CompTIA Security+ Threats, Vulnerabilities, and Mitigations Syllabus

What psychological principles do social engineers exploit?

Authority, intimidation, consensus/social proof, scarcity, urgency, familiarity/liking, and trust.

What is typosquatting?

Registering misspelled versions of legitimate domain names to capture traffic from users who make typos, often for phishing or malware delivery.

What is a business email compromise (BEC)?

An attack where a threat actor impersonates a trusted executive or partner via email to trick employees into transferring funds or sensitive data.

What is a memory injection vulnerability?

A flaw allowing an attacker to insert malicious code into a running process's memory space to execute it with that process's privileges.

What is a buffer overflow?

An attack that writes more data to a buffer than it can hold, overwriting adjacent memory to crash the system or execute arbitrary code.

What is a race condition (TOCTOU) vulnerability?

A flaw where the result depends on the timing of events; Time-of-Check to Time-of-Use occurs when a resource changes between when it is checked and when it is used.

What is SQL injection (SQLi)?

A web attack inserting malicious SQL statements into input fields to manipulate, read, or destroy the backend database.

What is cross-site scripting (XSS)?

A web vulnerability where an attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser.

Differentiate reflected, stored, and DOM-based XSS.

Reflected XSS bounces the script off a server in a response; stored XSS persists the script on the server; DOM-based XSS executes via client-side script modifying the page DOM.

What is cross-site request forgery (CSRF/XSRF)?

An attack that tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in, performing actions without consent.

What is privilege escalation?

Exploiting a flaw to gain elevated access rights beyond what was originally granted; vertical raises privilege level, horizontal accesses peer accounts.

What is a zero-day vulnerability?

A previously unknown flaw with no available patch, leaving systems exposed until the vendor releases a fix.

What is firmware vulnerability and why is it dangerous?

A flaw in low-level device software (firmware); it is dangerous because firmware runs below the OS, persists across reinstalls, and is hard to detect or patch.

What is an end-of-life (EOL) or legacy system vulnerability?

Risk from systems no longer supported by vendors, meaning no security patches are issued for newly discovered flaws.

What is VM escape?

An attack where a threat actor breaks out of a virtual machine to access the host hypervisor or other VMs running on it.

What is VM sprawl?

The uncontrolled proliferation of virtual machines that become unmanaged and unpatched, expanding the attack surface.

What are common cloud-specific vulnerabilities?

Misconfigurations, insecure APIs, inadequate identity/access management, insufficient logging, and improperly secured storage buckets.

What is a cryptographic vulnerability from weak or deprecated algorithms?

Using outdated ciphers (e.g., DES, MD5, SHA-1) or short keys that are computationally feasible to break, compromising confidentiality or integrity.

What is sideloading on mobile devices and its risk?

Installing apps from outside official app stores, bypassing vetting and increasing the risk of installing malware.

What is jailbreaking/rooting and why is it a vulnerability?

Removing manufacturer restrictions to gain root access; it disables built-in security controls and exposes the device to malware and exploits.

What is a logic bomb?

Malicious code that lies dormant until triggered by a specific condition, date, or event, then executes its payload.

Differentiate a virus from a worm.

A virus requires a host file and user action to spread; a worm is self-replicating and spreads across networks automatically without user interaction.

What is a Trojan horse?

Malware disguised as legitimate software that performs hidden malicious actions once installed by the user.

What is a rootkit and what makes it dangerous?

Malware that gains privileged (root) access and hides its presence, often operating at the kernel level to evade detection.

What is ransomware?

Malware that encrypts a victim's data or locks systems, demanding payment (ransom) for restoration or to prevent data leakage.

What is a keylogger?

Software or hardware that records a user's keystrokes to capture passwords, messages, and other sensitive input.

What is a distributed denial-of-service (DDoS) attack?

Overwhelming a target system or network with traffic from many compromised sources (a botnet) to make it unavailable to legitimate users.

What is an on-path (man-in-the-middle) attack?

An attacker secretly intercepts and possibly alters communication between two parties who believe they are communicating directly.

Differentiate a brute-force attack from a dictionary attack.

A brute-force attack tries every possible character combination; a dictionary attack uses a precompiled list of likely passwords/words.

What is a birthday attack?

A cryptographic attack exploiting the probability math behind hash collisions, finding two inputs that produce the same hash output.

What is salting and how does it defend against password attacks?

Adding random data to a password before hashing so identical passwords yield different hashes, defeating precomputed rainbow tables.

What is a rainbow table attack?

Using precomputed tables of hash values to quickly reverse password hashes back to plaintext; mitigated by salting.

What are Indicators of Compromise (IoCs)?

Forensic evidence that a breach has occurred, such as unusual outbound traffic, account lockouts, impossible travel logins, malicious file hashes, or unexpected changes.

Give examples of common Indicators of Compromise.

Account lockouts, concurrent/impossible-travel session usage, blocked content, resource consumption spikes, missing logs, published/leaked data, and unusual outbound traffic.

What is network segmentation and how does it mitigate threats?

Dividing a network into isolated zones (e.g., via VLANs) to limit lateral movement and contain breaches within a segment.

What is the principle of least privilege?

Granting users and processes only the minimum access rights necessary to perform their function, reducing the attack surface.

What is application allow listing (whitelisting)?

A security control that permits only explicitly approved applications to run, blocking all others by default.

Compare application allow listing with deny listing (blocklisting).

Allow listing blocks everything except approved apps (default-deny, more secure); deny listing allows everything except known-bad apps (default-allow, less secure).

What is application sandboxing/isolation?

Running an application in a restricted, isolated environment so it cannot affect other processes or the host system if compromised.

What are common system hardening targets?

Servers, workstations, mobile devices, network appliances (switches/routers), cloud infrastructure, IoT/embedded devices, and ICS/SCADA systems.

What does system hardening involve?

Reducing the attack surface by disabling unnecessary services/ports, removing default accounts, applying patches, configuring secure settings, and enforcing least privilege.

What is the role of patch management in hardening?

Regularly applying vendor updates to fix known vulnerabilities before attackers can exploit them.

What is host-based endpoint protection used in hardening?

Software like host-based firewalls, HIDS/HIPS, antivirus/EDR, and disk encryption that protects individual devices from threats.

What is the purpose of disabling unused ports and services during hardening?

It removes potential entry points, shrinking the attack surface available to threat actors.

What is a default credential vulnerability and how is it mitigated?

Using factory-set usernames/passwords that attackers know; mitigated by changing all default credentials immediately upon deployment.