CompTIA Security+ SY0-701 Threats, Vulnerabilities, and Mitigations Practice Questions

Free Security+ Threats, Vulnerabilities, and Mitigations practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main CompTIA Security+ SY0-701 page. Sign up free to practice the full set.

1. Question 1Threats, Vulnerabilities, and Mitigations

   What is the primary difference between a threat and a vulnerability?

   • AThreats and vulnerabilities are two identical, interchangeable concepts
   • BA threat is a system weakness and a vulnerability is the danger
   • CA threat is a potential danger; a vulnerability is the weaknessCorrect
   • DA vulnerability is always external while a threat is internal
   ✓ Correct answer: C

   A vulnerability is a flaw, gap, or weakness in a system, such as an unpatched service, a misconfiguration, or a weak password policy, that could be exploited. A threat is anything capable of taking advantage of that weakness, such as a malware author, a nation-state actor, or a natural disaster. Risk only materializes when a threat has a matching vulnerability to exploit; removing either one, patching the flaw or stopping the actor, reduces risk. Keeping these two terms distinct is foundational to accurate risk assessment, since risk registers and vulnerability management programs track them separately, one column for weaknesses found, another for the actors or events that could exploit them, so mitigations can be matched to the correct side of the equation.

   Why the other options are wrong

   • AThreats and vulnerabilities describe different things: one is a potential source of harm and the other is an exploitable weakness, so treating them as interchangeable ignores this core distinction used throughout risk assessment.
   • BThis reverses the definitions; a system weakness is the vulnerability, and the potential source of danger capable of exploiting it is the threat, not the other way around.
   • DNeither term is defined by location; a vulnerability can exist on an internal or external-facing system, and a threat can originate from inside the organization or outside it.
2. Question 2Threats, Vulnerabilities, and Mitigations

   A user at Apex Marketing receives an email that appears to be from their CEO requesting an urgent wire transfer to a new vendor. The email address is slightly different from the CEO's actual address. What type of attack is this?

   • AWatering hole attack
   • BBrute force attack
   • CBusiness email compromise (BEC)Correct
   • DVishing
   ✓ Correct answer: C

   Business email compromise combines executive impersonation, here through a sender address that is only slightly different from the real CEO's address, with a manufactured sense of urgency around an unusual wire transfer to a new vendor, in order to pressure the recipient at Apex Marketing into bypassing normal payment-verification procedures. The near-match spoofed address and the urgent, unusual financial request are the two hallmark indicators of BEC specifically, distinguishing it from broader, less targeted phishing campaigns aimed at harvesting generic credentials. Out-of-band verification of any payment or vendor-detail change, such as calling the CEO directly using a known phone number rather than replying to the email, is the primary control organizations use to catch this exact type of fraud before funds are transferred.

   Why the other options are wrong

   • AA watering hole attack infects a website the target group frequents; it does not involve a spoofed CEO email.
   • BA brute force attack guesses credentials through repeated attempts and has nothing to do with impersonating an executive by email.
   • DVishing is voice phishing over the phone, whereas this fraud was delivered through email.
3. Question 3Threats, Vulnerabilities, and MitigationsSelect all that apply

   Which THREE are common social engineering attack techniques? (Choose three.)

   • APhishingCorrect
   • BDefragmentation
   • CPretextingCorrect
   • DTailgatingCorrect
   • ECompiling
   ✓ Correct answer: A, C, D

   Phishing, pretexting, and tailgating are all classic social engineering techniques because each one manipulates human psychology rather than exploiting a technical software flaw. Phishing uses deceptive emails or messages to trick a victim into clicking a malicious link or revealing credentials. Pretexting fabricates a false scenario or invented identity, such as posing as IT support or a vendor, to persuade a target to hand over information or perform an action they otherwise would not. Tailgating is the physical variant, where an unauthorized person follows an authorized employee through a secured door by exploiting courtesy rather than presenting their own credentials. What unites all three is that the attacker's tool is deception and manipulation of trust, not code, malware, or a system exploit, which is why they are grouped together as social engineering.

