Domain 2 is a test of choosing the most specific control, not just a correct one. Candidates fail when they see an email impersonating a CEO and pick "phishing," when the examiner was testing the more precise "whaling"—a distinction that separates a pass from a fail.
This page provides 10 free practice questions for the CompTIA Security+ (SY0-701) "Threats, Vulnerabilities, and Mitigations" domain (Domain 2), updated for 2026. Each question includes a detailed explanation of the correct answer and why the distractors are wrong, training you to spot these critical distinctions.
Key facts
- Exam Domain: Threats, Vulnerabilities, and Mitigations (Domain 2)
- Domain Weighting: 24% of the SY0-701 exam
- Official Blueprint Objectives: 2.1, 2.2, 2.3, 2.4
- Key Topics: Social engineering, malware, network attacks, application vulnerabilities, mitigation techniques
- Passing Score: 750 on a scale of 100-900
- Official Body: CompTIA
The U.S. Bureau of Labor Statistics projects that jobs for information security analysts will grow 32% from 2022 to 2032, much faster than the average for all occupations (BLS).
How These Practice Questions Test Your Judgment
These questions are not a simple knowledge check. They are built to simulate the cognitive load of the real CompTIA Security+ exam, forcing you to make judgment calls under pressure. Each question is aligned with the official SY0-701 exam objectives for Domain 2 and is designed to test your analytical skills.
Studying for CompTIA Security+? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
This sampler is a small part of VoraPrep's complete 6-pillar course, which includes over 1,500 adaptive practice questions, textbook-grade lessons, exam simulators, and instant help from Vory, your 24/7 personal tutor. Use these questions to find your baseline. Be honest about not just what you got wrong, but why you got it wrong. Try VoraPrep's free CompTIA Security+ practice questions to see the full platform.
Distinguishing Common Social Engineering Attacks
One of the most common traps in Domain 2 is choosing a general answer when a more specific one is available. Social engineering questions are a prime example. You must know the precise vector and target.
| Attack Type | Vector | Target | Key Differentiator |
|---|---|---|---|
| Phishing | Broad/Non-specific | A generic, mass-email campaign. | |
| Spear Phishing | Specific individual or group | Highly personalized email with details about the target. | |
| Whaling | High-profile executive | A spear phishing attack aimed at a "big fish" (e.g., CEO, CFO). | |
| Vishing | Voice Call | Any | Uses the phone (Voice phishing) to create urgency. |
| Smishing | SMS Text | Any | Uses text messages (SMS phishing) to deliver malicious links. |
Threats, Vulnerabilities, and Mitigations Practice Questions
Read each question carefully. Choose the single best answer. The detailed explanations that follow are the most important part of this exercise.
Question 1
A security analyst is reviewing network traffic logs after a suspected data breach. The logs show that an external IP address connected to the company's file server via TCP port 445, downloaded several large files, and then the connection terminated. The activity was isolated to this single server. Which of the following types of malware is MOST likely responsible for this activity?
Correct Answer: B. WormA worm is malware that replicates itself to spread to other computers, often by exploiting a specific network service vulnerability without user interaction. The key indicators here are the use of a common network service port (TCP 445 for SMB) and the lack of any user action. The WannaCry ransomware famously propagated using an SMB vulnerability, demonstrating how worm-like capabilities can spread other malware payloads.
Why the other answers are wrong:
- A (Ransomware): The primary goal of ransomware is to encrypt files and demand payment. The scenario describes data exfiltration (downloading files), not encryption.
- C (Trojan): A Trojan disguises itself as legitimate software to trick a user into executing it. The attack described is network-based and automated, which is the classic signature of a worm, not a user-tricking Trojan.
- D (Spyware): Spyware focuses on covertly gathering information from a user's device (keystrokes, browsing habits). It is typically less focused on bulk file exfiltration from a server.
