Threats, Vulnerabilities, and Mitigations is worth 22% of CompTIA Security+ SY0-701. The exam expects you to recognize who is attacking and why, how they get in, which weakness they exploit, what the evidence looks like, and which mitigation stops it. Most questions describe a short scenario and ask you to name the attack or the best response.
This is the second set in our Security+ SY0-701 series (Questions 11-20). If you are new to the series, start with SY0-701 Questions 1-10. Every question is an original practice scenario, not a copy of a real exam item. SY0-701 remains the current Security+ exam, with its successor SY0-801 expected later, so these objectives are still the ones to study.
Read each scenario for the one detail that separates similar attacks, choose an answer, and then reveal the explanation.
Question 11: A Political Message on the Home Page
A pharmaceutical company’s public website is defaced with a message protesting its drug prices. No data was stolen and no ransom was demanded. Which threat actor is the most likely source?
A) Hacktivist
B) Organized crime
C) Nation-state
D) Shadow IT
👁 Reveal Answer
Correct Answer: A
Explanation: Hacktivists are motivated by philosophical or political beliefs and often use defacement, leaks, or denial of service to draw attention to a cause. The protest message with no financial demand is the giveaway. B is usually motivated by money, through ransomware, fraud, or data theft. C has the most resources and typically pursues espionage or disruption quietly over long periods. D refers to employees using unapproved technology, which is a risk but not an attacker who defaces websites.
Reference: CompTIA Security+ SY0-701 exam objectives, 2.1 (threat actors and motivations)
Question 12: An Urgent Wire Transfer From the CFO
An accounts payable clerk receives an email that appears to come from the CFO, sent from a domain that differs from the company’s by one letter. It asks for an urgent wire transfer to a new supplier and says the CFO cannot take calls. What is this, and what is the best control?
A) Smishing; block text messages on company phones
B) A watering hole attack; block the supplier’s website
C) Business email compromise; require out-of-band verification, such as a call to a known number, for payment changes
D) A brute-force attack; enable account lockout
👁 Reveal Answer
Correct Answer: C
Explanation: Business email compromise (BEC) uses impersonation of executives or suppliers, often with look-alike domains, urgency, and a reason to avoid normal checks, to trick staff into sending money. The FBI’s guidance stresses verifying payment and account changes through a separate, known channel rather than replying to the email. A is phishing by SMS. B compromises a website the victims visit. D guesses passwords; nothing here involves logging in.
Reference: FBI: Business email compromise
Question 13: A Trusted Industry Forum Turns Malicious
Attackers who want to breach an aerospace manufacturer compromise a small engineering forum that many of its engineers visit daily. Visitors to the forum are silently served malware. What type of attack is this?
A) Typosquatting
B) Watering hole attack
C) Vishing
D) On-path attack
👁 Reveal Answer
Correct Answer: B
Explanation: In a watering hole attack, attackers compromise a website that a target group is known to visit and use it to deliver malware to those visitors. MITRE ATT&CK describes this under drive-by compromise. A registers misspelled domain names to catch people who mistype a URL. C uses phone calls. D intercepts traffic between two parties; here, the victims visit a legitimate but compromised site.
Reference: MITRE ATT&CK: Drive-by Compromise (T1189)
Question 14: Failed Logins Spread Across Every Account
Sign-in logs show one failed attempt per hour against each of 4,000 user accounts, all using the password “Autumn2026!”. No single account reached the lockout threshold. What attack is this, and what mitigates it best?
A) Credential stuffing; force a password reset for one user
B) A birthday attack; use a longer hash
C) A brute-force attack against one account; lower the lockout threshold
D) Password spraying; require multifactor authentication and block common or company-themed passwords
👁 Reveal Answer
Correct Answer: D
Explanation: Password spraying tries one or a few common passwords across many accounts, staying below lockout thresholds that brute-force attacks against a single account would trigger. MFA stops a correct guess from being enough, and banned password lists stop users from choosing passwords like “Autumn2026!”. A uses username and password pairs stolen from other breaches, which would show many different passwords. B is a hash collision attack. C targets one account with many passwords, which is the opposite pattern.
Reference: MITRE ATT&CK: Password Spraying (T1110.003)
Question 15: Checking a File, Then Using a Different One
A privileged program checks that a user may write to a temporary file, then opens the file a moment later. An attacker swaps the file for a link to a system file between the check and the open. Which vulnerability is being exploited?
A) SQL injection
B) Buffer overflow
C) A race condition, specifically time-of-check to time-of-use (TOCTOU)
D) Cross-site scripting
👁 Reveal Answer
Correct Answer: C
Explanation: A TOCTOU race condition happens when a program checks the state of a resource and then uses it, but the resource changes between the check and the use. The attacker exploits that small window. A injects database commands through input. B writes past the end of a memory buffer. D injects scripts into web pages viewed by other users.
