Skip to content

Menu

ExamPassoLog in

CompTIA Security+ Threats, Vulnerabilities, and Mitigations Summary

Checked 10/29/26

Threats, Vulnerabilities, and Mitigations: key points

  • Phishing is email; vishing is voice; smishing is text message.
  • Ransomware encrypts files and demands payment.
Importance
★★★★☆ (4 / 5)
Weight
About 20 of 90 Security+ (SY0-701) questions (22%)

Threat actors and motivations, threat vectors and social engineering, application and system vulnerabilities, indicators of malware, password, application, network, and cryptographic attacks, and mitigation techniques such as segmentation, patching, and hardening.

📖 See more Threats, Vulnerabilities, and Mitigations concepts →

Threats, Vulnerabilities, and Mitigations: 10 sample questions

Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 1. An attacker calls an employee pretending to be from the help desk and asks for the employee's password. What is this attack called?

  1. ① Whaling
  2. ② Smishing
  3. ③ Vishing
  4. ④ Phishing
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Vishing

Key point: Voice call trick = vishing

Vishing (voice phishing) uses phone calls to trick people into giving up information. Smishing uses text messages, and phishing usually uses email.

Wrong choices

  • Smishing: Smishing uses text (SMS) messages.
  • Phishing: Phishing usually means fake emails or websites.
  • Whaling: Whaling targets senior executives, usually by email.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 2. A text message says a package is waiting and asks the user to click a link and enter card details. What is this?

  1. ① Watering hole attack
  2. ② Tailgating
  3. ③ Smishing
  4. ④ Vishing
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Smishing

Key point: Text message phishing = smishing

Smishing is phishing by SMS text message. It often uses fake delivery or bank alerts with a link.

Wrong choices

  • Vishing: Vishing uses voice calls.
  • Tailgating: Tailgating is following someone through a secure door.
  • Watering hole attack: A watering hole attack infects a website the targets often visit.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 3. Someone without a badge follows an employee closely through a secured door before it closes. What is this called?

  1. ① Tailgating
  2. ② Shoulder surfing
  3. ③ Impersonation
  4. ④ Dumpster diving
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ① Tailgating

Key point: Following someone through a door = tailgating

Tailgating (piggybacking) is getting into a secure area by following an authorized person. Access control vestibules (mantraps) and guards help stop it.

Wrong choices

  • Shoulder surfing: Shoulder surfing is watching someone's screen or keyboard.
  • Dumpster diving: Dumpster diving is searching trash for information.
  • Impersonation: Impersonation is pretending to be someone else; the act described is following through a door.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 4. Which type of malware encrypts a victim's files and demands payment for the key?

  1. ① Rootkit
  2. ② Spyware
  3. ③ Ransomware
  4. ④ Adware
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Ransomware

Key point: Encrypt files + demand payment = ransomware

Ransomware encrypts files or locks systems and demands a ransom. Good offline backups are the most important defense.

Wrong choices

  • Spyware: Spyware secretly collects information.
  • Adware: Adware shows unwanted ads.
  • Rootkit: A rootkit hides deep in the system to keep hidden access.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 5. Which malware spreads by itself across a network without any user action?

  1. ① Keylogger
  2. ② Trojan
  3. ③ Virus
  4. ④ Worm
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ④ Worm

Key point: Self-spreading over the network = worm

A worm copies itself from system to system over the network without user help. A virus needs a host file and usually a user action.

Wrong choices

  • Virus: A virus needs a user or host program to run before it spreads.
  • Trojan: A Trojan pretends to be useful software and needs the user to run it.
  • Keylogger: A keylogger records keystrokes; it does not spread by itself.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 6. An attacker tries one common password, such as "Spring2026!", against many different user accounts. What is this attack?

  1. ① Password spraying
  2. ② Dictionary attack against one account
  3. ③ Pass-the-hash
  4. ④ Brute force against one account
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ① Password spraying

Key point: One password, many accounts = password spraying

Password spraying tries a few common passwords across many accounts. It avoids lockouts that happen when many passwords are tried on one account.

Wrong choices

  • Brute force against one account: Brute force tries many passwords against one account.
  • Dictionary attack against one account: A dictionary attack tries many listed words, usually on one account.
  • Pass-the-hash: Pass-the-hash reuses a stolen password hash.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 7. Many compromised computers send traffic to one website at the same time so real users cannot reach it. What is this attack?

  1. ① On-path attack
  2. ② DNS zone transfer
  3. ③ Phishing
  4. ④ Distributed denial-of-service (DDoS)
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ④ Distributed denial-of-service (DDoS)

Key point: Many systems flood one target = DDoS

A DDoS attack uses many systems, often a botnet, to overwhelm a target so it is unavailable. It attacks availability.

Wrong choices

  • On-path attack: An on-path attack intercepts traffic; it does not flood a site.
  • Phishing: Phishing tricks users; it does not flood a server.
  • DNS zone transfer: A zone transfer copies DNS records; it is not a flood.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 8. Which threat actor is usually most motivated by money, such as through ransomware or fraud?

  1. ① Nation-state
  2. ② Hacktivist
  3. ③ Organized crime
  4. ④ Unskilled attacker
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Organized crime

Key point: Money motive = organized crime

Organized crime groups mainly want financial gain. Hacktivists want to promote a cause, and nation-states mostly seek espionage or strategic advantage.

Wrong choices

  • Hacktivist: Hacktivists are mainly driven by political or social causes.
  • Nation-state: Nation-states usually seek espionage or strategic goals.
  • Unskilled attacker: Unskilled attackers often act for fun or attention and use ready-made tools.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 9. A flaw that attackers exploit before the vendor knows about it or has released a patch is called a:

  1. ① Misconfiguration
  2. ② Legacy vulnerability
  3. ③ Zero-day vulnerability
  4. ④ False positive
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Zero-day vulnerability

Key point: Unknown, unpatched flaw = zero-day

A zero-day vulnerability is unknown to the vendor or has no patch yet, so defenders have had zero days to fix it.

Wrong choices

  • Legacy vulnerability: Legacy systems are old systems; the term does not mean the flaw is unknown.
  • Misconfiguration: A misconfiguration is a setup mistake, not an unknown software flaw.
  • False positive: A false positive is an alert for something that is not actually a problem.
Practice questionReviewedSecurity+ (SY0-701) › Threats, Vulnerabilities, and Mitigations★★★★☆

Question 10. A user downloads a free game that also secretly installs a backdoor. What type of malware is this?

  1. ① Worm
  2. ② Trojan
  3. ③ Logic bomb
  4. ④ Ransomware
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ② Trojan

Key point: Looks useful, hides malicious code = Trojan

A Trojan looks like legitimate software but carries hidden malicious code, such as a remote access backdoor.

Wrong choices

  • Worm: A worm spreads by itself; this one came hidden inside a program the user chose to install.
  • Logic bomb: A logic bomb waits for a trigger condition such as a date.
  • Ransomware: Ransomware encrypts files for payment.

Test yourself.

Threats, Vulnerabilities, and Mitigations: 5 questions →Security+ (SY0-701): 5 questions →

Written by AI · Not yet reviewed by staff