.Financial gain from reselling stolen payment card data
• b.Corporate espionage
• c.Intelligence collection for a foreign government
• d.Philosophical or political beliefs✓

Hacktivists are driven by ideology, politics, or social causes rather than money. Defacement and public manifestos draw attention to their message. Recognizing motivation helps defenders anticipate targets and tactics.

Which characteristic most distinguishes an insider threat from an external attacker?

• a.Insiders can only cause harm accidentally and never act with malicious intent
• b.Insiders always possess more advanced malware and custom zero-day exploits than outsiders
• c.Insiders are exclusively motivated by financial gain and never by revenge
• d.Authorized access to systems and knowledge of internal processes✓

Insiders already hold legitimate access and understand where valuable data lives, letting them bypass perimeter defenses. This access and knowledge is their defining advantage, whether the act is malicious or negligent. Monitoring, least privilege, and DLP help detect misuse.

During analysis of a sophisticated, multi-year campaign using several zero-days and custom implants, investigators note extensive funding and patience. Which actor attribute does this indicate?

• a.Internal origin, meaning the activity almost certainly came from a current employee
• b.High resources and funding consistent with a nation-state actor✓
• c.Accidental exposure caused by a simple misconfiguration rather than an attacker
• d.Low sophistication typical of an opportunistic smash-and-grab intruder

Sustained campaigns using multiple zero-days and bespoke tooling signal significant resources and funding, a hallmark of nation-state or advanced persistent threat groups. Sophistication and capability are key attributes for attribution. This shapes the required defensive posture.

Attackers steal sensitive customer records and threaten to publish them unless the company pays. Beyond the theft, what is the attackers' primary motivation?

• a.Service disruption
• b.Blackmail✓
• c.War
• d.Ethical disclosure

Threatening to release stolen data unless paid is extortion, a blackmail motivation. This is central to double-extortion ransomware, where data is both encrypted and threatened with exposure. Understanding motivation guides negotiation and response decisions.

An employee receives a text message claiming a package could not be delivered and prompting them to tap a link to reschedule. Which attack vector is being used?

• a.A message-based vector delivered by SMS text✓
• b.An unsecured wireless network broadcasting a deceptive access point name
• c.A malicious removable USB device left in a common area to tempt an employee
• d.A vulnerable client application exposed to the internet without patches

Smishing uses SMS text messages as the delivery vector for a social engineering lure. The link typically leads to a credential-harvesting page or malware. Messaging vectors exploit trust in familiar communication channels.

A hospital still runs a critical application on an operating system that the vendor no longer patches. Why is this a significant attack vector?

• a.Unsupported systems no longer receive security updates, leaving known vulnerabilities permanently open✓
• b.Unsupported systems automatically encrypt all traffic, which slows performance unacceptably
• c.Unsupported systems require multifactor authentication that frustrates clinical staff during care
• d.Unsupported systems always run faster because they lack modern security overhead and logging

End-of-life systems stop receiving vendor patches, so newly discovered vulnerabilities are never fixed and remain exploitable. Attackers specifically target these known gaps. Isolation, compensating controls, or replacement reduce the risk.

Attackers compromise a managed service provider and use its trusted remote-management tools to reach many downstream customers. This is an example of which vector?

• a.A supply chain attack✓
• b.A credential brute-force attack
• c.An open service port
• d.A phishing campaign

Compromising a trusted provider to reach its customers is a supply chain attack. The MSP's legitimate access and tools let the attacker bypass each customer's defenses. Vendor risk assessment and least-privilege integration limit this exposure.

A caller invents a detailed story about being a new auditor who urgently needs employee records to complete a compliance deadline. Which technique underlies this approach?

• a.Shoulder surfing
• b.Baiting
• c.Pretexting✓
• d.Dumpster diving

Pretexting builds a fabricated but believable scenario to justify a request for information or access. The invented auditor role gives the attacker a reason the target will accept. Verifying identity through independent channels defeats it.

During an election, coordinated fake social media accounts deliberately spread false claims to manipulate public opinion. Which concept does this represent?

• a.Watering hole targeting
• b.Business email compromise
• c.Impersonation of a specific individual
• d.A disinformation campaign✓

Disinformation is the deliberate spread of false information to deceive or manipulate, distinct from misinformation shared without intent to harm. Coordinated inauthentic accounts amplify the false narrative. Awareness and source verification counter influence campaigns.

A fraudulent email uses a well-known bank's exact logo, colors, and formatting to convince recipients it is genuine. Which technique is central here?

