CompTIA Security+ — All Questions

An attacker sends an email that appears to come from the company CEO, urgently asking the finance team to wire funds to a new vendor. What type of social engineering attack is this?

• a.Business email compromise✓
• b.Watering hole attack
• c.Tailgating
• d.Vishing

Business email compromise (BEC) impersonates a trusted executive or partner to trick employees into transferring money or sensitive data. It relies on authority and urgency rather than malware. Because it uses legitimate-looking email, it often bypasses technical filters and targets human judgment.

Which malware type encrypts a victim's files and demands payment for the decryption key?

• a.Ransomware✓
• b.Adware
• c.Keylogger
• d.Rootkit

Ransomware encrypts data and extorts the victim for a decryption key, often with a payment deadline. Modern variants also exfiltrate data first to enable double extortion. Reliable offline backups are the most effective recovery control.

A user reports that their credentials worked on a fake login page that looked identical to the corporate portal. Which attack most likely occurred?

• a.Buffer overflow
• b.SQL injection
• c.Privilege escalation
• d.Phishing✓

Phishing lures users to fraudulent pages that harvest credentials by mimicking legitimate sites. The cloned portal is the classic delivery mechanism. User training and multifactor authentication reduce the impact of harvested passwords.

Which term describes a previously unknown software vulnerability for which no patch yet exists?

• a.Zero-day✓
• b.Legacy flaw
• c.Race condition
• d.Misconfiguration

A zero-day is a vulnerability unknown to the vendor and defenders, giving zero days to prepare a fix. Attackers exploiting it face no available patch. Compensating controls like segmentation and behavior-based detection help mitigate the risk.

An attacker overwhelms a web server with traffic from thousands of compromised devices, making it unavailable. What is this called?

• a.Distributed denial-of-service✓
• b.On-path replay
• c.DNS poisoning
• d.Man-in-the-middle

A distributed denial-of-service (DDoS) attack floods a target from many compromised hosts, often a botnet, exhausting bandwidth or resources. The goal is to disrupt availability rather than steal data. Rate limiting, scrubbing services, and CDNs help absorb the load.

Which type of threat actor is typically well-funded, highly skilled, and motivated by espionage on behalf of a government?

• a.Hacktivist
• b.Script kiddie
• c.Insider by accident
• d.Nation-state actor✓

Nation-state actors, often labeled advanced persistent threats, have significant resources, patience, and sophisticated tooling. Their goals include espionage, sabotage, and strategic advantage. They frequently use zero-days and long-dwell stealthy campaigns.

A disgruntled employee copies confidential designs to a USB drive before resigning. This is an example of what threat?

• a.Shadow IT
• b.Watering hole
• c.Insider threat✓
• d.Supply chain attack

An insider threat comes from someone with authorized access who misuses it, whether maliciously or negligently. The employee here abuses legitimate access to steal data. Data loss prevention, least privilege, and monitoring help detect such activity.

Which attack injects malicious database commands through unvalidated user input fields?

• a.Directory traversal
• b.SQL injection✓
• c.Session hijacking
• d.Cross-site scripting

SQL injection inserts crafted database statements through input that the application fails to sanitize. It can expose, modify, or delete data. Parameterized queries and input validation are the primary defenses.

An attacker leaves infected USB drives in a company parking lot hoping employees will plug them in. This technique is known as:

• a.Whaling
• b.Baiting✓
• c.Shoulder surfing
• d.Pretexting

Baiting entices victims with something appealing, such as a found USB drive, to trigger a compromise. Curiosity leads the victim to introduce the malware themselves. Endpoint controls that block unknown removable media reduce this risk.

Which malware disguises itself as legitimate software but performs malicious actions once installed?

• a.Logic bomb
• b.Botnet
• c.Worm
• d.Trojan✓

A Trojan masquerades as a benign or useful program to trick users into running it. Unlike a worm, it does not self-replicate; it relies on deception. Once executed it may open backdoors, steal data, or download further payloads.

A malicious program spreads across a network automatically without any user interaction. What is it?

• a.Spyware
• b.Trojan
• c.Worm✓
• d.Rootkit

A worm self-replicates and propagates across networks by exploiting vulnerabilities, requiring no user action. This makes outbreaks spread rapidly. Timely patching and network segmentation slow worm propagation.

An attacker calls an employee pretending to be IT support to trick them into revealing a password. This voice-based social engineering is called:

• a.Phishing
• b.Spooling
• c.Smishing
• d.Vishing✓

Vishing uses voice calls to manipulate victims into disclosing information or performing actions. The attacker builds a plausible pretext, often posing as a trusted party. Verification callbacks and never sharing passwords by phone are effective countermeasures.

Which attack compromises a website frequently visited by a target group to infect their systems?

• a.Rainbow table
• b.Typosquatting
• c.Pass-the-hash
• d.Watering hole✓

A watering hole attack infects a site the intended victims commonly use, so visiting it delivers malware. It targets a community indirectly through a trusted resource. Keeping browsers patched and using endpoint protection reduces exposure.

Which term describes a hidden vulnerability in a third-party component that compromises everyone who uses it?

• a.Configuration drift
• b.Insider risk
• c.Physical risk
• d.Supply chain risk✓

Supply chain risk arises when a trusted vendor, library, or hardware component is compromised, affecting downstream customers. A single tainted update can reach many organizations. Vendor assessments and software bill of materials help manage this risk.

Malware that records every keystroke a user types to capture passwords is a:

• a.Keylogger✓
• b.Rootkit
• c.Backdoor
• d.Ransomware

A keylogger captures keyboard input to steal credentials, messages, and other sensitive typed data. It can be software or hardware based. Multifactor authentication limits the damage from stolen static passwords.

An attacker registers a domain like 'goggle.com' hoping users mistype the real address. This is:

• a.DNS spoofing
• b.Typosquatting✓
• c.Pharming
• d.Session fixation

Typosquatting registers look-alike domains based on common misspellings to catch mistyped traffic. Victims may land on malicious or fraudulent pages. Users should verify URLs and organizations can defensively register close variants.

