Threats, Vulnerabilities and Mitigations — CompTIA Security+ practice questions

A DDoS (Distributed Denial-of-Service) attack attempts to:

1. Silently copies records out of a target database over weeks
2. Encrypts victim files and demands payment for a decryption key
3. Exhausts a service's bandwidth or compute from many sources
4. Pushes unsigned software updates through an auto-update channel

Answer: C — Exhausts a service's bandwidth or compute from many sources

C) A DDoS floods a target from many distributed sources until legitimate users cannot be served. A) That is data exfiltration. B) That is ransomware. D) That describes update-channel abuse.

What type of attack intercepts communication?

1. Man-in-the-middle (on-path) interception
2. Distributed denial of service traffic flooding
3. Phishing email used to harvest user credentials
4. Brute-force guessing of many account passwords

Answer: A — Man-in-the-middle (on-path) interception

A man-in-the-middle (on-path) attacker sits between two parties, typically via ARP poisoning, a rogue access point, or DNS spoofing, and can read or alter traffic. DDoS (B) denies availability rather than intercepting. Phishing (C) tricks the user directly. Brute force (D) attacks credentials, not the channel.

The PRIMARY defense against ransomware is:

1. Signature-based antivirus deployed on every managed workstation
2. Tested offline backups, plus training, patching, and EDR coverage
3. Encrypting sensitive files so that the attacker cannot read them
4. Paying the ransom promptly in order to obtain the decryption key

Answer: B — Tested offline backups, plus training, patching, and EDR coverage

B) Layered prevention with recoverable backups as the anchor is what actually survives an infection. A) Signature detection misses new variants. C) Your own encryption does not stop the attacker re-encrypting the file. D) Payment funds the attacker and often yields incomplete recovery.

A user logged into a banking site clicks a link in a separate forum post; the link silently issues a transfer request to the bank using their authenticated session. What attack is this?

1. Stored cross-site scripting saved in the site's own content
2. SQL injection through an unsanitized input parameter field
3. Cross-Site Request Forgery riding the authenticated session
4. Session fixation using a session ID the attacker planted

Answer: C — Cross-Site Request Forgery riding the authenticated session

C) CSRF forges a state-changing request from another origin and relies on the browser attaching the victim's existing session. A) XSS injects script into the trusted page itself. B) SQL injection targets the database through input. D) Session fixation forces a known session ID before login.

Which factor BEST distinguishes an APT from a typical cybercriminal attack?

1. They rely exclusively on zero-day exploits to gain access
2. They avoid phishing entirely in favor of network exploits
3. They target small businesses rather than high-value orgs
4. They are well-resourced, persistent, and stealth-focused

Answer: D — They are well-resourced, persistent, and stealth-focused

D) APTs are defined by sustained, well-funded, often state-aligned campaigns that value long-term stealthy access over quick profit. A) Zero-days are sometimes used but not required. B) Phishing is a common APT initial vector. C) APTs pursue high-value targets.

A 'watering hole' attack is:

1. Compromising a legitimate site the target group visits often
2. Flooding the target's bandwidth from a distributed botnet
3. Mass phishing email sent to a broad, untargeted audience
4. Sniffing unencrypted wireless traffic at a public hotspot

Answer: A — Compromising a legitimate site the target group visits often

A) A watering hole compromises a third-party site the intended victims frequent, infecting them indirectly. B) That is a DDoS. C) That is untargeted phishing. D) That is wireless eavesdropping, often paired with an evil twin AP.

Best defense against MITM is:

1. Disabling Wi-Fi radios on endpoints so devices connect only over wired Ethernet links
2. Anti-malware scanning of endpoint files to catch interception tools before they run
3. TLS with certificate validation, plus VPNs on untrusted or unfamiliar wireless networks
4. A network IDS that alerts on suspicious traffic patterns crossing the monitored segment

Answer: C — TLS with certificate validation, plus VPNs on untrusted or unfamiliar wireless networks

(C) TLS with certificate validation cryptographically blocks eavesdropping and tampering in transit, and a VPN protects traffic on networks you do not control. (A) is impractical and does not protect wired paths. (B) inspects files, not sessions in flight. (D) may alert after the fact but does not prevent interception.

Which best mitigates a buffer overflow at the SOURCE-CODE level?

1. Disabling SMBv1 across all file servers and workstations
2. Taking daily backups with verified offsite restore tests
3. Segmenting the network to contain any successful exploit
4. Validating input length and using strlcpy instead of strcpy

Answer: D — Validating input length and using strlcpy instead of strcpy

D) The source-level fix is bounding input length and replacing unsafe APIs like strcpy and gets with length-aware functions. A) Disabling SMBv1 addresses one protocol's flaws. B) Backups are recovery, not prevention. C) Segmentation limits blast radius without fixing the defect.

A finance employee receives a call from someone claiming to be IT, asking for their MFA code 'to fix an Outlook issue.' This is:

1. Vishing with an IT pretext to capture the second factor
2. A watering hole attack staged on a site the victim visits
3. A logic bomb set to fire on a chosen future calendar date
4. A side-channel attack reading timing or power leakage

Answer: A — Vishing with an IT pretext to capture the second factor

A) A voice call plus a fabricated IT scenario is vishing with pretexting, aimed at harvesting the MFA code. B) Watering holes compromise a website. C) Logic bombs are code triggered by a condition. D) Side channels exploit physical emissions such as timing or power.

Which attack exploits the trust a browser has for a website by forging requests from another tab?

1. Stored XSS injected into the trusted page's own content
2. Reflected XSS bounced back from a crafted URL parameter
3. CSRF forging requests that ride the site's session cookie
4. Clickjacking hiding a real control under a decoy iframe

Answer: C — CSRF forging requests that ride the site's session cookie

C) CSRF exploits the browser's automatic inclusion of cookies for the trusted origin when another tab issues the request. A/B) Both XSS variants inject script into the trusted page rather than forging cross-origin requests. D) Clickjacking overlays UI to steal a click.

What is an insider threat?

Security risk from current/former employees, contractors, or partners who misuse authorized access intentionally or accidentally.

What is on-path attack?

Modern term for MitM — attacker positions between two communicating parties to intercept, modify, or inject data.

What is social engineering?

Manipulating people into divulging confidential information. Techniques: phishing, pretexting, baiting, tailgating, quid pro quo.

What is pretexting?

Creating a fabricated scenario (pretext) to gain trust and extract information. Example: pretending to be IT support.