• a.Pharming
• b.Brand impersonation✓
• c.Credential stuffing with breached passwords
• d.Typosquatting

Brand impersonation copies a trusted organization's visual identity to lend credibility to a scam. Victims lower their guard because the message looks official. Verifying the sender and avoiding embedded links reduces the risk.

Over several friendly conversations, an attacker casually gathers small details about a company's VPN vendor and patch schedule without ever asking directly. This technique is called:

• a.Directory traversal
• b.A logic bomb
• c.Eliciting information✓
• d.A denial-of-service attack

Eliciting information extracts useful details through seemingly innocent conversation rather than a direct request. Aggregated small facts can reveal exploitable weaknesses. Training staff to recognize probing questions limits leakage.

After opening a malicious attachment, a user's machine begins allowing an attacker to view the screen, move the mouse, and browse files remotely. Which malware is most likely present?

• a.A password-protected archive
• b.A remote access Trojan✓
• c.A logic bomb
• d.Adware

A remote access Trojan (RAT) gives an attacker interactive remote control of the infected host. It typically arrives disguised as a legitimate file and then opens a covert channel. Behavior-based detection and egress monitoring help catch its command traffic.

A departing developer inserts code that will delete production databases if their user account is ever removed from the payroll system. What kind of malware is this?

• a.A self-replicating worm
• b.A logic bomb✓
• c.A rootkit
• d.Ransomware

A logic bomb lies dormant until a specific condition or trigger is met, then executes its malicious payload. Here the trigger is the account's removal. Code reviews and separation of duties reduce the chance such code is planted.

A newly purchased laptop ships with numerous preinstalled trial programs that consume resources and expand the attack surface. What are these unwanted extras called?

• a.Bloatware✓
• b.A firmware rootkit
• c.Ransomware
• d.Spyware

Bloatware is unnecessary preinstalled software that wastes resources and can introduce vulnerabilities. It is not always overtly malicious but enlarges the attack surface. Removing it when hardening a new device is good practice.

An investigation finds malicious activity running entirely in memory through PowerShell, with no executable written to disk. Which malware characteristic does this describe?

• a.A boot sector virus
• b.Fileless malware✓
• c.A USB worm
• d.A file infector virus

Fileless malware operates in memory and abuses legitimate tools like PowerShell, leaving little on disk for signature scanners to find. This living-off-the-land approach evades many defenses. Behavioral monitoring and script logging improve detection.

While logged into their bank, a user visits a malicious page that silently submits a funds-transfer request using the user's active session. Which attack is this?

• a.Cross-site request forgery✓
• b.SQL injection
• c.A brute-force attack
• d.DNS poisoning that redirects the banking domain

Cross-site request forgery (CSRF) tricks a victim's browser into sending an unwanted authenticated request to a site where they are logged in. The site trusts the session cookie automatically. Anti-CSRF tokens and same-site cookies prevent it.

An attacker with a low-level user account exploits a flaw to gain administrator rights on the same system. What is this technique called?

• a.Data exfiltration
• b.A distributed denial-of-service attack
• c.Lateral movement
• d.Privilege escalation✓

Privilege escalation raises an attacker's permissions beyond what their account should have, often from user to administrator. It typically exploits a vulnerability or misconfiguration. Patching and least privilege limit escalation paths.

By entering '../../etc/passwd' in a URL parameter, an attacker retrieves files outside the web root. Which vulnerability is being exploited?

• a.Cross-site scripting
• b.A race condition
• c.Directory traversal✓
• d.Session replay

Directory traversal uses sequences like ../ to escape the intended directory and access unauthorized files on the server. Poor input validation of file paths enables it. Canonicalizing and validating paths prevents the attack.

A program copies user input into a fixed-size memory buffer without checking length, letting an attacker overwrite adjacent memory and run code. This is a:

• a.Phishing
• b.SQL injection
• c.Buffer overflow✓
• d.Cross-site request forgery

A buffer overflow writes more data than a buffer can hold, corrupting adjacent memory and potentially allowing arbitrary code execution. Unsafe memory handling in languages like C enables it. Bounds checking, ASLR, and DEP mitigate it.

At a coffee shop, an attacker sets up a rogue access point named identically to the shop's Wi-Fi to intercept connecting users' traffic. This is an:

• a.Jamming
• b.VLAN hopping
• c.ARP poisoning
• d.Evil twin✓

An evil twin is a rogue wireless access point impersonating a legitimate one to lure victims into connecting. Once connected, their traffic can be intercepted or manipulated. Verifying networks and using a VPN protect users on untrusted Wi-Fi.