Question 2
An employee receives an email that appears to be from the company's CEO. The email instructs the employee to immediately wire $25,000 to a new vendor for a time-sensitive project. The email uses an urgent tone and directs the employee to bypass the normal payment authorization process. This is an example of which type of attack?
Correct Answer: D. WhalingWhaling is a specific type of spear phishing attack that targets high-profile individuals within an organization, such as C-level executives (the "big fish" or "whales"). In this scenario, the attacker is impersonating the CEO to trick an employee into performing a high-value action. The specificity of the target (CEO) and the high-value request are the defining characteristics of whaling.
- B (Vishing): This is voice phishing, which occurs over the phone, not via email.
- C (Pharming): This attack redirects users from a legitimate website to a fraudulent one by compromising DNS records or host files. It does not involve email impersonation.
Question 3
A web developer is performing a security audit on a new e-commerce application. They discover that by manipulating a URL parameter, they can view the order history of other customers. For example, changing https://shop.example.com/orders?id=101 to https://shop.example.com/orders?id=102 displays another user's data. Which vulnerability is present?
Correct Answer: C. Insecure Direct Object Reference (IDOR)IDOR is an access control vulnerability that occurs when an application provides direct access to objects (like database records) based on user-supplied input. Here, the application uses the
Why the other answers are wrong:idparameter directly to fetch an order without verifying that the logged-in user is authorized to view that specific order. The attacker simply iterates through the ID numbers to access unauthorized data.
- A (XSS): XSS involves injecting malicious scripts into a web page that are then executed in other users' browsers. This scenario describes unauthorized data access, not script injection.
- B (SQLi): SQL injection involves inserting malicious SQL code into an input field to manipulate the backend database. While the data comes from a database, the attack described is manipulating an object reference (
id=101), not injecting SQL commands.- D (CSRF): CSRF tricks a victim's browser into making an unintended request to a web application where they are already authenticated. This scenario involves an attacker actively requesting data, not tricking another user into performing an action.
Question 4
A security team wants to implement a solution to detect and prevent malicious traffic from entering their network in real-time. The solution should be able to analyze traffic patterns against a known set of signatures and block any matching packets before they reach their destination. Which of the following would be the BEST choice?
Correct Answer: C. Network Intrusion Prevention System (NIPS)The key requirements are "prevent" and "in real-time" on the "network". A NIPS is an inline device that actively monitors network traffic and can block, drop, or redirect malicious packets based on a signature database or behavioral analysis. It meets all the requirements of the scenario.
- Goal: Detect or Prevent? The scenario says "prevent". This eliminates detection-only systems (NIDS).
- Location: Network or Host? The scenario says "network traffic". This eliminates host-based systems (HIPS).
- Conclusion: The only remaining option is a Network Intrusion Prevention System (NIPS).
- A (NIDS): A NIDS is a passive system. It can detect malicious traffic and generate an alert, but it cannot block the traffic itself. The scenario specifically requires prevention.
- B (HIPS): A HIPS runs on an individual endpoint (like a server or workstation) and can prevent malicious activity on that specific host, but it does not monitor the entire network.
- D (SIEM): A SIEM is a logging and correlation tool. It aggregates logs from many different sources for analysis and alerting. It does not actively block traffic on the network.
Question 5
A penetration tester successfully gains access to a company's internal network. To avoid detection while moving to other systems, the tester modifies operating system log files to erase any record of their commands and network connections. This technique is known as:
Correct Answer: C. Covering tracksCovering tracks is a phase in the cyber kill chain or MITRE ATT&CK framework where an attacker attempts to remove evidence of their presence and activities. Modifying or deleting log files, clearing command histories, and using file-wiping utilities are all examples of covering tracks. The goal is to hinder or prevent a forensic investigation.
Why the other answers are wrong:
- A (Privilege escalation): This involves gaining higher-level permissions than initially obtained (e.g., moving from a standard user to an administrator). The scenario describes hiding activity, not elevating permissions.
