CompTIA Security+ Domain 2: Threats, Vulnerabilities & Mitigations

Defacing sites with slogans and leaking data to shame leadership while seeking no profit is the textbook hacktivist pattern motivated by ideology rather than money.

• AThis misreads the incident as ransomware or extortion, but the attackers demanded no money and instead sought public embarrassment, contradicting a financial motive.
• BEspionage relies on stealth to exfiltrate secrets undetected, yet here the attackers publicized data loudly, the opposite of covert intellectual-property theft.
• DUnskilled thrill-seekers act for excitement without a cause, but the deliberate political messaging here signals a purposeful ideological agenda, not random recreational mischief.

Inserting an untrusted USB drive that auto-loads malware is the classic removable-media vector, bypassing perimeter defenses by relying on physical human curiosity.

• BWatering-hole attacks infect users via a website they routinely visit, but no browsing occurred here; the infection came from a physical drive, not a site.
• CBusiness email compromise abuses trusted email and fraudulent invoices, yet this scenario involved no message at all; the entry point was hardware, not email.
• DSupply-chain attacks compromise legitimate vendor products before delivery, but a random drive found outside is not a trusted supplied component, so this label misfits.

A TOCTOU race condition exploits exactly this gap, where the verified state changes before the program acts, letting attackers substitute a different resource.

• ABuffer overflows stem from writing past allocated memory boundaries, which concerns input size handling, not the timing gap between checking and using a resource.
• BSQL injection results from concatenating untrusted input into queries, an input-validation flaw unrelated to a timing window between a resource check and subsequent use.
• CCross-site scripting injects malicious scripts into web pages rendered by browsers, an output-encoding problem distinct from concurrent state changes between validation and action.

Malware using a domain generation algorithm produces many pseudo-random domains to reach rotating command-and-control infrastructure, explaining the flood of failing algorithmic DNS queries observed.

• AA logic bomb stays dormant until a condition fires and generates no steady network traffic, so constant DNS lookups do not match its silent dormant nature.
• CA keylogger records typed input locally and exfiltrates sparingly, so it would not generate thousands of random domain lookups per hour as seen here.
• DA rootkit hides files and processes to evade detection but does not inherently produce massive volumes of randomized DNS requests, making this behavioral indicator a poor fit.

Trying a single popular password against many accounts while limiting attempts per account defines password spraying, designed to avoid lockout thresholds that detect repeated failures.

• BBrute force exhaustively tries countless passwords against a single account, which would trigger lockouts; here only one password hits many accounts, contradicting that pattern.
• CA dictionary attack runs many wordlist entries against one target, but the logs show one password spread across many accounts, the inverse of dictionary behavior.
• DPass-the-hash replays captured password hashes to authenticate without plaintext, yet here a cleartext password is being tried, so no hash reuse is involved.

Network segmentation divides the environment into separate zones with restricted inter-zone traffic, containing infections and directly limiting the lateral movement that caused widespread spread.

• AFull-disk encryption protects data confidentiality on stolen or lost devices but does nothing to stop malware from spreading laterally between reachable hosts on a network.
• BStrong password policies harden authentication against guessing, yet they do not restrict network reachability, so ransomware can still propagate freely across a flat segment.
• DUpdated antivirus signatures improve detection of known malware but cannot reliably contain a novel ransomware strain already moving across an unsegmented, fully reachable network.

An insider threat is a current or former trusted user who abuses authorized access, exactly matching a departing administrator copying sensitive data and planting a destructive deletion script.

• AOrganized crime groups are external profit-driven gangs, but this trusted employee already holds legitimate internal access and acts from personal grievance rather than a coordinated criminal enterprise.
• CNation-state actors are well-resourced government-sponsored teams pursuing strategic or political objectives, which does not fit one disgruntled employee acting alone for personal revenge before his layoff.
• DHacktivists attack to advance a public ideological or political cause, yet this employee seeks private retaliation and data theft, showing no activist message or broader social agenda.

Typosquatting registers domains closely resembling a real one so users who mistype a single character reach an attacker-controlled lookalike site that harvests their entered credentials.

• AA watering-hole attack compromises a legitimate site the target group already frequents, but here victims are diverted by their own typing mistake to a separate attacker-controlled domain.
• BBusiness email compromise hijacks or spoofs trusted email accounts to push fraudulent payments, whereas this attack relies on a mistyped web address and involves no email message at all.
• DSmishing delivers malicious lures through SMS text messages, but no text was involved here; the user simply fat-fingered a URL and arrived at a fake banking page.

