Security+ SY0-701 Domain 2: Threats, Vulnerabilities & Mitigations — 11 practice questions with answers

Domain 2 is 22% of the CompTIA Security+ (SY0-701) exam, which works out to roughly 20of the up to 90 questions on the real test. Below are study notes for the domain's objectives, then every question from our free Security+ SY0-701 practice test that targets this domain, with the correct answer and the reasoning behind it. Try to answer each one before reading the explanation.

Objectives in this domain

2.1 Compare and contrast common threat actors and motivations
2.2 Explain common threat vectors and attack surfaces
2.3 Explain various types of vulnerabilities
2.4 Given a scenario, analyze indicators of malicious activity
2.5 Explain the purpose of mitigation techniques used to secure the enterprise

What to focus on

Domain 2 rewards precise distinctions. Threat actors differ by resources, sophistication and motive: a nation-state wants espionage or disruption and has years to spend; a hacktivist wants publicity; an unskilled attacker uses other people's tools; an insider already has access. Social-engineering variants are separated by channel and target, so phishing (email), vishing (voice), smishing (SMS) and whaling (executives) must not blur together.

Objective 2.4 is scenario-heavy: you are shown a symptom and asked what it indicates. Account lockouts spread across many users at once suggest password spraying; impossible travel suggests stolen credentials; a single host beaconing to one external address at fixed intervals suggests command-and-control. Practise reading the evidence before reading the answer options.

Mitigations close the domain. Segmentation, access control lists, application allow lists, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning and hardening are the vocabulary. A good habit is to name, for each attack you study, the one mitigation that most directly stops it, because that pairing is how many questions are built.