- B (Persistence): This is the technique of maintaining access to a compromised system across reboots or credential changes, often by creating scheduled tasks, services, or registry keys.
- D (Pivoting): This is the technique of using a compromised system to attack other systems on the same internal network that are not directly accessible from the outside.
Question 6 A company has a policy that all sensitive data must be encrypted. A security auditor discovers that while the data is encrypted when stored on the company's servers and when transmitted over the network, it is processed in plaintext in the server's RAM. What is the BEST control to mitigate this vulnerability?
Correct Answer: C. Homomorphic EncryptionThis question tests your knowledge of advanced cryptographic concepts. Homomorphic encryption is a specialized form of encryption that allows computations to be performed on ciphertext, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext. It is the specific solution for protecting data while it is in use (i.e., being processed in memory).
- A (FDE): Full Disk Encryption protects data-at-rest. The vulnerability described is for data-in-use.
- B (TLS): Transport Layer Security protects data-in-transit. The vulnerability is for data-in-use.
- D (DLP): Data Loss Prevention is a set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users. It is a policy enforcement tool, not a specific cryptographic method for protecting data in RAM.
Question 7
During a code review, a security analyst finds the following line of pseudocode in a web application's search function:
query = "SELECT * FROM products WHERE name = '" + user_input + "';"
execute_sql(query)
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Which of the following vulnerabilities is present in this code?
Correct Answer: B. SQL injectionThe code is dynamically building a SQL query by directly concatenating raw user input (
user_input) into the query string. This is the classic recipe for a SQL injection vulnerability. An attacker could provide malicious input, such as' OR '1'='1, to alter the query's logic and bypass authentication or dump the entireproductstable.
Laptop as user_input, the query becomes:
SELECT * FROM products WHERE name = 'Laptop'; (This is fine)
But if an attacker enters ' OR '1'='1' -- as user_input, the query becomes:
SELECT * FROM products WHERE name = '' OR '1'='1' --';
The OR '1'='1' clause is always true, and the -- comments out the rest of the line, causing the database to return all products.
- A (Buffer overflow): This occurs when a program writes data beyond the boundary of a fixed-length buffer in memory. The code snippet deals with database query construction, not memory management.
- C (Directory traversal): This attack involves using
../sequences to access files and directories stored outside the web root folder. It targets the file system, not the database. - D (Command injection): This involves tricking an application into executing arbitrary commands on the host operating system. The vulnerability here is specific to SQL, not general OS commands.
Question 8 Which of the following is a type of malware that is delivered with a software application and installs itself without the user's full knowledge, but is not typically malicious in nature and is used to collect user data for marketing purposes?
Correct Answer: A. AdwareAdware is software that displays unwanted advertisements, often in the form of pop-ups. While it can be intrusive and sometimes bundled with spyware, its primary purpose is advertising and data collection for marketing, which fits the description of "not typically malicious in nature." It is often installed with legitimate software as part of the terms and conditions.
Why the other answers are wrong:
- B (Rootkit): A rootkit is explicitly malicious. Its purpose is to gain administrative-level control over a system while hiding its presence from the user and operating system.
- C (Logic bomb): This is a piece of malicious code that is programmed to execute when a certain condition is met (e.g., a specific date or an employee's termination). It is designed to cause harm.
- D (Keylogger): A keylogger records a user's keystrokes. This is a form of spyware and is malicious, as it is used to steal credentials, financial information, and other sensitive data.
Question 9 A company wants to assess its web application's vulnerability to the most common web-based attacks. Which of the following resources provides the MOST recognized and standard awareness document for this purpose?
Correct Answer: C. OWASP Top 10The Open Web Application Security Project (OWASP) Top 10 is a standard awareness document for developers and web application security professionals. It represents a broad consensus about the most critical security risks to web applications. When a question specifically mentions "web application" vulnerabilities and a "standard awareness document," OWASP Top 10 is almost always the answer.