Users typing the correct bank URL are silently sent to a fraudulent server because forged records were inserted into a resolver's cache. Which attack is this?

• a.A deauthentication attack
• b.MAC flooding
• c.DNS cache poisoning✓
• d.A replay attack

DNS cache poisoning inserts forged records into a resolver so legitimate names resolve to attacker-controlled addresses. Victims are redirected without any visible URL change. DNSSEC and cache protections defend against it.

An attacker sends small spoofed requests to open DNS resolvers, which send much larger responses to the victim's address, overwhelming it. This is an:

• a.SQL injection attack against the victim's public database interface
• b.Privilege escalation attack elevating a standard account to administrator
• c.Amplified, reflected distributed denial-of-service attack✓
• d.Cross-site scripting attack executing script in other users' browsers

A reflected, amplified DDoS spoofs the victim's address so intermediary servers send large responses to the victim, multiplying the traffic. DNS and NTP are common amplifiers. Source-address validation and scrubbing services reduce the impact.

An on-path attacker forces two systems to negotiate an obsolete, weak version of TLS so the traffic can be broken. Which cryptographic attack is this?

• a.A brute-force attack
• b.A rainbow table attack
• c.A downgrade attack✓
• d.A birthday attack

A downgrade attack coerces parties into using a weaker protocol or cipher that the attacker can defeat. Blocking legacy versions and enforcing strong minimums prevents it. This is why disabling old SSL and TLS versions matters.

Two different inputs are found that produce the same hash value, undermining a hash function's integrity guarantee. This is known as a:

• a.Collision✓
• b.A downgrade attack
• c.Salting
• d.Key stretching

A collision occurs when two different inputs hash to the same value, breaking the uniqueness a hash relies on. Birthday attacks exploit probability to find collisions faster than brute force. Moving to stronger algorithms like SHA-256 mitigates the risk.

A researcher demonstrates breaking out of a guest virtual machine to execute code directly on the underlying hypervisor. What is this class of vulnerability called?

• a.VM escape✓
• b.Data remnants
• c.Resource exhaustion
• d.VM sprawl

VM escape breaks the isolation between a guest and the hypervisor, letting an attacker affect the host or other guests. It is a severe risk in multitenant environments. Hypervisor patching and strong isolation controls reduce it.

A company's confidential files are exposed because a cloud storage bucket was set to allow public access. Which root cause best describes this?

• a.A zero-day vulnerability with no vendor patch available
• b.A cryptographic weakness
• c.A security misconfiguration✓
• d.A supply chain compromise

Misconfiguration is a leading cause of cloud data exposure, such as leaving storage publicly readable. The technology worked as configured; the settings were wrong. Secure baselines, automated checks, and least privilege prevent it.

Logs show a user account signing in from New York and, eight minutes later, from Singapore. Which indicator of compromise does this represent?

• a.A blocked-content alert
• b.High CPU use
• c.Impossible travel✓
• d.Out-of-cycle logging

Impossible travel flags logins from geographically distant locations within a timeframe too short to physically travel. It strongly suggests stolen credentials used from two places. Conditional access and risk-based authentication respond to it.

A security analyst notices a single user account with many simultaneous active sessions from different countries. This is best classified as which indicator?

• a.Normal single sign-on behavior expected when a user opens multiple applications
• b.Scheduled maintenance activity that briefly duplicates sessions during failover
• c.Legitimate load balancing distributing the user's requests across data centers
• d.Concurrent session usage suggesting account compromise✓

Multiple concurrent sessions from disparate locations for one account indicate possible credential theft or sharing. It is a recognized indicator of malicious activity. Session monitoring and forced re-authentication help contain it.

During an assessment, a networked camera is found reachable from the internet using the manufacturer's default username and password. Which two weaknesses combine here?

• a.A cryptographic downgrade combined with a hash collision in the login process
• b.A cross-site scripting flaw combined with a cross-site request forgery weakness
• c.A logic bomb paired with a self-propagating worm on the device firmware
• d.An exposed open service and unchanged default credentials✓

Internet-exposed services running default credentials are trivially compromised because the passwords are publicly documented. Attackers scan for exactly this combination. Changing defaults and restricting exposure closes the gap.

An attacker registers 'micros0ft-support.com' to catch users who mistype or misread the legitimate domain. This technique is:

• a.Watering hole targeting
• b.Pharming
• c.Typosquatting✓
• d.Vishing

Typosquatting registers look-alike or misspelled domains to capture users who err when typing or reading a URL. The fraudulent site may harvest credentials or deliver malware. Defensive domain registration and user vigilance help.

