Practice Threats, Attacks & Vulnerabilities questions for the CompTIA Security+. Every question includes a full explanation of why the correct answer is right and why the tempting distractors are wrong.
23 questions available · medium difficulty · Security+ · Free, no registration required
10 example questions with full explanations. Use the interactive practice above to work through the complete set.
Question 1medium
A security analyst reviewing logs notices that several employees received emails appearing to come from the CEO asking them to wire funds to an external account. The emails used the CEO's name and included personal details about recent company events. Select all that apply — which characteristics indicate this is a spear phishing attack rather than a generic phishing campaign?
- A.The emails were sent to specific, targeted individuals rather than a broad mailing list✓
- B.The emails impersonated a high-authority figure within the organization
- C.The emails included personalized details relevant to the recipient's organization✓
- D.The emails were delivered via SMTP on port 25
Correct answer: A, C
Spear phishing is defined by its targeted nature — it is directed at specific individuals or organizations rather than sent in bulk, and it incorporates personalized information (such as company events or colleague names) to increase credibility. These two traits distinguish it from generic phishing. Impersonating a high-authority figure (B) is characteristic of whaling or business email compromise, but impersonation alone does not define spear phishing — generic phishing campaigns also impersonate authority figures. The delivery protocol (D) is irrelevant to classifying the attack type; all phishing uses standard email infrastructure.
Question 2medium
An incident responder is analyzing a compromised workstation and finds that malicious code is executing entirely within PowerShell memory processes, with no executable files written to disk. EDR logs show that legitimate system binaries such as wmic.exe and certutil.exe are being used to download and run payloads. Select all that apply — which statements correctly describe this type of attack?
- A.This is consistent with fileless malware, which evades traditional signature-based AV that scans files on disk✓
- B.The use of legitimate system tools in this manner is known as living-off-the-land✓
- C.Because no files are written to disk, the malware cannot persist across reboots under any circumstances
- D.Memory forensics and behavioral analysis are appropriate detection techniques for this attack type✓
- E.This attack is best categorized as a worm because it uses built-in OS tools to spread
Correct answer: A, B, D
Fileless malware executes in memory and avoids writing traditional executable files to disk, which defeats file-based antivirus signatures (A). The technique of abusing legitimate, pre-installed system tools like PowerShell, wmic.exe, and certutil.exe is called living-off-the-land (B). Memory forensics and behavioral/heuristic analysis are the appropriate detection methods since there are no files to scan (D). Option C is incorrect — fileless malware can persist through registry keys, scheduled tasks, or WMI subscriptions without storing a traditional binary on disk. Option E is incorrect — using OS tools does not define a worm; worms are defined by self-replication across systems, which is not described here.
Question 3medium
During a web application penetration test, a tester discovers that submitting the input ' OR '1'='1 into a login form bypasses authentication. The tester also finds that appending ../../../etc/passwd to a URL parameter returns file contents. Select all that apply — which vulnerability classes are present in this application?
- A.SQL injection✓
- B.Directory traversal✓
- C.Cross-site request forgery (CSRF)
- D.Cross-site scripting (XSS)
- E.Insecure direct object reference (IDOR)
Correct answer: A, B
The input ' OR '1'='1 is a classic SQL injection payload that manipulates a SQL query to return true for all rows, bypassing authentication — confirming SQL injection (A). The use of ../../../etc/passwd to traverse the file system and read sensitive files outside the web root is a textbook directory traversal attack (B). CSRF (C) involves forging cross-site requests using a victim's authenticated session and is not demonstrated by either finding. XSS (D) involves injecting malicious scripts into web pages viewed by other users, which is also not shown. IDOR (E) involves accessing objects by manipulating a reference ID (e.g., changing user_id=1 to user_id=2), which is distinct from directory traversal.
Question 4medium
A network administrator notices that ARP tables on multiple hosts show the same MAC address mapped to both the default gateway IP and a workstation IP. Shortly after, a security tool alerts that TLS certificates presented to internal users do not match the expected certificates from the server. Select all that apply — which attacks are most likely occurring based on these indicators?
- A.ARP poisoning✓
- B.On-path (MITM) attack✓
- C.DNS poisoning
- D.A replay attack
- E.A deauthentication attack
Correct answer: A, B
ARP poisoning involves sending forged ARP replies to associate the attacker's MAC address with a legitimate IP (such as the default gateway), causing traffic to be redirected through the attacker — which is exactly what the duplicate MAC address in the ARP table indicates (A). ARP poisoning is a common method to position an attacker as an on-path (MITM) interceptor, and the mismatched TLS certificates are a strong indicator that traffic is being intercepted and re-encrypted by an unauthorized party (B). DNS poisoning (C) would manifest as incorrect IP addresses returned for domain names, not ARP table anomalies. A replay attack (D) involves re-transmitting captured authentication tokens and does not produce these IoCs. A deauthentication attack (E) is a wireless attack that disconnects clients from a Wi-Fi network and is unrelated to ARP table manipulation.
Question 5medium
A security analyst notices that several employee accounts across different departments each had exactly one failed login attempt with a common password before successfully authenticating with their correct credentials — all within a 30-minute window. No single account triggered the lockout threshold of five failed attempts. What type of attack best describes this activity?
- A.Password spraying✓
- B.Credential stuffing
- C.Brute force
- D.Dictionary attack
Correct answer: A
Password spraying involves trying one or a few common passwords against many different accounts, deliberately staying below lockout thresholds. The key indicators here are: multiple accounts targeted, only one or few attempts per account, and a short time window — all hallmarks of spraying. Credential stuffing uses previously breached username/password pairs, not a common password tried across accounts. Brute force and dictionary attacks focus on exhausting many passwords against a single account, which would trigger lockout policies and does not match the observed pattern.