Reference: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Question 16: A Signed Update That Contained a Backdoor
A company installs a routine update for its network monitoring software. The update is correctly signed by the vendor, but investigators later find that attackers had compromised the vendor’s build system and added a backdoor. Which threat vector does this represent?
A) A supply chain attack through a malicious update
B) An unsecure wireless network
C) Default credentials
D) A removable device
👁 Reveal Answer
Correct Answer: A
Explanation: In a supply chain attack, attackers compromise a trusted supplier, such as a software vendor or service provider, so that the malicious code arrives through a channel the victim already trusts. A valid signature only proves the vendor’s system produced the update; it cannot prove the build system was clean. Defenses include vendor risk assessment, monitoring update behavior, and limiting what monitoring tools can reach. B, C, and D are real threat vectors, but none of them explains a signed vendor update carrying a backdoor.
Reference: CompTIA Security+ SY0-701 exam objectives, 2.2 (supply chain threat vectors) and 2.3 (malicious update)
Question 17: One User, Two Continents, Ten Minutes
A user’s account signs in from Chicago and then, ten minutes later, from Singapore. The user is at her desk in Chicago. Which indicator of malicious activity does this match?
A) Resource consumption
B) Blocked content
C) Account lockout
D) Impossible travel
👁 Reveal Answer
Correct Answer: D
Explanation: Impossible travel means sign-ins from locations too far apart to reach in the time between them, which suggests that someone else is using the account. Identity platforms such as Microsoft Entra ID Protection flag this kind of atypical travel as a risk detection. A refers to unusual CPU, memory, or bandwidth use. B means a security tool stopped content from loading. C happens after too many failed sign-ins, which did not occur here.
Question 18: Recovering From Ransomware Without Paying
A hospital wants to be able to recover from a ransomware attack that encrypts its file servers without paying the ransom. Which measure contributes most directly to that goal?
A) A larger file server with more disk space
B) Regular backups that are kept offline or immutable and are tested by restoring them
C) A policy that forbids employees from opening attachments
D) Snapshots stored on the same file server
👁 Reveal Answer
Correct Answer: B
Explanation: CISA’s #StopRansomware guidance recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity. Backups that ransomware cannot reach or change, and that are proven to restore, are what make recovery possible without paying. A changes capacity, not resilience. C may reduce infections but will never stop all of them, and it does not help recovery. D sits on the same system the ransomware encrypts, so attackers often destroy it first.
Reference: CISA #StopRansomware Guide
Question 19: Only Approved Programs on the Kiosks
A library runs public kiosks that should only ever run a web browser and a catalog app. Users keep running portable programs from USB drives. Which mitigation fits best?
A) An application allow list that permits only the approved programs to run
B) A stronger Wi-Fi password
C) Antivirus with daily signature updates only
D) A data retention policy
👁 Reveal Answer
Correct Answer: A
Explanation: An application allow list (also called allowlisting) permits only specified applications to run and blocks everything else. It works especially well on fixed-purpose systems such as kiosks, where the list of approved programs is short and rarely changes. B protects the network, not what runs on the kiosk. C catches known malware but will let harmless unapproved programs run. D controls how long data is kept.
Reference: NIST SP 800-167: Guide to Application Whitelisting
Question 20: Forcing a Connection Onto Old Encryption
During testing, an attacker on the same network manipulates the connection between a client and a web server so that they negotiate an older, weak protocol version that the server still supports. What is this attack, and what prevents it?
A) A collision attack; use a longer hash
B) A replay attack; add timestamps to every request
C) A downgrade attack; disable outdated protocol versions and weak cipher suites on the server
D) SQL injection; use parameterized queries
👁 Reveal Answer
Correct Answer: C
Explanation: A downgrade attack forces two parties to fall back to an older or weaker protocol version or cipher suite that the attacker can break more easily. The root cause is that the server still supports the weak option, so the fix is to disable outdated protocol versions (such as TLS 1.0 and 1.1) and weak cipher suites, as NIST’s TLS guidance in SP 800-52 recommends. A finds two inputs that produce the same hash. B resends captured valid traffic. D attacks a database through user input.
Reference: NIST SP 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of TLS Implementations
Study Tips for Threats, Vulnerabilities, and Mitigations
- Read motive first. Money suggests organized crime, a cause suggests hacktivists, and long, quiet espionage suggests a nation-state.
- Look for the pattern in the evidence. One password across many accounts is spraying. Many passwords against one account is brute force.
- Trust can be the attack path. Watering holes abuse trusted sites, and supply chain attacks abuse trusted vendors.
- Match the mitigation to the cause. Disable weak protocols for downgrades, use allow lists for unapproved software, and verify payments out of band for BEC.
- Ransomware recovery depends on backups. They must be offline or immutable, and tested.
Keep Practicing for Security+
Review cloud architecture in SY0-701 Questions 1-10, then continue to Questions 21-30 on security operations: incident response, forensics, vulnerability management, and monitoring.