Hundreds of infected corporate hosts periodically beacon to the same external server that issues them instructions. What does this server represent?

• a.A content delivery network node
• b.A reverse proxy
• c.A command-and-control server✓
• d.A certificate authority

A command-and-control (C2) server directs a botnet of compromised hosts, sending commands and receiving stolen data. Regular beaconing to one destination is a classic indicator. Blocking C2 domains and inspecting egress traffic disrupts it.

A financially motivated, well-organized group operates ransomware as a business, complete with affiliates and support portals. Which threat actor type is this?

• a.Organized crime✓
• b.An unskilled attacker
• c.An accidental insider
• d.Hacktivists

Organized crime groups are professional, financially motivated actors that run cybercrime like a business. Ransomware-as-a-service with affiliates reflects this structure. Their profit motive drives high-volume, opportunistic targeting.

A marketing team signs up for an unapproved cloud app and uploads customer data without involving security. Which internal risk does this illustrate?

• a.Shadow IT✓
• b.An evil twin access point
• c.Espionage
• d.A supply chain attack

Shadow IT is technology adopted by staff without organizational approval or oversight. It bypasses security review, creating unmanaged data exposure and compliance gaps. Discovery tools and clear policies bring it under control.

An employee gets a call from someone claiming to be the help desk, who asks them to read back a one-time code just sent to their phone. Which attack is underway?

• a.A watering hole attack staged on a website the employee routinely visits
• b.Vishing aimed at capturing a multifactor authentication code✓
• c.Smishing delivered through a fraudulent text message rather than a phone call
• d.A brute-force attempt against the employee's password on the login portal

Vishing uses a phone call and a convincing pretext to trick the victim into revealing information such as a one-time passcode. Capturing that code lets the attacker defeat multifactor authentication. Never sharing codes and verifying callers defeats it.

A visitor holds the door and an unauthorized person walks in after them, with the visitor's knowing cooperation. Which term best fits this scenario?

• a.Dumpster diving
• b.Piggybacking✓
• c.Shoulder surfing
• d.Tailgating

Piggybacking is unauthorized entry with the consent or cooperation of an authorized person, distinguishing it from tailgating, which occurs without that person's knowledge. Both defeat physical access controls. Access vestibules and awareness reduce them.

Within minutes, an infection spreads from one server to hundreds across the network with no user clicking anything, exploiting a single unpatched service. Which malware behavior is this?

• a.A worm exploiting a vulnerability to self-propagate✓
• b.A Trojan that must be manually executed by each user before it can run
• c.Ransomware whose only action is to encrypt files on the initially infected host
• d.Adware that displays pop-ups but does not move between networked systems

A worm self-replicates and spreads automatically by exploiting vulnerabilities, needing no user interaction. Rapid network-wide propagation from one flaw is its signature. Prompt patching and segmentation slow it.

A directory-enabled login form fails to sanitize input, letting an attacker alter the LDAP query to bypass authentication. This is a form of:

• a.Replay
• b.Injection✓
• c.Protocol downgrade
• d.Denial of service

Injection attacks insert crafted input that a system interprets as commands, whether SQL, LDAP, or XML. Unvalidated input to the directory query enables authentication bypass. Input validation and parameterized queries are the defense.

A banking function checks an account balance and then, a moment later, completes a withdrawal; an attacker exploits the delay to withdraw twice. Which flaw is this?

• a.A buffer overflow overwriting adjacent memory beyond a fixed-size array
• b.A cross-site scripting flaw running attacker script in another user's browser
• c.A time-of-check to time-of-use race condition✓
• d.A misconfiguration that left an administrative interface exposed to the internet

A time-of-check to time-of-use (TOCTOU) race condition exploits the gap between validating a condition and acting on it. The attacker changes state within that window to cause double spending. Atomic operations and locking prevent it.

On a local network, an attacker sends forged replies associating their MAC address with the gateway's IP so traffic flows through their machine. This is:

• a.Deauthentication
• b.ARP poisoning✓
• c.DNS cache poisoning
• d.Smurf attack

ARP poisoning forges address resolution replies to redirect local traffic through the attacker, enabling on-path interception. It works because ARP has no authentication. Dynamic ARP inspection and static entries mitigate it.

A user's browsing habits, form entries, and typed passwords are being secretly collected and sent to a third party. Which malware category fits best?

