1. Home
2. All questions
3. Attacks

CompTIA Security+ study material: Attacks

68 questions of the 611 in the CompTIA Security+ quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 123. An attacker recovers disk encryption keys from memory after gaining brief physical possession of a laptop. Which CVSS Attack Vector value describes this?
2. 139. What is the underlying cause common to every injection flaw?
3. 140. Which technique is the primary defence against SQL injection, and why does it work?
4. 149. Why does a single encoding function not prevent all cross-site scripting?
5. 153. Why can a server not distinguish a cross-site request forgery from a legitimate request using cookies alone?
6. 156. An unauthenticated endpoint runs an expensive report generation on every call. What is the risk?
7. 162. An application fetches a URL supplied by the user to generate a link preview. Why is this dangerous?
8. 236. An attacker submits input containing newline characters that appear in the log as separate, forged entries. What is the defence?
9. 266. Which two authenticator types are classed as not phishing-resistant? Choose two.
10. 278. What does the AAL2 requirement for replay resistance prevent?
11. 280. Why does adding a security question to a password login not meaningfully improve resistance to credential stuffing?
12. 281. Why is a FIDO2 security key resistant to a convincing look-alike login page?
13. 282. An attacker with a valid password triggers repeated push approvals until the user taps accept. Which control most directly counters this?
14. 283. A login form replies "no such user" for unknown addresses and "incorrect password" for known ones. What does this enable?
15. 285. At which moment must an application regenerate the session identifier to prevent session fixation?
16. 293. An attacker captures a valid assertion from one relying party and presents it to a second. Which assertion property prevents this from working?
17. 305. Which user behaviour does a password manager most directly eliminate?
18. 350. A standard user reads another standard user's records. How is this escalation classified?
19. 385. An application tunnels its traffic over port 443 to avoid filtering. Which control identifies it anyway?
20. 395. An API adopts TLS 1.3 zero-round-trip resumption for speed. Which request must not be sent as early data?
21. 397. Which mechanism closes the window opened by a user typing a bare hostname and being redirected from HTTP to HTTPS?
22. 413. Which weakness of WPA2 personal did WPA3 address by replacing the handshake?
23. 414. An administrator disables broadcast of the wireless network name as a security measure. Why is this ineffective?
24. 424. Why does MITRE catalogue Valid Accounts as a technique in its own right?
25. 434. Why does generic awareness messaging fail against spear phishing?
26. 436. An attacker compromises an industry news site frequently read by employees of one company. Which technique is this?
27. 437. An attacker registers a domain differing from a bank's by one transposed letter. What is this technique, and what does it exploit?
28. 456. An attacker tries the password "Autumn2026!" against several thousand accounts, one attempt each. Which attack is this, and why does it work?
29. 457. Which user behaviour makes credential stuffing effective?
30. 458. An attacker steals a password hash file. Why does the login endpoint's rate limiting no longer help?
31. 459. Which defence makes rainbow tables useless against a stolen password database?
32. 460. Why is SHA-256 unsuitable for storing passwords even when salted?
33. 461. A team pre-hashes passwords with plain SHA-512 before passing them to bcrypt. Which attack does this enable?
34. 462. An attacker captures an authentication exchange on the network and replays it later to log in. Which property would have prevented this?
35. 463. How does session hijacking differ from credential theft?
36. 464. What does cross-site scripting give the attacker access to?
37. 465. Which variant of cross-site scripting affects every user who views a page, without any of them clicking a crafted link?
38. 466. A security review of server responses finds no injected script, yet cross-site scripting still occurs. Which variant is most likely?
39. 467. What is the most serious outcome of SQL injection when the database account is over-privileged?
40. 468. An application returns identical responses regardless of the injected condition, but responses take longer when the condition is true. What does this indicate?
41. 469. A request for a report filename returns the contents of a system configuration file elsewhere on disk. Which attack is this?
42. 470. An application passes user input into a shell command. What is the most reliable fix?
43. 471. An XML parser resolves an external entity supplied by the user and returns a local file's contents. Which configuration change prevents this?
44. 472. Why does process injection frustrate detection tools that judge activity by process name?
45. 473. An adversary creates a scheduled task that runs their payload at every boot. Which ATT&CK tactic does this serve?
46. 474. Malicious code lies dormant in an application until a specific date, then deletes records. What is this called?
47. 475. Why should a suspected rootkit infection not be investigated using tools running on the affected host?
48. 476. Why does a trojan need no software vulnerability to succeed?
49. 477. Which malware property makes patching internet-facing services more urgent than patching desktops?
50. 478. Why does fileless malware evade a product that scans files on disk?
51. 479. A keylogger is installed on a user's workstation. Which control most directly limits the damage?
52. 480. Why does blocking by source address fail against a distributed denial-of-service attack?
53. 481. An attacker sends small spoofed requests to a service that replies with much larger responses aimed at the victim. What is this technique?
54. 482. A user reaches an attacker's server while the address bar still shows the expected domain name. Which manipulation explains this?
55. 483. How does an attacker take an on-path position inside a local network segment?
56. 484. An attacker sets up an access point broadcasting the same network name as the corporate wireless. Why is this effective?
57. 485. What are the two uses of a wireless deauthentication attack?
58. 486. Why is disabling old TLS versions on the server necessary rather than merely deprioritising them?
59. 487. Which property of a hash function does a birthday attack exploit?
60. 488. A collision is found in the hash function underlying a signature scheme. What has been broken, even though no key was compromised?
61. 489. An attacker recovers a key by measuring how long cryptographic operations take. What class of attack is this?
62. 490. An attacker abuses a legitimate elevation mechanism rather than exploiting a software flaw. How does MITRE classify this?
63. 491. After gaining access, an adversary adds an SSH key and a group membership to the compromised account. Which technique is this, and what does it achieve?
64. 492. During an incident, defenders find their own administrative accounts have been disabled. Which ATT&CK tactic does this serve?
65. 493. A flaw is being exploited and no patch exists. What is the appropriate response posture?
66. 515. Why should logs be forwarded off the host promptly?
67. 554. What does key stretching achieve against an offline attacker?
68. 560. An attacker steals a table of salted password hashes. What can they do with it directly?