CompTIA Security+ Threats Attacks and Vulnerabilities

By Jordan Blake · Updated May 25, 2026

Questions23
Passing Score75%
Format65% Multiple Choice
Sessions Logged1,597
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.6 (21)

Topics covered

This quiz

Uncategorized23 (100%)

Uncategorized23 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

Which THREE techniques are commonly used in a password attack?

Answer choices

  • A. Brute force (trying all possible combinations)

  • B. Dictionary attack (using wordlists of common passwords)

  • C. Credential stuffing (using breached username/password pairs on other sites)

  • D. VLAN hopping (manipulating 802.1Q tags)

  • E. DNS poisoning (inserting fake DNS records)

Question 2

An attacker finds a web application that reflects user input directly back in the HTTP response without encoding. The attacker hosts a malicious link that embeds `<script>alert(document.cookie)</script>` in a URL parameter. Which XSS type is this?

Answer choices

  • A. Stored (Persistent) XSS

  • B. Reflected (Non-Persistent) XSS

  • C. DOM-Based XSS

  • D. Blind XSS

Question 3

Which TWO techniques are used in a pass-the-hash (PtH) attack?

Answer choices

  • A. The attacker needs the plaintext password to conduct the attack

  • B. The attacker captures an NTLM password hash and uses it directly for authentication without cracking it

  • C. PtH attacks exploit Windows NTLM authentication's ability to accept password hashes as authentication proof

  • D. PtH is only effective against accounts with no password

  • E. PtH attacks require the attacker to be on a different network segment than the victim

Question 4

A penetration tester is hired by a company and given no prior information about the target environment. What type of engagement is this?

Answer choices

  • A. White-box testing

  • B. Gray-box testing

  • C. Black-box testing

  • D. Red team exercise

Question 5

An organization conducts a threat intelligence exercise and classifies a threat actor as having high sophistication, significant financial resources, and nation-state backing. Which threat actor category BEST describes this?

Answer choices

  • A. Script kiddie

  • B. Hacktivist

  • C. APT (Advanced Persistent Threat)

  • D. Insider threat