VM escape exploits a hypervisor flaw allowing code in a guest to break isolation and execute on the host, endangering every other tenant virtual machine on that server.

• AVM sprawl is the unmanaged proliferation of forgotten virtual machines that wastes resources and widens the attack surface, but it does not describe breaking out of hypervisor isolation.
• BCross-site scripting injects malicious scripts into web pages viewed by users, an application flaw entirely unrelated to escaping a guest virtual machine to reach the underlying host.
• CPrivilege escalation inside one guest only elevates rights within that single operating system, while the tester crossed the virtualization boundary to control the shared host itself.

An on-path attacker inserts itself between two parties, here through ARP poisoning, to silently read and modify the traffic flowing between the victim workstation and the gateway.

• BA distributed denial-of-service attack floods a target with traffic to exhaust capacity, but this attacker stays quiet and intercepts traffic rather than overwhelming any service or host.
• CDNS cache poisoning corrupts resolver records to redirect name lookups, yet here the attacker manipulates ARP on the local segment, not DNS responses, to seize the traffic path.
• DCredential replay captures and reuses authentication material to log in later, which differs from actively relaying and altering live traffic between a victim and gateway in real time.

Directory traversal uses sequences like dot-dot-slash to escape the web root and read arbitrary files, such as the system password file, located outside the intended served folder.

• ASQL injection inserts crafted input into database queries to manipulate data, but these requests target the file system with dot-dot-slash sequences, not any backend SQL statement.
• BCross-site request forgery tricks an authenticated browser into submitting unwanted actions, which has nothing to do with traversing directories to read protected files on the server.
• DCross-site scripting injects scripts that run in victims' browsers, but the logged payload reads server-side files instead of delivering any client-side executable script content at all.

An application allow list permits only explicitly approved programs to execute and blocks everything else by default, stopping any unapproved or unknown executable from ever running.

• ASignature-based antivirus only blocks malware matching known signatures, so a novel or unknown executable can still run, failing the goal of permitting solely pre-approved programs.
• CLeast privilege restricts the rights granted to accounts, but a user with normal rights could still launch unapproved software, so it does not enforce approved-only program execution.
• DRegular patching fixes known vulnerabilities in installed software, yet it does nothing to prevent a user from running a brand-new malicious executable that was never approved.

Custom zero-days, year-long covert persistence, and disciplined working-hours operations reflect the deep resources and advanced sophistication that distinguish well-funded external nation-state actors from lesser groups.

• AScript kiddies rely on freely borrowed tools and lack the funding to develop multiple zero-day exploits or sustain a stealthy year-long intrusion campaign like the one described.
• CAn insider already holds authorized access and would not need several custom zero-day exploits or external persistence techniques to operate within the targeted environment over time.
• DHacktivists seek loud public attention for an ideology, but this actor stayed covert for over a year and displayed no protest messaging or social cause.

Business email compromise impersonates or hijacks a trusted executive to push fraudulent payments through email alone, exactly matching an urgent CEO wire request that carries no malware.

• BA watering-hole attack infects a website the target routinely visits, but no browsing occurred here; the fraud arrived purely as a deceptive email message.
• CSupply-chain compromise tampers with a vendor's product before delivery, yet this incident involves no software or hardware component, only a spoofed internal email request.
• DUSB HID injection requires a malicious physical device emulating a keyboard, but the clerk received only an email and plugged in nothing, so this vector cannot apply.

Stored XSS saves malicious script on the server so it persistently runs in the browser of every user who views the affected page, stealing their session cookies.

• AReflected XSS bounces script from a single crafted request back to that one victim, but here the payload was saved and served automatically to every later visitor.
• BSQL injection manipulates database queries through crafted input, whereas this attack injects a browser-executed script into a stored page rather than any backend SQL statement.
• CCross-site request forgery tricks a browser into submitting unwanted actions, but this attack runs attacker-supplied script inside victims' browsers to steal cookies, not forge requests.

Credential stuffing automates replaying username-password pairs stolen from one breach against another site, succeeding wherever victims reused the same credentials, exactly as described in this scenario.

• APassword spraying tries a single common password against many accounts, but this attacker replays specific leaked username-password pairs, relying on password reuse rather than one guessed password.
• BBrute force exhaustively tries countless combinations against one account and triggers lockouts, whereas this attack reuses already-known credential pairs from a separate breach across many accounts.
• DA dictionary attack runs many wordlist guesses against a single target, but here valid leaked pairs are replayed across many accounts rather than guessed from a wordlist.