Why the other answers are wrong:
- A (MITRE ATT&CK Framework): This is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It is much broader than just web applications and focuses on post-exploit adversary behavior.
- B (NIST CSF): This is a high-level, strategic framework for organizations to manage and reduce cybersecurity risk. It is not a technical list of specific web application vulnerabilities.
- D (ISO/IEC 27001): This is a formal standard for an Information Security Management System (ISMS). It specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS, but it does not list specific technical vulnerabilities.
Question 10 A security analyst uses a tool to send a large number of TCP SYN packets to a server from a spoofed IP address. The server responds with SYN-ACK packets to the spoofed address and waits for ACK packets that never arrive. This eventually exhausts the server's resources, making it unavailable to legitimate users. What type of attack has the analyst simulated?
Correct Answer: B. SYN floodThis is the classic definition of a SYN flood attack, a type of Denial-of-Service (DoS) attack. It exploits the three-way TCP handshake. By sending a flood of SYN requests and never completing the handshake with the final ACK, the attacker forces the server to keep connections in a half-open state, consuming resources until it can no longer accept new, legitimate connections.
Why the other answers are wrong:
- A (Smurf attack): This is a DDoS attack that uses spoofed ICMP echo requests (pings) sent to a network's broadcast address, causing all hosts on that network to reply to the victim's IP address. It uses ICMP, not TCP SYN packets.
- C (Teardrop attack): This involves sending fragmented IP packets that are designed to overlap, causing the target system to crash when it attempts to reassemble them.
- D (Ping of death): This is an older attack that involved sending a malformed or oversized ICMP packet to a target system, causing it to crash. Modern systems are patched against this.
How to Analyze Your Score (And What to Do Next)
Count your correct answers. This isn't about a number; it's about identifying patterns in your thinking.
- If you scored 0-4: Your focus should be on foundational definitions. You might be confusing a worm with a trojan, or a NIDS with a NIPS. Your first step is to solidify these core concepts. Don't just read definitions; write down the single key differentiator for each term. VoraPrep's FSRS spaced-repetition flashcards are built specifically for this kind of efficient memorization.
- If you scored 5-7: You likely know the definitions but are falling for the classic CompTIA traps. You might have picked "Phishing" over the more specific "Whaling." Your challenge is judgment, not knowledge. For every question you missed, ask: "What specific word in the question made the correct answer better than mine?" This is where an adaptive question bank is critical, as it forces you to practice these judgment calls repeatedly.
- If you scored 8-10: Excellent. You have a strong grasp of the concepts and can apply them. Your next step is to build speed and prepare for Performance-Based Questions (PBQs). PBQs require you to perform tasks in a simulated environment, like analyzing a log file. You can hone these skills in VoraPrep's 1:1 exam simulators, which replicate the real testing interface.
No matter your score, the path forward is consistent, targeted practice. Merely re-reading a textbook won't build the judgment skills needed to pass. For more, check out our full-length practice test covering all five domains.
The Complete System for Passing the SY0-701
If you found yourself hesitating or getting tricked by the distractors, that's a sign that you need more than just passive learning. VoraPrep is a complete, 6-pillar exam prep course designed to build expert-level judgment, contrasting sharply with overpriced, passive video-lecture bundles.
Our platform includes:
- Textbook-Grade Lessons: Clear, concise study guides that get straight to the point.
- Adaptive Practice Banks: A bank of over 1,500 questions that intelligently targets your weak areas.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real testing environment, including PBQs.
- Spaced-Repetition Flashcards: An FSRS system to help you memorize key terms, ports, and concepts efficiently.
- Personalized Study Plan: A dynamic calendar that tells you exactly what to study each day.
- Vory, Your 24/7 Tutor: Stuck on a question? Ask Vory for a step-by-step explanation without leaving the platform.
You can explore all our exam details and format breakdown on the official VoraPrep CompTIA Security+ page.