CompTIA Security+ Practice Test of the Day 260501

Welcome to today’s CompTIA Security+ practice test!

This practice test uses our new UI!

Today’s practice test is based on Subdomain 2.3 (Explain various types of vulnerabilities) from the CompTIA Security+ SY0-701 objectives.

This beginner-level practice test is inspired by the CompTIA Security+ (SY0-701) exam and is designed to help you reinforce key cybersecurity concepts on a daily basis.

These questions are not official exam questions, nor are they brain dumps, but they reflect topics and scenarios relevant to the Security+ certification. Use them to test your knowledge, identify areas for improvement, and build daily cybersecurity habits.

Note: CompTIA and Security+ are registered trademarks of CompTIA. This content is not affiliated with or endorsed by CompTIA.

To choose CompTIA Security+ practice tests based on specific domains/subdomains, click that link.

CompTIA Security+ Practice Test of the Day 260501

10 questions • Single best answer

Question 1

A developer at a fintech company reviews a crash report showing that when users submit an unexpectedly long string in a payment form field, the application overwrites adjacent memory regions — causing the server process to crash or execute unintended instructions. Which vulnerability type does this describe?

A. Race condition B. SQL injection C. Buffer overflow D. Memory injection

Question 2

A penetration tester enters ' OR '1'='1' -- into a web application's login form and successfully authenticates without a valid password. The application constructs database queries using unsanitized user input. Which vulnerability type was exploited?

A. Cross-site scripting B. Buffer overflow C. SQL injection D. Directory traversal

Question 3

An attacker posts a comment on a blog platform containing a JavaScript snippet. When other users load the page, their browsers execute the script — stealing session cookies and sending them to the attacker's server. Which web-based vulnerability is being exploited?

A. SQL injection B. Cross-site scripting (XSS) C. Buffer overflow D. Race condition

Question 4

An application checks a user's write permission for a file, then a fraction of a second later performs the write. An attacker replaces the target file between the permission check and the write operation — causing the application to write to a sensitive system file with elevated privileges. Which vulnerability type does this illustrate?

A. Buffer overflow B. Memory injection C. Time-of-check/time-of-use (TOC/TOU) race condition D. SQL injection

Question 5

A vulnerability in a cloud hypervisor allows a malicious process running inside a virtual machine to interact directly with the host system's memory and processes — breaking the isolation boundary between the VM and the underlying host. Which virtualization vulnerability type does this represent?

A. Resource reuse B. VM escape C. Side-channel attack D. Cloud misconfiguration

Question 6

Security researchers discover that attackers are actively exploiting a vulnerability in a widely used VPN product. The vendor has no knowledge of the flaw, no patch has been released, and no CVE has been published. Which vulnerability type does this describe?

A. Misconfiguration B. End-of-life vulnerability C. Supply chain vulnerability D. Zero-day vulnerability

Question 7

A cloud security scan reveals that an S3 bucket containing customer PII is configured with public read access — allowing anyone on the internet to list and download the files without authentication. Which vulnerability category does this represent?

A. Cloud-specific architecture flaw B. Zero-day vulnerability C. Misconfiguration D. Supply chain vulnerability

Question 8

A financial services employee roots their personal Android phone and uses it to access corporate email and client data. The rooted device bypasses OS security restrictions, allowing apps to access system-level functions normally unavailable to user-space applications. Which mobile device vulnerability does this represent?

A. Side loading B. Jailbreaking C. End-of-life OS D. Resource reuse

Question 9

A security team discovers that a third-party authentication library included in their web application contains a backdoor inserted by a compromised developer at the library's vendor. All users of the library are unknowingly exposed to remote access. Which vulnerability type does this represent?

A. Zero-day B. Software supply chain vulnerability C. Misconfiguration D. OS-based vulnerability

Question 10

An auditor discovers a manufacturing facility's process control network still runs Windows XP on critical workstations. Microsoft ended security support for Windows XP in 2014, meaning no patches are issued for any vulnerabilities discovered since then. Which vulnerability category does this represent?

A. Misconfiguration B. Zero-day C. Virtualization vulnerability D. End-of-life/legacy OS vulnerability

Tired of Googling acronyms while practicing/studying?
Keep them all under your keyboard.

📋 GET_THE_DESK_MAT

Take more CompTIA Security+ practice tests

CompTIA Security+ Practice Test of the Day 260501

Related Posts

Leave a Comment Cancel Reply