CompTIA Security+ Practice Questions: Threats and Vulnerabilities

8 free, exam-style CompTIA Security+ (SY0-701) practice questions covering Threats and Vulnerabilities. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.

🚀 Take the full CompTIA Security+ quiz 📘 CompTIA Security+ study guide

Q1. Which of the following BEST describes a zero-day vulnerability?

A.A vulnerability in outdated software
B.An unpatched flaw unknown to the vendor✓ Correct
C.A misconfigured firewall rule
D.An expired digital certificate

Explanation: Zero-day vulnerabilities are unknown to the vendor, leaving no time for patches before potential exploitation. Learn more.

Q2. Which attack uses many systems to overwhelm a target service with traffic?

A.DDoS✓ Correct
B.On-path decryption only
C.Bluejacking
D.Typosquatting only

Explanation: Distributed denial-of-service attacks use multiple sources to exhaust capacity or availability. Learn more.

Q3. Which wireless attack creates a fake access point that appears legitimate?

A.Evil twin✓ Correct
B.Smurf
C.Pass-the-hash
D.Birthday attack

Explanation: An evil twin is a rogue access point configured to impersonate a legitimate wireless network. Learn more.

Q4. Which type of malware encrypts user files and demands payment?

A.Ransomware✓ Correct
B.Logic bomb only
C.Root certificate
D.Ad blocker

Explanation: Ransomware denies access to data, often through encryption, and demands payment for recovery. Learn more.

Q5. Which attack uses a fake QR code to send users to a malicious site?

A.Quishing✓ Correct
B.Smishing only
C.Vishing only
D.Tailgating

Explanation: Quishing is phishing that uses QR codes to direct users to malicious content. Learn more.

Q6. Which attack uses similar-looking domain names to trick users?

A.Typosquatting✓ Correct
B.ARP poisoning only
C.RFID cloning only
D.Privilege escalation only

Explanation: Typosquatting registers lookalike or misspelled domains to lure users. Learn more.

Q7. Which vulnerability occurs when an application includes user input in an LDAP query without safe handling?

A.LDAP injection✓ Correct
B.DNS poisoning
C.MAC flooding
D.Bluejacking

Explanation: LDAP injection manipulates directory queries through unsafe input handling. Learn more.

Q8. Which attack sends fraudulent text messages to steal information?

A.Smishing✓ Correct
B.Vishing only
C.Whaling only
D.Watering hole only

Explanation: Smishing is phishing conducted through SMS or text messages. Learn more.