Which type of malware hides deep in the operating system to conceal its presence and maintain privileged access?

• a.Worm
• b.Adware
• c.Trojan
• d.Rootkit✓

A rootkit embeds itself at a low level, often the kernel, to hide processes and files while retaining elevated control. Its stealth makes detection and removal difficult. Secure boot and integrity monitoring help defend against rootkits.

A phishing attack that specifically targets a high-value executive is known as:

• a.Spear tailoring
• b.Vishing
• c.Whaling✓
• d.Smishing

Whaling is a form of spear phishing aimed at senior executives or high-profile targets. The lures are carefully crafted for that individual and their authority. Executive awareness training and verification procedures reduce success.

Which attack intercepts and possibly alters communication between two parties who believe they are talking directly?

• a.On-path (man-in-the-middle)✓
• b.Cross-site request forgery
• c.Brute force
• d.Denial-of-service

An on-path attack, historically called man-in-the-middle, positions the attacker between two endpoints to eavesdrop or tamper with traffic. Unencrypted channels are especially vulnerable. Strong encryption and certificate validation mitigate it.

A malicious script stored on a vulnerable web page runs in other users' browsers when they view it. This is:

• a.Stored cross-site scripting✓
• b.Clickjacking
• c.SQL injection
• d.CSRF

Stored cross-site scripting (XSS) persists malicious script on the server so it executes in every visitor's browser. It can steal session tokens or perform actions as the victim. Output encoding and input validation prevent XSS.

Which term describes exploiting a time gap between checking a resource and using it?

• a.Replay attack
• b.Race condition✓
• c.Buffer overflow
• d.Injection

A race condition, or time-of-check to time-of-use flaw, exploits the interval between validating and using a resource. An attacker changes state in that window to bypass controls. Proper locking and atomic operations prevent it.

An attacker follows an employee through a secured door without badging in. This physical attack is called:

• a.Piggyback encryption
• b.Tailgating✓
• c.Shoulder surfing
• d.Dumpster diving

Tailgating is entering a restricted area by closely following an authorized person through a controlled door. It exploits politeness and weak physical enforcement. Mantraps, turnstiles, and awareness reduce tailgating.

Which attack precomputes hashes to reverse password hashes quickly?

• a.Rainbow table attack✓
• b.Dictionary attack
• c.Credential stuffing
• d.Password spraying

A rainbow table uses precomputed hash chains to reverse unsalted password hashes efficiently. Adding a unique random salt to each password defeats this approach. Modern slow hashing functions further increase cracking cost.

An attacker tries a few very common passwords across many user accounts to avoid lockouts. This is:

• a.Brute force
• b.Pass-the-hash
• c.Rainbow table
• d.Password spraying✓

Password spraying tests a small set of common passwords across many accounts, staying under lockout thresholds. It exploits weak, reused passwords at scale. Strong password policies, MFA, and anomaly detection counter it.

A teenager with no coding ability downloads a ready-made exploit tool from a forum and launches it against a school website. Which threat actor best describes them?

• a.A hacktivist collective motivated by a political or ideological cause
• b.Unskilled attacker✓
• c.A nation-state group running a long-term espionage campaign for strategic advantage
• d.An organized crime syndicate seeking large-scale financial extortion

An unskilled attacker (often called a script kiddie) relies on prewritten tools and exploits without deep technical knowledge. Their capability is limited to what others have built, but automated tools still cause real damage. Motivation is often curiosity or notoriety rather than strategic gain.

A group defaces a corporation's website to protest its environmental record and posts a manifesto. What primarily motivates this threat actor?

• a.Financial gain achieved by reselling stolen payment card data on illicit markets
• b.Corporate espionage to steal a competitor's product designs and pricing strategy
• c.Long-term intelligence collection on behalf of a foreign government's interests
• d.Philosophical or political beliefs✓

Hacktivists are driven by ideology, politics, or social causes rather than money. Defacement and public manifestos draw attention to their message. Recognizing motivation helps defenders anticipate targets and tactics.

Which characteristic most distinguishes an insider threat from an external attacker?

• a.Insiders can only cause harm accidentally and never act with malicious intent
• b.Insiders always possess more advanced malware and custom zero-day exploits than outsiders
• c.Insiders are exclusively motivated by financial gain and never by revenge
• d.Authorized access to systems and knowledge of internal processes✓

Insiders already hold legitimate access and understand where valuable data lives, letting them bypass perimeter defenses. This access and knowledge is their defining advantage, whether the act is malicious or negligent. Monitoring, least privilege, and DLP help detect misuse.

During analysis of a sophisticated, multi-year campaign using several zero-days and custom implants, investigators note extensive funding and patience. Which actor attribute does this indicate?

• a.Internal origin, meaning the activity almost certainly came from a current employee
• b.High resources and funding consistent with a nation-state actor✓
• c.Accidental exposure caused by a simple misconfiguration rather than an attacker
• d.Low sophistication typical of an opportunistic smash-and-grab intruder

Sustained campaigns using multiple zero-days and bespoke tooling signal significant resources and funding, a hallmark of nation-state or advanced persistent threat groups. Sophistication and capability are key attributes for attribution. This shapes the required defensive posture.

Attackers steal sensitive customer records and threaten to publish them unless the company pays. Beyond the theft, what is the attackers' primary motivation?

• a.Service disruption intended purely to knock the company offline during peak hours
• b.Blackmail✓
• c.War or destabilization directed by a state sponsor against critical infrastructure
• d.Ethical disclosure meant to responsibly warn the company about a weakness

Threatening to release stolen data unless paid is extortion, a blackmail motivation. This is central to double-extortion ransomware, where data is both encrypted and threatened with exposure. Understanding motivation guides negotiation and response decisions.

An employee receives a text message claiming a package could not be delivered and prompting them to tap a link to reschedule. Which attack vector is being used?