Question 6medium
An organization's network administrator observes that DNS responses for a popular internal application are returning an IP address that belongs to an external server the team does not recognize. Users who visit the application are unknowingly submitting their credentials to this rogue server. The administrator confirms that the organization's internal DNS server records have been altered. Which attack is most consistent with these findings?
- A.DNS amplification attack
- B.DNS poisoning✓
- C.ARP poisoning
- D.Replay attack
Correct answer: B
DNS poisoning (also called DNS cache poisoning or DNS spoofing) involves corrupting DNS records so that legitimate domain names resolve to malicious IP addresses, redirecting users to attacker-controlled servers. The scenario explicitly states that internal DNS server records were altered and users are being redirected — this is the defining characteristic of DNS poisoning. DNS amplification is a DDoS technique that exploits open resolvers to flood a victim with traffic, not to redirect users. ARP poisoning operates at Layer 2 to associate a rogue MAC address with a legitimate IP, a different mechanism.Areplay attack involves capturing and retransmitting authentication tokens, which does not match the DNS record tampering described.
Question 7medium
A penetration tester on an authorized engagement sets up a wireless access point with the same SSID as the corporate network in the parking lot of the target organization. Employees' laptops automatically connect to it, allowing the tester to intercept their traffic. Which wireless attack technique is the tester employing?
- A.Deauthentication attack
- B.WPS PIN brute force
- C.Evil twin✓
- D.KRACK attack
Correct answer: C
An evil twin attack involves creating a rogue access point that mimics a legitimate network's SSID, causing devices configured to auto-connect to join the attacker's AP instead, enabling traffic interception. This precisely matches the described scenario.Adeauthentication attack sends forged 802.11 disassociation frames to disconnect clients from a legitimate AP, often used as a precursor to evil twin but is not the attack itself. WPS PIN brute force targets the Wi-Fi Protected Setup feature to recover the WPA2 passphrase and does not involve a rogue AP. KRACK exploits a vulnerability in the WPA2 four-way handshake to reinstall cryptographic keys, which requires the attacker to be in proximity but is a cryptographic attack rather than an impersonation attack.
Question 8medium
A web developer reports that whenever a specific blog comment containing a script tag is loaded by any visitor, the visitor's session cookie is silently sent to an external server. The malicious comment has been stored in the site's database for two weeks and has affected hundreds of users. Which application attack technique does this describe?
- A.Reflected cross-site scripting (XSS)
- B.Cross-site request forgery (CSRF)
- C.DOM-based cross-site scripting (XSS)
- D.Stored cross-site scripting (XSS)✓
Correct answer: D
Stored (persistent) XSS occurs when malicious script is saved in the application's database and executed in the browser of every user who loads the affected page — exactly what is described with the malicious blog comment persisting and affecting hundreds of visitors over time. Reflected XSS requires the malicious payload to be embedded in a URL that the victim clicks; it is not stored server-side and affects only users who follow the crafted link. DOM-based XSS manipulates the Document Object Model in the client's browser without the payload necessarily passing through the server. CSRF tricks an authenticated user's browser into making an unintended request to another site, exploiting the user's existing session — it does not inject scripts into page content.
Question 9medium
A threat intelligence report indicates that attackers recently compromised a widely used open-source logging library and inserted malicious code into its official release package. Organizations that updated to the new version automatically deployed the backdoor. Which category of attack does this represent?
- A.Supply chain attack✓
- B.Watering hole attack
- C.Baiting
- D.Insider threat
Correct answer: A
A supply chain attack targets the software or hardware distribution pipeline — in this case, a trusted third-party library — to insert malicious code that is then distributed to downstream organizations as part of a legitimate update. The compromise of the open-source library and its official release package is the defining indicator.Bwatering hole attack compromises websites frequented by the intended victims, not the software supply chain itself. Baiting is a social engineering technique that lures victims with something enticing (e.g., a malicious USB drive), which does not apply here. An insider threat originates from a malicious or negligent person within the organization; external compromise of a third-party library does not qualify, even though the effect propagated internally.
Question 10hard
A security analyst reviewing SIEM logs notices that over the past 72 hours, a single external IP has attempted authentication against 847 different user accounts, using only the passwords 'Summer2024!', 'Welcome1!', and 'Company123' for each account. The attempts are spread across multiple hours to avoid lockout thresholds. Simultaneously, the analyst finds 12 accounts have successfully authenticated from this IP and are now accessing SharePoint. Which attack technique BEST describes what occurred, and what distinguishes it from a related but different attack?
- A.Credential stuffing, because the attacker is using a large set of previously breached username/password pairs harvested from data dumps
- B.Password spraying, because the attacker uses a small set of commonly used passwords tried across many accounts to stay below lockout thresholds✓
- C.Brute force, because the attacker is systematically testing multiple password combinations against user accounts until successful
- D.Dictionary attack, because the attacker is selecting passwords from a precomputed wordlist and testing them against each individual account
Correct answer: B
Password spraying is characterized by trying a small number of commonly used passwords against a large number of accounts, deliberately staying below lockout thresholds to avoid detection — exactly what is described here. Unlike credential stuffing, which uses known username/password pairs from previous data breaches (implying each account gets its specific previously breached password), spraying uses the same few generic passwords across all accounts. A traditional brute force or dictionary attack exhausts many password combinations against one or a few accounts, which would quickly trigger lockout policies. The deliberate pacing across hours and the tiny password set confirm spraying as the correct classification.