   Why the other options are wrong

   • BDefragmentation reorganizes fragmented file data on a disk for performance; it is a routine maintenance operation with no deceptive or manipulative element at all.
   • ECompiling translates source code into an executable program, a normal software development step that has nothing to do with manipulating a person.
4. Question 4Threats, Vulnerabilities, and Mitigations

   A security operations team detects unusual DNS queries from an internal server. The queries contain encoded data in the subdomain fields and are directed to an external domain controlled by an attacker. What technique is the attacker using?

   • ADNS cache poisoning
   • BARP spoofing
   • CDHCP starvation
   • DDNS tunneling for data exfiltrationCorrect
   ✓ Correct answer: D

   DNS tunneling smuggles data by encoding it into the subdomain labels of DNS queries sent to an attacker-controlled domain, letting the traffic blend in with normal, expected DNS activity and bypass security controls and firewalls that routinely leave port 53 open without deep content inspection. The attacker's own authoritative DNS server for that external domain receives each specially crafted query and decodes the embedded subdomain data to reassemble the exfiltrated information, matching the pattern the operations team observed originating from the internal server. Because DNS was never designed to carry arbitrary payloads and is rarely logged at the content level, this covert channel can persist for a long time undetected. DNS query monitoring, entropy analysis on subdomain names, and egress filtering to approved resolvers only are the primary detection and mitigation controls.

   Why the other options are wrong

   • ADNS cache poisoning injects forged records to redirect users to malicious sites; it does not encode outbound data in queries.
   • BARP spoofing manipulates layer 2 address mappings on a local network and is unrelated to DNS query content.
   • CDHCP starvation exhausts a DHCP pool to deny address leases, an availability attack with no connection to DNS-based data theft.
5. Question 5Threats, Vulnerabilities, and Mitigations

   An attacker registers a domain that closely resembles a legitimate company's domain, differing by a single transposed letter, hoping users mistype the URL and land on the malicious site. What is this technique called?

   • APharming
   • BTyposquattingCorrect
   • CDomain hijacking
   • DSession replay
   ✓ Correct answer: B

   Typosquatting, also called URL hijacking, relies entirely on registering a domain name that is nearly identical to a legitimate one, differing by a single transposed, added, or missing letter, so that users who make a small typing mistake while entering the address land on the attacker's site instead of the real one, where they may be phished for credentials or served malware. Because the technique depends purely on human typing error rather than any technical compromise of the legitimate site, organizations commonly defend against it by proactively registering the most likely misspellings and common transpositions of their own domain names. Pharming (A), by contrast, achieves a similar end result of misdirecting users, but does so technically, by poisoning DNS records or a local hosts file, not by registering a new lookalike domain.

   Why the other options are wrong

   • APharming redirects users to a malicious site by poisoning DNS records or a hosts file, a technical manipulation, not by registering a new misspelled lookalike domain.
   • CDomain hijacking involves taking unauthorized control over an existing, legitimate domain's registration, rather than registering a separate new domain that merely resembles it.
   • DSession replay reuses previously captured authentication data to impersonate a user; it has nothing to do with registering a similar-looking domain name.
6. Question 6Threats, Vulnerabilities, and Mitigations

   Malware modifies a victim's local hosts file so that entering the bank's correct, legitimate URL silently resolves to an attacker-controlled server. Which attack does this describe?

   • APharmingCorrect
   • BPhishing
   • CVishing
   • DSmishing
   ✓ Correct answer: A

   Pharming works by corrupting the name-resolution process itself, here by modifying the victim's local hosts file, or in other variants poisoning a DNS cache, so that typing the bank's correct, legitimate URL silently resolves to an IP address the attacker controls instead of the real server. This is what makes pharming especially dangerous: the victim did nothing suspicious, entered the correct address exactly as always, yet is still redirected, with no malicious link or message required at all. Phishing instead relies on deceptive messages or links to lure victims to a fraudulent destination, meaning the victim must be tricked into clicking something or entering a wrong address, which is not what happened here. Vishing and smishing are simply phishing conducted over voice calls and SMS text messages respectively, both still relying on a deceptive message rather than resolution tampering.

