SY0-701 · CompTIA · Threats, Vulnerabilities, and Mitigations · Bank updated 2026-09-20
SY0-701 practice questions: Threats, Vulnerabilities, and Mitigations
5 free questions from 15 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Threats, Vulnerabilities, and Mitigations section of our SY0-701 bank (15 questions on this area, which carries 22% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
1/5 · Threats, Vulnerabilities, and Mitigations
A server is rebuilt after an intrusion: the disks are wiped and repartitioned, the operating system is reinstalled from the vendor's media, and every credential the server used is changed. Within a fortnight the same outbound connection to the attacker's infrastructure reappears, and a capture shows it opening before the operating system has finished starting. Which exposure BEST explains the return?
AImplanted firmware on the server
BA backdoor account in the directory
CA scheduled task left on the disks
DA tampered image on the build server
Show answer & explanation
A is correct. Objective 2.3 lists firmware alongside end-of-life and legacy under hardware vulnerabilities. NIST SP 800-193 describes platform firmware as highly privileged, necessary for the system to operate and persistent across power cycles because it is held in non-volatile memory, and warns that sophisticated attacks may inject persistent malware into that firmware to modify low-level services, exfiltrate data or otherwise affect the security posture of the system. The practical consequence is the one this item turns on: wiping, repartitioning, reinstalling and rotating credentials all operate above the layer where such an implant lives, so the only signal a responder gets is behaviour that begins before the operating system does.
↗ CompTIA Security+ SY0-701 Exam Objectives - Domain 2: Threats, Vulnerabilities, and Mitigations
2/5 · Threats, Vulnerabilities, and Mitigations
An analyst reviews authentication logs from a single source address:
02:41:03 FAIL user=a.novak reason=bad_password
02:41:05 FAIL user=b.olsen reason=bad_password
02:41:07 FAIL user=c.pereira reason=bad_password
02:41:09 FAIL user=d.quinn reason=bad_password
... 780 further entries, each a different account ...
03:02:54 SUCCESS user=r.walsh
Every account appears exactly once, no account reached its lockout threshold, and the attempt pattern repeats the following night. Which attack does this MOST likely indicate?
ACredential replay
BBrute force on one account
CA birthday attack
DPassword spraying
Show answer & explanation
D is correct. Objective 2.4 separates spraying from brute force under password attacks. MITRE ATT&CK T1110.003 describes password spraying as using a single or small list of commonly used passwords against many different accounts, specifically to avoid the account lockouts that brute forcing one account would trigger - and names a high volume of failures across many accounts as the detection signal.
↗ CompTIA Security+ SY0-701 Exam Objectives - Domain 2: Threats, Vulnerabilities, and Mitigations
3/5 · Threats, Vulnerabilities, and Mitigations
Finance workstations are repeatedly infected by small executables that arrive as email attachments and are written into the user's profile folder. Each sample is compiled shortly before it is sent, and the team has three samples from this month running in the user context. The build for these workstations is managed centrally and new software goes through a change process before it is added. The team must stop the next sample from executing at all. Which mitigation BEST achieves that?
AA host-based intrusion prevention agent
BAn application allow list on the workstations
CRemoval of local administrator rights
DMore frequent antivirus signature updates
Show answer & explanation
B is correct. Objective 2.5 lists application allow list as a mitigation in its own right, separately from patching, least privilege, monitoring and the hardening techniques that include endpoint protection and host-based intrusion prevention. The item turns on when each control makes its decision. Signatures and behavioural agents decide about code that is already present or already executing, so both need prior knowledge or a window in which the code runs; an allow list inverts the default so unapproved code is never started. NIST SP 800-53 Rev. 5 control CM-7, Least Functionality, describes the same stance - configure a system to provide only essential capabilities and restrict the software permitted to execute.
↗ CompTIA Security+ SY0-701 Exam Objectives - Domain 2: Threats, Vulnerabilities, and Mitigations
4/5 · Threats, Vulnerabilities, and Mitigations · hard
An aerospace supplier reconstructs a 14-month intrusion. The operators worked with a commercially licensed remote administration product and a rented traffic-obfuscation service, and the investigators found no component written for this environment. Four months in, the foothold passed to a second set of operators working from a different country, who staged both engineering drawings and the payroll database. Forum posts recovered during the investigation advertise access to the supplier's network during the week of that handover. Which threat actor profile BEST fits the first group?
AA nation-state actor with a collection tasking
BA hacktivist collective with a public cause
CAn organized crime group operating externally
DAn unskilled attacker using public tooling
Show answer & explanation
C is correct. Objective 2.1 pairs each threat actor with attributes - internal or external, resources and funding, level of sophistication and capability - and with motivations including financial gain, espionage and political belief. Dwell time and discipline are not attributes of a particular actor, which is where the usual reading goes wrong: many actors are patient. The attributes that do discriminate here are capability, which was entirely bought rather than built, and motivation, which shows itself when the access is transferred for payment instead of exploited to the end by the group that gained it.
↗ CompTIA Security+ SY0-701 Exam Objectives - Domain 2: Threats, Vulnerabilities, and Mitigations
5/5 · Threats, Vulnerabilities, and Mitigations · hard
A reporting utility that runs with elevated privileges verifies that a temporary file in a world-writable directory belongs to the user who invoked it, and then opens that same path for writing. A local user runs the utility in a loop while a second process repeatedly replaces the path with a symbolic link pointing at a system configuration file. After several hundred iterations the configuration file is overwritten with report output. Which weakness did the attacker exploit?
AA race condition
BA buffer overflow
CMemory injection
DA malicious update
Show answer & explanation
A is correct. Objective 2.3 lists race conditions under application vulnerabilities and names the time-of-check and time-of-use halves explicitly. CWE-367 describes the weakness as checking the state of a resource before using it when that state can change between the check and the use in a way that invalidates the check - with symbolic link substitution as the classic exploitation path.
↗ CompTIA Security+ SY0-701 Exam Objectives - Domain 2: Threats, Vulnerabilities, and Mitigations
Other SY0-701 areas
The same kind of free sample for every other section of the SY0-701 bank:
Study Threats, Vulnerabilities, and Mitigations with instant feedback
6 free questions · filter study mode by area and difficulty · error log with spaced repetition · no card, no dumps, no ads.
Create your free account →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by CompTIA. SY0-701 and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official CompTIA materials (as of September 2026); always confirm current details with the vendor before booking.