Practice questions and explanations

1. A user receives an email appearing to be from their bank, asking them to click a link to verify their account. The link leads to a fake website that harvests credentials. What type of attack is this?
1. A) Vishing
2. B) Phishing
3. C) Smishing
4. D) Whaling
Answer: B — Phishing
Phishing is a social engineering attack that uses fraudulent emails, websites, or messages to trick victims into revealing sensitive information. Vishing uses voice calls, smishing uses SMS, and whaling specifically targets high-profile individuals like executives.
2. An attacker injects malicious SQL statements into a login form to bypass authentication. What type of vulnerability is being exploited?
1. A) Cross-site scripting (XSS)
2. B) SQL injection
3. C) Buffer overflow
4. D) Directory traversal
Answer: B — SQL injection
SQL injection occurs when an attacker inserts malicious SQL code into input fields that are processed by a back-end database. By manipulating SQL queries, attackers can bypass authentication, access unauthorized data, modify data, or execute administrative operations on the database.
3. Which type of malware encrypts files and demands payment for the decryption key?
1. A) Trojan
2. B) Spyware
3. C) Ransomware
4. D) Rootkit
Answer: C — Ransomware
Ransomware is a type of malware that encrypts the victim's files or locks their system, then demands a ransom payment (typically in cryptocurrency) in exchange for the decryption key. Notable examples include WannaCry and NotPetya.
4. An attacker positions themselves between two communicating parties to intercept and potentially alter the communication. What is this attack called?
1. A) Replay attack
2. B) On-path (man-in-the-middle) attack
3. C) DNS poisoning
4. D) ARP spoofing
Answer: B — On-path (man-in-the-middle) attack
An on-path attack (formerly known as man-in-the-middle or MITM) occurs when an attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. This allows the attacker to eavesdrop on, modify, or inject data into the communication.
5. Which of the following attacks involves overwhelming a target system with traffic to make it unavailable to legitimate users?
1. A) Social engineering
2. B) Brute force attack
3. C) Distributed Denial of Service (DDoS)
4. D) Privilege escalation
Answer: C — Distributed Denial of Service (DDoS)
A Distributed Denial of Service (DDoS) attack uses multiple compromised systems (often a botnet) to flood a target with traffic, exhausting its resources and making it unavailable to legitimate users. Unlike a simple DoS, a DDoS originates from many distributed sources, making it harder to mitigate.
6. What type of threat actor typically has the most resources and conducts long-term, sophisticated cyber operations?
1. A) Script kiddies
2. B) Hacktivists
3. C) Advanced Persistent Threats (APTs) / Nation-state actors
4. D) Insider threats
Answer: C — Advanced Persistent Threats (APTs) / Nation-state actors
Advanced Persistent Threats (APTs) and nation-state actors have the most resources, including government funding, sophisticated tools, and skilled personnel. They conduct long-term, stealthy campaigns targeting specific organizations or nations for espionage, sabotage, or strategic advantage.
7. A security analyst discovers that a recently patched vulnerability in a web application was exploited before the patch was available. What type of attack was this?
1. A) Known vulnerability exploit
2. B) Zero-day attack
3. C) Brute force attack
4. D) Side-channel attack
Answer: B — Zero-day attack
A zero-day attack exploits a previously unknown vulnerability before the vendor has released a patch or fix. The term 'zero-day' refers to the fact that the developers have had zero days to address the vulnerability. These attacks are particularly dangerous because there are no existing signatures or patches to defend against them.
8. An employee plugs in a USB drive they found in the parking lot, which installs malware on their workstation. This is an example of which social engineering technique?
1. A) Tailgating
2. B) Baiting
3. C) Pretexting
4. D) Impersonation
Answer: B — Baiting
Baiting involves luring victims with something enticing, such as a USB drive left in a public location. When the target picks up and uses the bait, malware is installed or sensitive information is compromised. It exploits human curiosity and is a form of social engineering.
9. Which of the following BEST describes a supply chain attack?
1. A) Attacking a company's retail distribution network
2. B) Compromising a trusted software vendor or hardware manufacturer to deliver malware through their products
3. C) Stealing products during shipping
4. D) Disrupting a company's procurement process
Answer: B — Compromising a trusted software vendor or hardware manufacturer to deliver malware through their products
A supply chain attack targets the less-secure elements of a supply chain, such as software vendors, hardware manufacturers, or managed service providers. By compromising a trusted supplier, attackers can distribute malware through legitimate software updates or hardware components, affecting all downstream customers.
10. Which type of cross-site scripting (XSS) attack stores the malicious script permanently on the target server?
1. A) Reflected XSS
2. B) Stored (persistent) XSS
3. C) DOM-based XSS
4. D) Self-XSS
Answer: B — Stored (persistent) XSS
Stored (or persistent) XSS occurs when malicious script is permanently stored on the target server, such as in a database, comment field, or forum post. Every user who visits the affected page will execute the malicious script, making it more dangerous than reflected XSS, which requires the victim to click a specific link.
11. An attacker uses a list of commonly used passwords to attempt to gain access to multiple accounts. What type of attack is this?
1. A) Rainbow table attack
2. B) Password spraying
3. C) Credential stuffing
4. D) Dictionary attack
Answer: B — Password spraying
Password spraying attempts a small number of commonly used passwords against many accounts, as opposed to brute force which tries many passwords against one account. This technique avoids account lockout policies by staying below the threshold for each individual account.

Reading answers is not the same as recalling them. When you have worked through every domain, take the timed Security+ SY0-701 practice test: it shuffles the questions and options and scores you by domain, so you can see whether this one still needs work.

Security+ SY0-701 Domain 2: Threats, Vulnerabilities & Mitigations — 11 practice questions with answers

Objectives in this domain

What to focus on

Practice questions and explanations

1. A user receives an email appearing to be from their bank, asking them to click a link to verify their account. The link leads to a fake website that harvests credentials. What type of attack is this?

2. An attacker injects malicious SQL statements into a login form to bypass authentication. What type of vulnerability is being exploited?

3. Which type of malware encrypts files and demands payment for the decryption key?

4. An attacker positions themselves between two communicating parties to intercept and potentially alter the communication. What is this attack called?

5. Which of the following attacks involves overwhelming a target system with traffic to make it unavailable to legitimate users?

6. What type of threat actor typically has the most resources and conducts long-term, sophisticated cyber operations?

7. A security analyst discovers that a recently patched vulnerability in a web application was exploited before the patch was available. What type of attack was this?

8. An employee plugs in a USB drive they found in the parking lot, which installs malware on their workstation. This is an example of which social engineering technique?

9. Which of the following BEST describes a supply chain attack?

10. Which type of cross-site scripting (XSS) attack stores the malicious script permanently on the target server?

11. An attacker uses a list of commonly used passwords to attempt to gain access to multiple accounts. What type of attack is this?