• a.A message-based vector delivered by SMS text✓
• b.An unsecured wireless network broadcasting a deceptive access point name
• c.A malicious removable USB device left in a common area to tempt an employee
• d.A vulnerable client application exposed to the internet without patches

Smishing uses SMS text messages as the delivery vector for a social engineering lure. The link typically leads to a credential-harvesting page or malware. Messaging vectors exploit trust in familiar communication channels.

A hospital still runs a critical application on an operating system that the vendor no longer patches. Why is this a significant attack vector?

• a.Unsupported systems no longer receive security updates, leaving known vulnerabilities permanently open✓
• b.Unsupported systems automatically encrypt all traffic, which slows performance unacceptably
• c.Unsupported systems require multifactor authentication that frustrates clinical staff during care
• d.Unsupported systems always run faster because they lack modern security overhead and logging

End-of-life systems stop receiving vendor patches, so newly discovered vulnerabilities are never fixed and remain exploitable. Attackers specifically target these known gaps. Isolation, compensating controls, or replacement reduce the risk.

Attackers compromise a managed service provider and use its trusted remote-management tools to reach many downstream customers. This is an example of which vector?

• a.A supply chain attack✓
• b.A brute-force attack against each customer's externally exposed login portal
• c.An open service port discovered during an untargeted internet-wide scan
• d.A direct phishing campaign aimed individually at each victim organization's staff

Compromising a trusted provider to reach its customers is a supply chain attack. The MSP's legitimate access and tools let the attacker bypass each customer's defenses. Vendor risk assessment and least-privilege integration limit this exposure.

A caller invents a detailed story about being a new auditor who urgently needs employee records to complete a compliance deadline. Which technique underlies this approach?

• a.Shoulder surfing performed by physically watching a target enter their credentials
• b.Tailgating through a secured entrance behind an authorized badge holder
• c.Pretexting✓
• d.Dumpster diving to recover discarded documents containing sensitive information

Pretexting builds a fabricated but believable scenario to justify a request for information or access. The invented auditor role gives the attacker a reason the target will accept. Verifying identity through independent channels defeats it.

During an election, coordinated fake social media accounts deliberately spread false claims to manipulate public opinion. Which concept does this represent?

• a.Watering hole targeting of a website that a narrow group of victims frequents
• b.Business email compromise directed at a finance department for fraudulent transfers
• c.Impersonation of a specific individual to gain access to that person's accounts
• d.A disinformation campaign✓

Disinformation is the deliberate spread of false information to deceive or manipulate, distinct from misinformation shared without intent to harm. Coordinated inauthentic accounts amplify the false narrative. Awareness and source verification counter influence campaigns.

A fraudulent email uses a well-known bank's exact logo, colors, and formatting to convince recipients it is genuine. Which technique is central here?

• a.Pharming that redirects users to a fraudulent site by poisoning name resolution
• b.Brand impersonation✓
• c.Credential stuffing that reuses previously breached username and password pairs
• d.Typosquatting that registers a domain resembling a common misspelling of a real site

Brand impersonation copies a trusted organization's visual identity to lend credibility to a scam. Victims lower their guard because the message looks official. Verifying the sender and avoiding embedded links reduces the risk.

Over several friendly conversations, an attacker casually gathers small details about a company's VPN vendor and patch schedule without ever asking directly. This technique is called:

• a.A directory traversal attack against a misconfigured public web server
• b.A logic bomb planted to trigger malicious code on a specific future date
• c.Eliciting information✓
• d.A denial-of-service attack aimed at exhausting the company's network bandwidth

Eliciting information extracts useful details through seemingly innocent conversation rather than a direct request. Aggregated small facts can reveal exploitable weaknesses. Training staff to recognize probing questions limits leakage.

After opening a malicious attachment, a user's machine begins allowing an attacker to view the screen, move the mouse, and browse files remotely. Which malware is most likely present?

• a.A password-protected archive used only to smuggle data past email filters
• b.A remote access Trojan✓
• c.A logic bomb waiting for a specific condition before executing its payload
• d.Adware that displays unwanted advertisements but does not grant remote control

A remote access Trojan (RAT) gives an attacker interactive remote control of the infected host. It typically arrives disguised as a legitimate file and then opens a covert channel. Behavior-based detection and egress monitoring help catch its command traffic.

A departing developer inserts code that will delete production databases if their user account is ever removed from the payroll system. What kind of malware is this?

• a.A self-replicating worm that spreads across the network without any trigger condition
• b.A logic bomb✓
• c.A rootkit designed to hide processes and maintain stealthy administrative access
• d.Ransomware that encrypts files and demands payment for a decryption key

A logic bomb lies dormant until a specific condition or trigger is met, then executes its malicious payload. Here the trigger is the account's removal. Code reviews and separation of duties reduce the chance such code is planted.

A newly purchased laptop ships with numerous preinstalled trial programs that consume resources and expand the attack surface. What are these unwanted extras called?

• a.Bloatware✓
• b.A rootkit embedded in firmware to survive operating system reinstallation
• c.Ransomware that must be paid before the operating system will boot normally
• d.Spyware that secretly transmits the user's keystrokes to a remote server

Bloatware is unnecessary preinstalled software that wastes resources and can introduce vulnerabilities. It is not always overtly malicious but enlarges the attack surface. Removing it when hardening a new device is good practice.

An investigation finds malicious activity running entirely in memory through PowerShell, with no executable written to disk. Which malware characteristic does this describe?

• a.A boot sector infector that modifies the master boot record on the hard drive
• b.Fileless malware✓
• c.A removable-media worm that copies itself onto every USB drive it detects
• d.A traditional virus that infects executable files and requires them to run to spread

Fileless malware operates in memory and abuses legitimate tools like PowerShell, leaving little on disk for signature scanners to find. This living-off-the-land approach evades many defenses. Behavioral monitoring and script logging improve detection.

While logged into their bank, a user visits a malicious page that silently submits a funds-transfer request using the user's active session. Which attack is this?

