1. Home
2. All questions
3. Vulnerabilities

CompTIA Security+ study material: Vulnerabilities

117 questions of the 611 in the CompTIA Security+ quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 28. A vendor will not patch a flaw in a product the organisation uses. Which two of the following are recognised risk responses in this situation? Choose two.
2. 43. A manager reports to the board that a vulnerability scan "proved the systems can be breached". Why is that claim unsupported?
3. 54. A team uses a vulnerability's CVSS score directly as its risk rating. Which factor does CVSS deliberately exclude that they must add themselves?
4. 55. A vulnerability's base score is taken straight from a public feed and used to rank remediation. What assumption is being carried in unexamined?
5. 56. A report labels a score CVSS-BTE. What does the label tell the reader?
6. 57. Two flaws both score 8.8. One appears in the Known Exploited Vulnerabilities catalog. Which should be remediated first and why?
7. 58. Which two conditions must be met before a vulnerability is added to the Known Exploited Vulnerabilities catalog? Choose two.
8. 85. A batch of network cards turns out to be counterfeit, though no malicious code is present. Why is this still a supply chain security issue?
9. 86. A critical flaw is announced in a widely used logging library. Which artefact turns finding affected products from a research project into a lookup?
10. 106. A flaw the organisation has been carrying quietly for months is published in a security advisory. What changes about the risk?
11. 107. Which response to a software vulnerability removes it outright without also removing functionality?
12. 108. An unused reporting service on a server has an unpatched critical flaw. The business confirms nobody uses it. Which response is avoidance?
13. 109. A critical flaw is found in an application whose vendor ended support two years ago. Why is this different from a normal unpatched finding?
14. 110. A hospital's imaging system vendor requires that updates be applied only on its certified schedule. An engineer wants to patch immediately. What is the risk of doing so?
15. 111. An upgrade would fix a vulnerability, but the new version's cryptographic modules are not yet FIPS-validated and the organisation must use validated modules. What does this illustrate?
16. 112. Where does the vulnerability management lifecycle begin?
17. 113. A team installs a patch and immediately closes the finding. Which lifecycle step have they skipped?
18. 114. Which two activities belong to the prepare phase of executing a patch response? Choose two.
19. 115. An organisation treats every patch cycle as an emergency and never plans capacity for it. Which framing does NIST recommend instead?
20. 116. An enterprise patch strategy currently covers only servers and workstations. Which two asset classes must also be included? Choose two.
21. 117. A legacy control system cannot be patched and cannot be replaced this year. What does NIST expect the organisation to produce for it?
22. 118. A flaw is being exploited in the wild and no patch exists yet. According to NIST's patch planning guidance, how should the organisation treat this?
23. 119. Which two of the following are metric groups in CVSS v4.0? Choose two.
24. 120. Which CVSS metric group changes as proof-of-concept exploit code becomes publicly available?
25. 121. Which CVSS Attack Vector value produces the highest severity contribution?
26. 122. A flaw can only be triggered by a device on the same Wi-Fi network or local IP subnet. Which CVSS Attack Vector value applies?
27. 123. An attacker recovers disk encryption keys from memory after gaining brief physical possession of a laptop. Which CVSS Attack Vector value describes this?
28. 124. An exploit succeeds repeatably against any instance of a product with no target-specific work. What Attack Complexity value should it receive?
29. 125. Exploiting a flaw requires the attacker to win a race condition. In CVSS v4.0, which metric captures this?
30. 126. A device ships with the same default administrator password across every unit, and it is rarely changed. How should Privileges Required be scored?
31. 127. A stored cross-site scripting flaw fires when the victim simply views a page. Which CVSS v4.0 User Interaction value fits?
32. 128. What did CVSS v4.0 replace the older Scope metric with?
33. 129. An analyst wants to lower a base score because the flaw was found through a difficult internal audit rather than being publicly known. Why is this wrong?
34. 130. An organisation has a custom firewall rule that blocks the only path to a vulnerable service. Where should that be reflected in CVSS?
35. 131. Who is best placed to supply the Environmental metric values for a vulnerability?
36. 132. Why does FIRST require a CVSS vector string to be published alongside the numeric score?
37. 133. A report references both CWE-89 and CVE-2024-XXXX for the same finding. What is the difference between the two identifiers?
38. 134. A patch compliance report built from unauthenticated scans shows far fewer missing patches than the software inventory suggests. What is the likely cause?
39. 135. Which scan type best measures what an outside attacker would see of an organisation's internet-facing estate?
40. 136. A team must assess a fragile industrial network without risking an outage. Which technique fits?
41. 137. An organisation scans only the hosts in its asset inventory. What kind of exposure does this method structurally miss?
42. 138. Which activity separates a scanner finding from a confirmed vulnerability?
43. 139. What is the underlying cause common to every injection flaw?
44. 140. Which technique is the primary defence against SQL injection, and why does it work?
45. 141. A team moves all queries into stored procedures and declares SQL injection solved. Under what condition is that claim wrong?
46. 142. A report lets the user choose which column to sort by, and the column name goes into the query. Parameters cannot bind an identifier. What is the correct defence?
47. 143. An application's database account is granted read access only to the two tables it needs. What does this achieve against SQL injection?
48. 144. Which validation strategy does OWASP recommend, and why?
49. 145. A developer removes server-side validation because the form already validates in the browser. What is the flaw in this reasoning?
50. 146. Why should input be canonicalised before it is validated?
51. 147. A team validates all input strictly and concludes that output encoding is unnecessary. Why is that wrong?
52. 148. Which two controls should be applied to a user file upload feature? Choose two.
53. 149. Why does a single encoding function not prevent all cross-site scripting?
54. 150. A developer wants to insert a user-supplied value directly inside a script block, encoded carefully. What is OWASP's guidance?
