CompTIA Security+ — Practice Exam
2.0 Threats, Vulnerabilities, and Mitigations: practice questions
Our CompTIA Security+ bank has 66 questions on this topic. Here are 5 of them with answers; the full mock exam draws from every topic, like the real one.
Question 1
An attacker breaches a managed service provider and uses its remote tools to reach the MSP's customers. What vector is this?
- Watering hole
- Typosquatting
- Supply chain
- Smishing
Show the answer
C. Supply chain — Compromising a trusted provider (MSP, vendor or supplier) to reach its customers is a supply chain attack.
Question 2
A login form passes ' OR '1'='1 into a database query and the attacker logs in without a password. What attack is this?
- Cross-site scripting
- Directory traversal
- Request forgery
- SQL injection
Show the answer
D. SQL injection — SQL injection inserts SQL into a query built from unsanitized input. Parameterized queries prevent it.
Question 3
Which malware spreads on its own across a network without any user action?
- Worm
- Virus
- Trojan
- Keylogger
Show the answer
A. Worm — A worm self-replicates over the network. A virus needs a host file and usually user action; a trojan relies on the user running it.
Question 4
A request for /download?file=../../../etc/passwd returns the system password file. What attack is this?
- Cross-site scripting
- Replay attack
- Session hijacking
- Directory traversal
Show the answer
D. Directory traversal — Directory (path) traversal uses ../ sequences to reach files outside the intended folder.
Question 5
A program copies user input into a fixed-size memory area without checking length, overwriting adjacent memory. What is this?
- Race condition
- Buffer overflow
- Directory traversal
- Cross-site scripting
Show the answer
B. Buffer overflow — A buffer overflow writes past the end of a buffer and can overwrite return addresses to run attacker code.