• a.Cross-site request forgery✓
• b.SQL injection that manipulates backend database queries through unsanitized input
• c.A brute-force attack systematically guessing the user's online banking password
• d.DNS poisoning that redirects the banking domain to an attacker-controlled server

Cross-site request forgery (CSRF) tricks a victim's browser into sending an unwanted authenticated request to a site where they are logged in. The site trusts the session cookie automatically. Anti-CSRF tokens and same-site cookies prevent it.

An attacker with a low-level user account exploits a flaw to gain administrator rights on the same system. What is this technique called?

• a.Data exfiltration achieved by tunneling stolen files out through DNS queries
• b.A distributed denial-of-service attack overwhelming the host with junk traffic
• c.Lateral movement across separate hosts using stolen credentials and remote services
• d.Privilege escalation✓

Privilege escalation raises an attacker's permissions beyond what their account should have, often from user to administrator. It typically exploits a vulnerability or misconfiguration. Patching and least privilege limit escalation paths.

By entering '../../etc/passwd' in a URL parameter, an attacker retrieves files outside the web root. Which vulnerability is being exploited?

• a.Cross-site scripting that injects client-side script into pages viewed by others
• b.A race condition exploiting the gap between checking and using a resource
• c.Directory traversal✓
• d.Session replay reusing a captured authentication token to impersonate a user

Directory traversal uses sequences like ../ to escape the intended directory and access unauthorized files on the server. Poor input validation of file paths enables it. Canonicalizing and validating paths prevents the attack.

A program copies user input into a fixed-size memory buffer without checking length, letting an attacker overwrite adjacent memory and run code. This is a:

• a.Phishing message designed to harvest the user's login credentials
• b.SQL injection inserting crafted statements into a database query string
• c.Buffer overflow✓
• d.Cross-site request forgery abusing a trusted authenticated browser session

A buffer overflow writes more data than a buffer can hold, corrupting adjacent memory and potentially allowing arbitrary code execution. Unsafe memory handling in languages like C enables it. Bounds checking, ASLR, and DEP mitigate it.

At a coffee shop, an attacker sets up a rogue access point named identically to the shop's Wi-Fi to intercept connecting users' traffic. This is an:

• a.Amplified DNS reflection attack that floods a victim with unsolicited responses
• b.VLAN hopping attack that reaches traffic on a segment the attacker should not access
• c.ARP poisoning attack that corrupts the mapping of IP addresses to MAC addresses
• d.Evil twin✓

An evil twin is a rogue wireless access point impersonating a legitimate one to lure victims into connecting. Once connected, their traffic can be intercepted or manipulated. Verifying networks and using a VPN protect users on untrusted Wi-Fi.

Users typing the correct bank URL are silently sent to a fraudulent server because forged records were inserted into a resolver's cache. Which attack is this?

• a.A deauthentication attack forcing wireless clients to disconnect from the access point
• b.A MAC flooding attack overwhelming a switch's address table to force it to broadcast
• c.DNS cache poisoning✓
• d.A replay attack reusing previously captured valid authentication messages

DNS cache poisoning inserts forged records into a resolver so legitimate names resolve to attacker-controlled addresses. Victims are redirected without any visible URL change. DNSSEC and cache protections defend against it.

An attacker sends small spoofed requests to open DNS resolvers, which send much larger responses to the victim's address, overwhelming it. This is an:

• a.SQL injection attack against the victim's public database interface
• b.Privilege escalation attack elevating a standard account to administrator
• c.Amplified, reflected distributed denial-of-service attack✓
• d.Cross-site scripting attack executing script in other users' browsers

A reflected, amplified DDoS spoofs the victim's address so intermediary servers send large responses to the victim, multiplying the traffic. DNS and NTP are common amplifiers. Source-address validation and scrubbing services reduce the impact.

An on-path attacker forces two systems to negotiate an obsolete, weak version of TLS so the traffic can be broken. Which cryptographic attack is this?

• a.A brute-force attack trying every possible key until the correct one is found
• b.A rainbow table attack reversing unsalted password hashes with precomputed chains
• c.A downgrade attack✓
• d.A birthday attack exploiting the mathematics of hash collision probability

A downgrade attack coerces parties into using a weaker protocol or cipher that the attacker can defeat. Blocking legacy versions and enforcing strong minimums prevents it. This is why disabling old SSL and TLS versions matters.

Two different inputs are found that produce the same hash value, undermining a hash function's integrity guarantee. This is known as a:

• a.Collision✓
• b.Downgrade attack forcing negotiation of an older, weaker cryptographic protocol
• c.Salting technique adding random data to each password before hashing it
• d.Key stretching operation that intentionally slows down password hashing

A collision occurs when two different inputs hash to the same value, breaking the uniqueness a hash relies on. Birthday attacks exploit probability to find collisions faster than brute force. Moving to stronger algorithms like SHA-256 mitigates the risk.

A researcher demonstrates breaking out of a guest virtual machine to execute code directly on the underlying hypervisor. What is this class of vulnerability called?

• a.VM escape✓
• b.Data remnants, where deleted virtual disks leave recoverable sensitive information
• c.Resource exhaustion, where one tenant consumes shared capacity needed by others
• d.VM sprawl, where unmanaged virtual machines accumulate faster than they are tracked

VM escape breaks the isolation between a guest and the hypervisor, letting an attacker affect the host or other guests. It is a severe risk in multitenant environments. Hypervisor patching and strong isolation controls reduce it.

A company's confidential files are exposed because a cloud storage bucket was set to allow public access. Which root cause best describes this?

• a.A zero-day vulnerability that no vendor patch could have prevented at the time
• b.A cryptographic weakness in the algorithm protecting the stored data at rest
• c.A security misconfiguration✓
• d.A supply chain compromise introduced through a tainted third-party dependency

Misconfiguration is a leading cause of cloud data exposure, such as leaving storage publicly readable. The technology worked as configured; the settings were wrong. Secure baselines, automated checks, and least privilege prevent it.

