Threats, Vulnerabilities, and Mitigations
Free CompTIA Security+ (SY0-701) practice — 6 questions on Threats, Vulnerabilities, and Mitigations, with explanations. No sign-up. Full 12-question mixed test →
A developer writes code that checks whether a file exists and is owned by the requesting user, then opens that file for writing in a separate subsequent operation. A local attacker replaces the file with a symbolic link to /etc/shadow between the check and the open call, causing the privileged process to overwrite the system password file. Which vulnerability class does this describe?
TOCTOU race conditions occur when a security check and the corresponding action are separated in time, allowing an attacker to swap the resource between the check and use — exactly the symlink-swap scenario described.
A security team attributes an intrusion to a group that used custom zero-day exploits, maintained persistence for over a year without detection, and exfiltrated intellectual property related to a competing country's defense contracts, with no ransom demand or financial motive evident. Which threat actor is MOST consistent with this profile?
Nation-state actors are characterized by high sophistication (zero-days), long dwell time/persistence, and espionage motives such as stealing defense-related IP rather than financial gain.
A cloud storage bucket was found publicly accessible after an audit revealed the default access policy was never changed from 'allow all authenticated AWS users' during initial setup, exposing sensitive customer records for months. Which category of vulnerability does this incident represent?
Leaving default overly permissive access policies unchanged on cloud storage is a textbook cloud misconfiguration — a known, preventable issue caused by improper configuration rather than a flaw in the platform itself.
An attacker intercepts a TLS handshake and forces the client and server to negotiate SSLv3 instead of TLS 1.3, then exploits known weaknesses in the older protocol to decrypt session traffic. Which type of cryptographic attack is being performed?
A downgrade attack forces two parties to fall back to a weaker, less secure protocol or cipher version so the attacker can exploit known weaknesses in that older standard — precisely what happened by forcing SSLv3 negotiation.
A software vendor's build server is compromised, and attackers insert malicious code into a legitimate, digitally-signed update that is then distributed to thousands of customers through the vendor's normal automatic update mechanism. Which threat vector BEST describes this attack?
Compromising a trusted vendor's build/update process to distribute malicious code to downstream customers is the defining characteristic of a supply chain attack, since it abuses the trust relationship in the software distribution pipeline.
A security engineer notices thousands of login attempts across many user accounts, each account tried with only one or two common passwords like 'Summer2026!' to avoid triggering per-account lockout thresholds. Which mitigation is MOST effective specifically against this attack pattern?
This describes a password spraying attack, which deliberately uses few passwords across many accounts to stay under per-account lockout thresholds; detecting abnormal authentication velocity across the account population and requiring MFA directly counters this technique regardless of per-account thresholds.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 2.
Get my $34.99 deal →