A downgrade attack, such as SSL stripping, forces a connection onto a weaker or plaintext protocol so the attacker can read data the encryption was meant to protect.

• ADNS poisoning corrupts name-resolution records to send users toward a fraudulent address, but here the destination is unchanged; only the protocol was forced down to plaintext.
• CA birthday attack exploits probability to find a hash collision, which concerns cryptographic digests, not coercing a live session away from HTTPS down to plaintext HTTP.
• DA replay attack resends previously captured authentication data, but this attack instead weakens the live connection's encryption in real time to read freshly submitted credentials.

Least privilege grants each account only the permissions its role genuinely requires, so a compromised helpdesk account no longer carries the excessive domain administrator rights an attacker could abuse.

• BEncrypting drives at rest protects data on stolen or powered-off disks, but it does nothing to reduce the excessive administrative rights assigned to active helpdesk accounts.
• CA host-based firewall filters network traffic to and from a workstation, yet it cannot revoke the over-broad domain administrator permissions that make each helpdesk account so dangerous.
• DNetwork segmentation limits lateral movement between zones, but the helpdesk accounts would still hold domain admin rights, so a single compromise could still control the domain.

Correct because shadow IT is staff deploying unsanctioned hardware or services outside IT governance, exactly matching this team's unapproved cloud adoption for speed.

• AWrong because a malicious insider deliberately abuses authorized access to cause harm, while these employees sought convenience and had no sabotage or theft intent.
• BWrong because organized crime is an external, financially motivated group running coordinated operations, not internal staff informally adopting an unapproved productivity tool.
• DWrong because an unskilled attacker runs prebuilt exploit tools against targets, which does not describe employees provisioning their own storage for legitimate work tasks.

Correct because a watering hole compromises a site a target group frequents so members are infected when visiting, precisely matching this standards-website approach.

• AWrong because spear phishing sends crafted messages directly to chosen targets, whereas here the attackers infect a trusted third-party site and wait for victims to arrive.
• CWrong because typosquatting registers misspelled lookalike domains to catch mistyped URLs, but the engineers reached the real, legitimately addressed site that was compromised.
• DWrong because pretexting builds a fabricated scenario to manipulate a person in conversation, while this attack relies on a poisoned website rather than human dialogue.

Correct because writing more data than a fixed buffer holds overruns adjacent memory and the return address, enabling code execution exactly as described here.

• AWrong because a race condition exploits timing between concurrent operations on a shared resource, not the writing of oversized input past a fixed memory boundary.
• BWrong because SQL injection inserts crafted query syntax into a database call, while this attack overwrites process memory in a C program with no database involved.
• CWrong because integer overflow wraps a numeric value past its maximum, whereas the root cause here is unbounded copying of input beyond an allocated buffer length.

Correct because password spraying tries one common password against many accounts slowly to dodge lockout, matching the single guess per account spread over hours.

• BWrong because classic brute force hammers one account with many password guesses, but here each account received only a single attempt with the same password.
• CWrong because credential stuffing replays many breached username-password pairs, while this pattern reuses one identical password across accounts rather than varied leaked combinations.
• DWrong because privilege escalation abuses a flaw to gain higher rights after access, not a guessing pattern of one shared password against thousands of logins.

Correct because a rootkit operates at kernel level and hooks system calls to conceal processes and files from the OS and AV, exactly as observed here.

• AWrong because a trojan disguises itself as legitimate software to trick installation, but it does not inherently hook the kernel to hide files from the operating system.
• CWrong because a worm's defining trait is autonomous propagation across hosts, while the evidence here centers on stealth and kernel concealment, not network self-replication.
• DWrong because a keylogger records typed input to steal credentials, which does not explain hidden kernel drivers cloaking files and processes from the system.

Because the workload already moved and no patches exist, retiring the unsupported host removes the vulnerable asset entirely and is the definitive mitigation here.

• AThis wrongly assumes fixes exist; an end-of-life platform receives no vendor patches, so a tighter patch cadence cannot remediate the unpatchable critical CVEs.
• BConfiguration hardening reduces attack surface but cannot close code-level CVEs that require vendor patches, so the unsupported host stays exploitable despite a baseline.
• DEncrypting data at rest protects confidentiality if disks are stolen but does nothing to address running-service CVEs on a still-online unsupported host.