Logs show a user account signing in from New York and, eight minutes later, from Singapore. Which indicator of compromise does this represent?

• a.A blocked-content alert generated when a user tries to reach a prohibited website
• b.Resource consumption caused by a runaway process using excessive CPU cycles
• c.Impossible travel✓
• d.Out-of-cycle logging showing unexpected timestamps on a scheduled batch process

Impossible travel flags logins from geographically distant locations within a timeframe too short to physically travel. It strongly suggests stolen credentials used from two places. Conditional access and risk-based authentication respond to it.

A security analyst notices a single user account with many simultaneous active sessions from different countries. This is best classified as which indicator?

• a.Normal single sign-on behavior expected when a user opens multiple applications
• b.Scheduled maintenance activity that briefly duplicates sessions during failover
• c.Legitimate load balancing distributing the user's requests across data centers
• d.Concurrent session usage suggesting account compromise✓

Multiple concurrent sessions from disparate locations for one account indicate possible credential theft or sharing. It is a recognized indicator of malicious activity. Session monitoring and forced re-authentication help contain it.

During an assessment, a networked camera is found reachable from the internet using the manufacturer's default username and password. Which two weaknesses combine here?

• a.A cryptographic downgrade combined with a hash collision in the login process
• b.A cross-site scripting flaw combined with a cross-site request forgery weakness
• c.A logic bomb paired with a self-propagating worm on the device firmware
• d.An exposed open service and unchanged default credentials✓

Internet-exposed services running default credentials are trivially compromised because the passwords are publicly documented. Attackers scan for exactly this combination. Changing defaults and restricting exposure closes the gap.

An attacker registers 'micros0ft-support.com' to catch users who mistype or misread the legitimate domain. This technique is:

• a.Watering hole targeting of a site the intended victims are known to visit
• b.Pharming that poisons DNS so correct addresses resolve to malicious servers
• c.Typosquatting✓
• d.Vishing that uses fraudulent phone calls to extract sensitive information

Typosquatting registers look-alike or misspelled domains to capture users who err when typing or reading a URL. The fraudulent site may harvest credentials or deliver malware. Defensive domain registration and user vigilance help.

Hundreds of infected corporate hosts periodically beacon to the same external server that issues them instructions. What does this server represent?

• a.A content delivery network edge node caching static assets closer to the users
• b.A reverse proxy load balancing inbound requests across backend web servers
• c.A command-and-control server✓
• d.A certificate authority validating the identity of the connecting endpoints

A command-and-control (C2) server directs a botnet of compromised hosts, sending commands and receiving stolen data. Regular beaconing to one destination is a classic indicator. Blocking C2 domains and inspecting egress traffic disrupts it.

A financially motivated, well-organized group operates ransomware as a business, complete with affiliates and support portals. Which threat actor type is this?

• a.Organized crime✓
• b.An unskilled attacker relying entirely on tools written by more capable people
• c.An accidental insider who exposes data through a careless but non-malicious mistake
• d.A hacktivist collective pursuing a political or social cause rather than profit

Organized crime groups are professional, financially motivated actors that run cybercrime like a business. Ransomware-as-a-service with affiliates reflects this structure. Their profit motive drives high-volume, opportunistic targeting.

A marketing team signs up for an unapproved cloud app and uploads customer data without involving security. Which internal risk does this illustrate?

• a.Shadow IT✓
• b.An evil twin access point deployed in the marketing department's office space
• c.A nation-state espionage operation targeting the organization's intellectual property
• d.A supply chain attack introduced through a compromised software update channel

Shadow IT is technology adopted by staff without organizational approval or oversight. It bypasses security review, creating unmanaged data exposure and compliance gaps. Discovery tools and clear policies bring it under control.

An employee gets a call from someone claiming to be the help desk, who asks them to read back a one-time code just sent to their phone. Which attack is underway?

• a.A watering hole attack staged on a website the employee routinely visits
• b.Vishing aimed at capturing a multifactor authentication code✓
• c.Smishing delivered through a fraudulent text message rather than a phone call
• d.A brute-force attempt against the employee's password on the login portal

Vishing uses a phone call and a convincing pretext to trick the victim into revealing information such as a one-time passcode. Capturing that code lets the attacker defeat multifactor authentication. Never sharing codes and verifying callers defeats it.

A visitor holds the door and an unauthorized person walks in after them, with the visitor's knowing cooperation. Which term best fits this scenario?

• a.Dumpster diving to recover access badges discarded in the building's trash
• b.Piggybacking✓
• c.Shoulder surfing performed by observing credentials entered on a nearby keypad
• d.Tailgating, in which the unauthorized entry happens without the insider's awareness

Piggybacking is unauthorized entry with the consent or cooperation of an authorized person, distinguishing it from tailgating, which occurs without that person's knowledge. Both defeat physical access controls. Access vestibules and awareness reduce them.

Within minutes, an infection spreads from one server to hundreds across the network with no user clicking anything, exploiting a single unpatched service. Which malware behavior is this?

• a.A worm exploiting a vulnerability to self-propagate✓
• b.A Trojan that must be manually executed by each user before it can run
• c.Ransomware whose only action is to encrypt files on the initially infected host
• d.Adware that displays pop-ups but does not move between networked systems

A worm self-replicates and spreads automatically by exploiting vulnerabilities, needing no user interaction. Rapid network-wide propagation from one flaw is its signature. Prompt patching and segmentation slow it.

A directory-enabled login form fails to sanitize input, letting an attacker alter the LDAP query to bypass authentication. This is a form of:

• a.A replay attack resubmitting a previously captured valid authentication request
• b.Injection✓
• c.A downgrade attack forcing a weaker cryptographic protocol during the session
• d.A denial-of-service attack aimed at making the directory service unavailable

Injection attacks insert crafted input that a system interprets as commands, whether SQL, LDAP, or XML. Unvalidated input to the directory query enables authentication bypass. Input validation and parameterized queries are the defense.