55. 151. What role does a Content Security Policy play in defending against cross-site scripting?
56. 152. An application built on a modern framework has a stored cross-site scripting flaw. What is the most likely cause?
57. 153. Why can a server not distinguish a cross-site request forgery from a legitimate request using cookies alone?
58. 154. Why does a synchroniser token defeat cross-site request forgery?
59. 155. A team sets SameSite on its session cookie and removes its CSRF tokens. What is OWASP's position on this?
60. 156. An unauthenticated endpoint runs an expensive report generation on every call. What is the risk?
61. 157. Which two application controls most directly limit denial-of-service exposure? Choose two.
62. 158. An administrator raises the password hashing work factor until each login takes three seconds. What new risk has been introduced?
63. 159. Which two findings fall under security misconfiguration? Choose two.
64. 160. A production application returns full stack traces including framework versions when an error occurs. Beyond untidiness, what does this give an attacker?
65. 161. Why do vulnerable and outdated components form a category distinct from the rest of the OWASP Top Ten?
66. 162. An application fetches a URL supplied by the user to generate a link preview. Why is this dangerous?
67. 163. An application turns attacker-controlled data directly into live objects. Which flaw class is this, and what is the worst case?
68. 164. Which two defences remove the buffer overflow class rather than mitigating individual instances?
69. 165. A program checks that a file is owned by the user, then opens it. An attacker replaces the file between the two steps. Which flaw is this?
70. 166. Which virtualisation weakness would affect every tenant sharing a host?
71. 167. Which two weaknesses account for most cloud security incidents? Choose two.
72. 168. A user installs an application from outside the vetted app store onto a corporate phone. What is the primary weakness this creates?
73. 169. Which two are hardware or firmware weaknesses rather than software ones? Choose two.
74. 170. Why do supply chain vulnerabilities defeat controls aimed at untrusted input?
75. 171. What does hardening a system primarily achieve?
76. 172. Systems are built to a hardened baseline but drift out of compliance within weeks. Which control addresses this?
77. 173. A critical flaw is disclosed and the vendor patch is two weeks away. The team deploys a rule at the application gateway that blocks the exploit pattern. What is this called?
78. 174. Which step confirms that a deployed patch actually removed the vulnerability?
79. 175. A patching programme reports the number of patches installed each month. Why is this a weak enterprise-level metric?
80. 176. How does an organisation learn that a library it depends on has become vulnerable?
81. 177. Why are logging and monitoring failures serious even though they rarely cause the breach?
82. 178. A flaw is found that no amount of correct implementation would have prevented. Which category does it fall into, and what practice addresses it?
83. 179. A team patches every critical-severity finding first, regardless of whether the affected service is reachable. What is the problem with this policy?
84. 180. The same coding flaw exists in two code paths, one reachable from the internet and one that is dead code. Why do they carry different risk?
85. 348. An application hides the delete button from non-administrators but the delete endpoint performs no check. What is wrong?
86. 349. Changing the invoice number in a URL shows another customer's invoice. What is this flaw called?
87. 379. Which two properties make Internet-of-Things devices difficult to secure? Choose two.
88. 386. Which device can block a SQL injection attempt inside an otherwise permitted HTTPS session?
89. 418. A patch programme covers operating systems and applications but not firmware. What is the consequence?
90. 453. Beyond a remediation list, what does the Known Exploited Vulnerabilities catalog tell a defender?
91. 464. What does cross-site scripting give the attacker access to?
92. 465. Which variant of cross-site scripting affects every user who views a page, without any of them clicking a crafted link?
93. 466. A security review of server responses finds no injected script, yet cross-site scripting still occurs. Which variant is most likely?
94. 467. What is the most serious outcome of SQL injection when the database account is over-privileged?
95. 468. An application returns identical responses regardless of the injected condition, but responses take longer when the condition is true. What does this indicate?
96. 469. A request for a report filename returns the contents of a system configuration file elsewhere on disk. Which attack is this?
97. 470. An application passes user input into a shell command. What is the most reliable fix?
98. 471. An XML parser resolves an external entity supplied by the user and returns a local file's contents. Which configuration change prevents this?
99. 477. Which malware property makes patching internet-facing services more urgent than patching desktops?
100. 493. A flaw is being exploited and no patch exists. What is the appropriate response posture?
101. 528. Which sequence describes the vulnerability management cycle the exam expects?
102. 536. An application uses bcrypt and accepts passwords of any length. What must it also enforce?
103. 566. Why can a medium-severity vulnerability legitimately outrank a high-severity one in a remediation queue?
104. 576. An organisation has taken no explicit decision about a vulnerability it does not yet know exists. Which risk response is it implicitly taking?
105. 577. What is the range of a CVSS score, and which metric group produces it before any refinement?
106. 578. A flaw is exploitable only when a non-default option is enabled. How should the Base metrics be scored?
107. 579. A scanner is tuned aggressively to reduce noise and now misses several real weaknesses. Which measure has worsened?
108. 580. What does port and service identification contribute to a vulnerability assessment?
109. 581. Where does escaping input sit among OWASP's SQL injection defences?
110. 582. A team adds CSRF tokens to every endpoint, including read-only ones. What is the effect?
111. 583. Which two of the following does the exam list among its mitigation techniques? Choose two.
112. 584. What must a remediation report state beyond the list of findings?
113. 585. A device cannot follow the standard patching plan. What keeps it visible and owned?
114. 586. Why does OWASP treat storing unnecessary sensitive data as a vulnerability in itself?
115. 587. Which two are identification and authentication failures? Choose two.
116. 588. An application loads a plugin from an unverified source at runtime. Which OWASP category does this fall under?
117. 600. What does the reporting step of the vulnerability management cycle achieve?