• a.Spyware✓
• b.Worm
• c.Logic bomb
• d.Ransomware

Spyware covertly gathers information about a user's activity and transmits it without consent. Keystroke capture and browsing surveillance are common behaviors. Reputable endpoint protection and cautious software installation reduce exposure.

A rival firm secretly funds intruders to steal a company's unreleased product blueprints. What is the primary motivation behind this activity?

• a.Service disruption
• b.Revenge
• c.Ideological protest
• d.Espionage✓

Espionage seeks to steal confidential information such as trade secrets or intellectual property, often for competitive or strategic advantage. Competitor-sponsored theft is a classic case. Data protection and insider monitoring defend against it.

Malware is hidden inside what appears to be an ordinary image file, executing when a vulnerable viewer opens it. Which attack vector does this use?

• a.An unsecure wireless network broadcasting a deceptive access point name nearby
• b.A phone-based social engineering call impersonating internal technical support
• c.An exposed remote-desktop port left open to the public internet without a firewall
• d.A file-based vector using a malicious image✓

File-based vectors deliver malware inside documents, images, or other files that exploit a flaw in the handling application. The lure looks harmless, encouraging the victim to open it. Patching viewers and scanning attachments reduce risk.

Servers suddenly run at maximum CPU and electricity costs spike, later traced to unauthorized cryptocurrency mining software. Which indicator first signaled this?

• a.A missing-logs alert
• b.Abnormal resource consumption✓
• c.A blocked-content notification
• d.An account lockout

Unusual resource consumption, such as sustained maximum CPU or unexpected power draw, can indicate cryptojacking or other unauthorized processes. Baselining normal utilization makes anomalies visible. Investigation confirms whether it is malicious.

Employees remove the manufacturer's built-in restrictions on their mobile devices to install unauthorized apps. Why does this increase organizational risk?

• a.It permanently encrypts the device so corporate data can never be recovered later
• b.It removes built-in security protections, expanding the device's attack surface✓
• c.It forces the device to use only vendor-signed applications from the official store
• d.It automatically enrolls the device into mobile device management for tighter control

Jailbreaking or rooting removes the vendor's security controls, allowing unsigned apps and undermining the device's protections. This enlarges the attack surface and can bypass MDM policy. Blocking rooted devices from corporate resources mitigates it.

Attackers compromise a niche industry forum that engineers at a target company visit daily, planting malware to infect those specific visitors. This is a:

• a.Credential stuffing
• b.Watering hole attack✓
• c.Smishing campaign
• d.Business email compromise

A watering hole attack compromises a site frequented by the intended victims so that visiting it delivers malware. It targets a community indirectly through a trusted resource. Endpoint protection and patching reduce exposure.

Antivirus reports a clean system, yet certain processes and files are invisible to the operating system's own tools while an attacker retains privileged access. Which malware is most consistent with this?

• a.Adware
• b.A macro virus
• c.A phishing email
• d.A rootkit✓

A rootkit hides its presence at a low level, concealing processes and files while maintaining privileged control. Its stealth is why standard tools show a clean system. Secure boot, integrity checks, and offline scanning help detect it.

An attacker floods the 2.4 GHz band with noise so that nearby Wi-Fi clients cannot maintain a connection. Which attack is this?

• a.ARP poisoning
• b.An evil twin
• c.Wireless jamming✓
• d.A downgrade attack

Jamming intentionally interferes with wireless signals to deny service by overwhelming the frequency with noise. It targets availability rather than data. Spectrum monitoring and directional antennas help locate and mitigate it.

Which statement about threat actor attributes is accurate for exam purposes?

• a.External actors are always more sophisticated and better funded than any insider could be
• b.Only nation-state actors ever have any financial motivation for their operations at all
• c.Actors vary in resources, sophistication, and whether they operate internally or externally✓
• d.Level of sophistication is irrelevant when categorizing and defending against threat actors

Threat actors differ along attributes such as internal versus external origin, resources and funding, and level of sophistication and capability. These attributes shape likely targets and tactics. Profiling them guides proportionate defenses.

A vendor's email account is compromised and used to send a genuine-looking invoice with changed bank details to the customer's accounts payable team. This is best described as:

• a.A rainbow table attack
• b.A watering hole attack
• c.Business email compromise✓
• d.A denial-of-service attack against the accounts payable mail gateway

Business email compromise abuses a trusted or spoofed email account to trick staff into transferring funds or changing payment details. Using a real compromised vendor account makes it especially convincing. Out-of-band verification of banking changes stops it.