A banking function checks an account balance and then, a moment later, completes a withdrawal; an attacker exploits the delay to withdraw twice. Which flaw is this?

• a.A buffer overflow overwriting adjacent memory beyond a fixed-size array
• b.A cross-site scripting flaw running attacker script in another user's browser
• c.A time-of-check to time-of-use race condition✓
• d.A misconfiguration that left an administrative interface exposed to the internet

A time-of-check to time-of-use (TOCTOU) race condition exploits the gap between validating a condition and acting on it. The attacker changes state within that window to cause double spending. Atomic operations and locking prevent it.

On a local network, an attacker sends forged replies associating their MAC address with the gateway's IP so traffic flows through their machine. This is:

• a.A deauthentication attack disconnecting wireless clients from their access point
• b.ARP poisoning✓
• c.DNS poisoning that corrupts name-to-address resolution in a caching resolver
• d.An amplified reflection attack using open resolvers to flood a chosen victim

ARP poisoning forges address resolution replies to redirect local traffic through the attacker, enabling on-path interception. It works because ARP has no authentication. Dynamic ARP inspection and static entries mitigate it.

A user's browsing habits, form entries, and typed passwords are being secretly collected and sent to a third party. Which malware category fits best?

• a.Spyware✓
• b.A worm whose defining behavior is self-replication across networked systems
• c.A logic bomb that stays inert until a defined trigger condition is met
• d.Ransomware that encrypts data and demands payment to restore access

Spyware covertly gathers information about a user's activity and transmits it without consent. Keystroke capture and browsing surveillance are common behaviors. Reputable endpoint protection and cautious software installation reduce exposure.

A rival firm secretly funds intruders to steal a company's unreleased product blueprints. What is the primary motivation behind this activity?

• a.Service disruption intended to keep the target's website offline during a launch
• b.Financial extortion demanding payment to prevent release of the stolen files
• c.Ideological protest against the company's business practices and public conduct
• d.Espionage✓

Espionage seeks to steal confidential information such as trade secrets or intellectual property, often for competitive or strategic advantage. Competitor-sponsored theft is a classic case. Data protection and insider monitoring defend against it.

Malware is hidden inside what appears to be an ordinary image file, executing when a vulnerable viewer opens it. Which attack vector does this use?

• a.An unsecure wireless network broadcasting a deceptive access point name nearby
• b.A phone-based social engineering call impersonating internal technical support
• c.An exposed remote-desktop port left open to the public internet without a firewall
• d.A file-based vector using a malicious image✓

File-based vectors deliver malware inside documents, images, or other files that exploit a flaw in the handling application. The lure looks harmless, encouraging the victim to open it. Patching viewers and scanning attachments reduce risk.

Servers suddenly run at maximum CPU and electricity costs spike, later traced to unauthorized cryptocurrency mining software. Which indicator first signaled this?

• a.A missing-logs alert indicating that audit records had been deleted from the host
• b.Abnormal resource consumption✓
• c.A blocked-content notification from the secure web gateway's URL filter
• d.An account lockout triggered by repeated failed authentication attempts

Unusual resource consumption, such as sustained maximum CPU or unexpected power draw, can indicate cryptojacking or other unauthorized processes. Baselining normal utilization makes anomalies visible. Investigation confirms whether it is malicious.

Employees remove the manufacturer's built-in restrictions on their mobile devices to install unauthorized apps. Why does this increase organizational risk?

• a.It permanently encrypts the device so corporate data can never be recovered later
• b.It removes built-in security protections, expanding the device's attack surface✓
• c.It forces the device to use only vendor-signed applications from the official store
• d.It automatically enrolls the device into mobile device management for tighter control

Jailbreaking or rooting removes the vendor's security controls, allowing unsigned apps and undermining the device's protections. This enlarges the attack surface and can bypass MDM policy. Blocking rooted devices from corporate resources mitigates it.

Attackers compromise a niche industry forum that engineers at a target company visit daily, planting malware to infect those specific visitors. This is a:

• a.Credential-stuffing attack replaying leaked passwords against the company's portal
• b.Watering hole attack✓
• c.Smishing campaign sending malicious links through text messages to the engineers
• d.Business email compromise impersonating an executive to authorize a fraudulent payment

A watering hole attack compromises a site frequented by the intended victims so that visiting it delivers malware. It targets a community indirectly through a trusted resource. Endpoint protection and patching reduce exposure.

Antivirus reports a clean system, yet certain processes and files are invisible to the operating system's own tools while an attacker retains privileged access. Which malware is most consistent with this?

• a.Adware that only displays advertising and makes no attempt to hide its presence
• b.A macro virus embedded in a document that runs when the file is opened by a user
• c.A phishing email crafted to trick the user into revealing their account credentials
• d.A rootkit✓

A rootkit hides its presence at a low level, concealing processes and files while maintaining privileged control. Its stealth is why standard tools show a clean system. Secure boot, integrity checks, and offline scanning help detect it.

An attacker floods the 2.4 GHz band with noise so that nearby Wi-Fi clients cannot maintain a connection. Which attack is this?

• a.ARP poisoning that redirects local traffic through the attacker's own machine
• b.An evil twin that impersonates a legitimate access point to capture user traffic
• c.Wireless jamming✓
• d.A downgrade attack forcing clients onto an older, weaker encryption protocol

Jamming intentionally interferes with wireless signals to deny service by overwhelming the frequency with noise. It targets availability rather than data. Spectrum monitoring and directional antennas help locate and mitigate it.

Which statement about threat actor attributes is accurate for exam purposes?

• a.External actors are always more sophisticated and better funded than any insider could be
• b.Only nation-state actors ever have any financial motivation for their operations at all
• c.Actors vary in resources, sophistication, and whether they operate internally or externally✓
• d.Level of sophistication is irrelevant when categorizing and defending against threat actors

Threat actors differ along attributes such as internal versus external origin, resources and funding, and level of sophistication and capability. These attributes shape likely targets and tactics. Profiling them guides proportionate defenses.