   Why the other options are wrong

   • BPhishing relies on a deceptive message or link to lure the victim to a fraudulent destination; here the victim used the correct URL with no such lure involved.
   • CVishing is voice-call-based phishing conducted over the phone, a social-engineering technique unrelated to manipulating local name resolution.
   • DSmishing is phishing conducted via SMS text messages; it relies on a deceptive message, not on redirecting a correctly typed URL.
7. Question 7Threats, Vulnerabilities, and Mitigations

   Incident responders find no malicious files on disk. Instead, a PowerShell process loaded a payload directly into memory via a registry-stored script, and it disappears on reboot. Which malware approach is this?

   • AFileless malwareCorrect
   • BBoot-sector virus
   • CMacro virus
   • DRansomware
   ✓ Correct answer: A

   Fileless malware operates entirely in volatile memory and abuses legitimate, already-trusted system utilities, here PowerShell reading a payload staged inside a registry value, rather than dropping a standalone malicious executable onto disk that signature-based antivirus would have a chance to scan and flag. Because the payload never touches disk as its own file and lives only in the running process's memory, it vanishes automatically the moment the system reboots, leaving few or no traditional forensic artifacts behind, which is precisely why detecting it requires behavior-based and memory-analysis tooling rather than file-hash signatures. A boot-sector virus, a macro virus, and ransomware all leave persistent on-disk artifacts, in the boot record, inside a document file, or as encrypted files respectively, none of which matches this memory-resident, reboot-clearing behavior.

   Why the other options are wrong

   • BA boot-sector virus persists by writing itself into the disk's boot record, an on-disk artifact that survives reboot, unlike the memory-only payload described here.
   • CA macro virus lives embedded inside a document file and requires that document to be opened to run, leaving a clear on-disk file artifact behind.
   • DRansomware's defining action is writing encrypted files to disk to extort the victim; this scenario explicitly states no files on disk were ever created or encrypted.
8. Question 8Threats, Vulnerabilities, and MitigationsSelect all that apply

   An analyst is reviewing a suspicious email that impersonates a shipping company. Which TWO indicators would MOST strongly suggest this is a phishing message? (Choose two.)

   • AThe sender domain is a misspelled version of the real carrierCorrect
   • BThe message creates urgency and threatens a lost packageCorrect
   • CThe email is digitally signed by the carrier
   • DThe message arrives during normal business hours
   ✓ Correct answer: A, B

   A sender domain that is a slight misspelling of the genuine shipping carrier's real domain is one of the strongest phishing indicators available, because the attacker fundamentally cannot send from the carrier's actual domain and must rely on a look-alike to fool a quick glance. Manufactured urgency, here a threat about a lost package that pressures the recipient to act immediately, is a core social engineering pressure tactic specifically designed to short-circuit careful, rational evaluation of the message before the recipient has time to notice red flags like the misspelled domain. Seen together, a spoofed-looking sending domain combined with artificially induced time pressure is one of the most reliable phishing patterns taught in security awareness training, and analysts are trained to check the actual sending domain character by character and to treat urgency itself as a warning sign rather than a reason to act quickly.

   Why the other options are wrong

   • CA valid digital signature genuinely from the real carrier would actually support the message's authenticity, which is the opposite of a phishing indicator.
   • DArriving during normal business hours is unremarkable timing and does not by itself suggest anything malicious about a message.

How Threats, Vulnerabilities, and Mitigations is tested

This domain holds 216 of the 990 questions in the Security+ bank, about 22%. The mix is 184 single-answer multiple choice and 32 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Threats, Vulnerabilities, and Mitigations on its own rather than re-running full-length mocks.

Other Security+ exam domains

• General Security Concepts125 questions
• Security Architecture176 questions
• Security Operations285 questions
• Security Program Management and Oversight188 questions
• All Security+ practice questions990 total
• Threats, Vulnerabilities, and Mitigations study notesKey concepts
• Security practice examsAll Security

Security+ Threats, Vulnerabilities, and Mitigations FAQ