A vendor's email account is compromised and used to send a genuine-looking invoice with changed bank details to the customer's accounts payable team. This is best described as:

• a.A rainbow table attack used to reverse the vendor's stored password hashes
• b.A watering hole attack staged on a website the finance team frequently visits
• c.Business email compromise✓
• d.A denial-of-service attack against the accounts payable email infrastructure

Business email compromise abuses a trusted or spoofed email account to trick staff into transferring funds or changing payment details. Using a real compromised vendor account makes it especially convincing. Out-of-band verification of banking changes stops it.

Attackers exploit a flaw in widely used software before the vendor is even aware of it, so no patch exists. What is this called?

• a.A zero-day vulnerability✓
• b.An end-of-life condition where the vendor has stopped issuing any further updates
• c.A misconfiguration introduced by an administrator applying incorrect security settings
• d.A supply chain compromise inserted into a trusted third-party build pipeline

A zero-day is a previously unknown vulnerability with no available patch, giving defenders zero days to prepare. Attackers value it because existing defenses may not detect the exploit. Segmentation and behavioral detection provide compensating protection.

An attacker captures a valid session token from unencrypted traffic and reuses it to access the victim's authenticated account. This is a:

• a.Buffer overflow attack overwriting memory beyond an allocated fixed-size buffer
• b.Distributed denial-of-service attack exhausting the web server's connection capacity
• c.SQL injection attack manipulating database queries through unsanitized form input
• d.Session replay attack✓

A replay attack captures a valid credential or token and resubmits it to gain unauthorized access. Unencrypted sessions and predictable tokens make it possible. Encryption, nonces, and short-lived tokens defeat replay.

An attacker overwhelms a switch's address table with thousands of fake MAC addresses, causing it to broadcast traffic to all ports. Which attack is this?

• a.An evil twin luring wireless users onto a rogue impersonating access point
• b.MAC flooding✓
• c.DNS poisoning corrupting the resolver cache to redirect users to false addresses
• d.A reflected amplification attack using open servers to overwhelm a chosen victim

MAC flooding fills a switch's content addressable memory with bogus addresses, forcing it to fail open and broadcast frames, which the attacker can then sniff. It exploits limited table size. Port security limiting learned MACs prevents it.

A penetration test flags that an application still protects passwords using unsalted MD5. Why is this a vulnerability?

• a.MD5 encrypts data so strongly that recovering forgotten passwords becomes impossible
• b.MD5 requires specialized hardware security modules that most servers do not include
• c.MD5 is cryptographically broken and, unsalted, is highly vulnerable to fast cracking✓
• d.MD5 is far too slow, which noticeably degrades the application's login performance

MD5 is a deprecated hash with known collision weaknesses, and without salting it is quickly cracked using precomputed tables. Password storage should use slow, salted algorithms like bcrypt or Argon2. Using broken cryptography is a recognized vulnerability.

A recently fired administrator uses retained credentials to sabotage systems out of anger. What is the primary motivation?

• a.Revenge✓
• b.Espionage conducted quietly to collect intelligence over a long period of time
• c.Political or ideological beliefs expressed through disruptive public activism
• d.Financial gain from selling the sabotaged company's data to a competing firm

Revenge motivates a disgruntled individual to cause harm, often after a perceived wrong such as termination. Prompt deprovisioning of access on offboarding is the key control. Motivation helps predict insider risk.

An analyst finds that a server's security logs stop for a two-hour window that coincides with suspicious file changes. Which indicator does the gap represent?

• a.Excessive resource consumption from an unauthorized cryptocurrency mining process
• b.Missing logs suggesting an attacker cleared traces of their activity✓
• c.A blocked-content event where the web filter denied access to a prohibited site
• d.Impossible travel between two logins occurring in an implausibly short timeframe

Missing or gapped logs are a red flag that an attacker may have deleted records to hide activity. The gap aligning with suspicious changes strengthens that inference. Centralized, tamper-resistant logging preserves evidence.

A device is compromised through an unauthenticated Bluetooth pairing exploit while in a crowded public space. Which category of attack vector is this?

• a.A message-based vector delivered through a malicious email attachment payload
• b.A default-credential vector exploiting an unchanged factory administrator password
• c.A supply chain vector introduced via a compromised hardware component at manufacture
• d.An unsecure network vector✓

Unsecure network vectors include wired, wireless, and Bluetooth connections that lack proper protection. Open or weakly secured Bluetooth can allow unauthorized pairing and exploitation. Disabling unused radios and requiring authentication reduce exposure.

An attacker convincingly poses as a specific senior manager and pressures IT to reset that manager's password. Which technique is central to this attack?

• a.Tailgating through a secured door directly behind the actual senior manager
• b.Impersonation✓
• c.Dumpster diving to recover printed records containing the manager's information
• d.Shoulder surfing to observe the manager entering credentials at their workstation

Impersonation involves pretending to be a specific, often authoritative person to manipulate a target into acting. The claimed identity and urgency pressure the help desk to comply. Strong identity verification procedures defeat it.

Opening a spreadsheet enables its embedded macros, which then infect the user's template so every new file carries the malicious code. Which malware type is this?

• a.A network worm that propagates automatically without any user interaction at all
• b.A hardware rootkit embedded in firmware below the operating system layer itself
• c.A macro virus✓
• d.A denial-of-service tool designed to exhaust a target server's available bandwidth

A macro virus embeds in documents and executes through the application's macro feature, often spreading via shared templates and files. It requires the user to enable or run the macro. Disabling macros by default and user caution mitigate it.

A trusted software vendor's update mechanism is subverted so that a signed update secretly installs a backdoor on all customers. Which risk does this exemplify?

• a.A brute-force attack that guessed the update server's administrative password
• b.A cross-site scripting flaw in the vendor's public customer support web portal
• c.A misconfiguration where an administrator mistakenly exposed an internal service
• d.A supply chain attack through a compromised software update✓

Subverting a vendor's build or update process to distribute malicious code is a supply chain attack that abuses established trust. A single tainted update can reach many organizations at once. Code signing integrity and vendor assurance help defend against it.

Attackers gain access to a company's domain registrar account and change its DNS records to point the website and email to their own servers. This is:

• a.A collision attack producing two inputs with the same cryptographic hash value
• b.A deauthentication attack forcing the company's wireless clients to disconnect
• c.Domain hijacking✓
• d.A MAC flooding attack overwhelming the switch to force traffic to broadcast out

Domain hijacking takes control of a domain's registration or DNS configuration, letting attackers redirect web and email traffic. It often follows a registrar account compromise. Registrar locks and strong account security prevent it.

A batch of network devices is found to contain an unauthorized chip added during manufacturing that could exfiltrate data. Which vulnerability category is this?

• a.An end-of-life condition in which the vendor no longer supports the hardware
• b.A hardware supply chain compromise✓
• c.A zero-day flaw in the device's operating system discovered after deployment
• d.A software misconfiguration applied by the receiving organization after delivery

Hardware supply chain compromises insert malicious components during manufacturing or distribution before the product reaches the buyer. Such implants are hard to detect and abuse deep trust. Trusted suppliers and hardware inspection reduce the risk.

Which set of characteristics is the strongest indicator that an email is a phishing attempt?

• a.A calendar invite from a coworker whose address matches the corporate directory
• b.A digitally signed message from a known colleague sent during normal business hours
• c.An internal newsletter with no links, delivered on its regular weekly schedule again
• d.Urgent tone, a mismatched sender domain, and a link to an unfamiliar login page✓

Classic phishing indicators include manufactured urgency, sender addresses that do not match the claimed organization, and links to unexpected credential pages. Recognizing these cues lets users avoid the lure. Reporting suspicious mail improves defenses.

After remediation, responders discover the attacker left a hidden service that allows them to return later without authenticating normally. What is this called?

• a.A logic bomb set to trigger its payload only on a specific future calendar date
• b.A backdoor✓
• c.A rogue access point impersonating the corporate wireless network to capture traffic
• d.A rainbow table used to reverse the organization's stored password hashes offline

A backdoor provides covert, persistent access that bypasses normal authentication, letting an attacker return at will. It is often installed to survive initial remediation. Thorough eradication and integrity monitoring are needed to remove it.

An intrusion shows an attacker maintaining stealthy access for over a year, moving slowly and avoiding detection while collecting sensitive data. This dwell pattern is most characteristic of:

• a.A hacktivist seeking rapid public impact through a highly visible website defacement
• b.An unskilled attacker who typically causes immediate, noisy, and short-lived damage
• c.An advanced persistent threat✓
• d.An opportunistic criminal aiming for a quick financial payout before being detected

Advanced persistent threats, often nation-state actors, prioritize long-term stealthy access and patient data collection. Extended dwell time with low-and-slow tactics is a defining trait. Detecting them requires behavioral analytics and threat hunting.

An attacker posts flyers with QR codes that lead to a credential-harvesting site disguised as a parking payment portal. Which emerging technique is this?

• a.Vishing conducted over the phone using a spoofed caller identity and a pretext
• b.Quishing, which is phishing delivered through a malicious QR code✓
• c.Tailgating into a restricted area behind an employee holding a valid access badge
• d.A logic bomb embedded in the parking system to execute on a future trigger date

Quishing uses QR codes to direct victims to malicious sites, exploiting trust and the fact that the destination is hidden until scanned. It sidesteps some link filters. Previewing the URL and using caution with public QR codes helps.

An organization worries that staff installing apps from outside the official store could introduce malware. Which practice raises this specific risk?

• a.Sideloading applications from unofficial or unverified sources✓
• b.Enrolling all devices in mobile device management for centralized policy control
• c.Enforcing screen locks with a strong passcode and a short inactivity timeout
• d.Requiring full-disk encryption on every mobile device that stores any company data

Sideloading installs apps from sources outside the vetted official store, bypassing the platform's app review. This raises the chance of installing malicious or trojanized software. Restricting installation sources through MDM reduces the risk.

To slow attackers who steal a password database, developers deliberately use a hashing scheme that is computationally expensive per guess. What is this defensive technique called?

• a.Key stretching✓
• b.Certificate pinning, which ties a service to a specific expected public key
• c.Tokenization, which replaces sensitive values with non-sensitive substitute tokens
• d.Steganography, which conceals data within another seemingly innocuous carrier file

Key stretching applies a deliberately slow, resource-intensive function so each password guess costs more, blunting brute-force and dictionary attacks. Algorithms like bcrypt, scrypt, and PBKDF2 implement it. Combined with salting, it strengthens stored credentials.

A company discovers that internal server names and employee emails are freely searchable online, aiding attacker reconnaissance. This exposure is an example of:

• a.A race condition exploiting the timing gap between a check and a subsequent use
• b.A zero-day vulnerability with no vendor patch available to remediate it just yet
• c.Information available through open-source intelligence✓
• d.A downgrade attack forcing negotiation of a weaker cryptographic protocol version

Open-source intelligence (OSINT) is information gathered from publicly available sources, which attackers use during reconnaissance. Exposed names and emails ease targeting and phishing. Limiting public exposure and monitoring for leaks reduce the aid to attackers.

A phishing email succeeds largely because it claims an account will be closed within one hour unless the recipient acts immediately. Which social engineering principle is being exploited?

• a.Authority, established by impersonating a senior executive within the company itself
• b.Urgency✓
• c.Familiarity, built by referencing a long personal relationship with the recipient
• d.Social proof, created by citing that many coworkers have already complied with it

Urgency pressures victims to act quickly before thinking critically, a core social engineering principle. Artificial deadlines short-circuit careful verification. Training users to slow down and verify defeats manufactured urgency.