Mock Exam Part 1: General Security Concepts and Threats

Welcome to Mock Exam Part 1, covering Security+ Domains 1 and 2: General Security Concepts (12%) and Threats, Vulnerabilities, and Mitigations (22%). Together these account for 34% of your exam score. Each scene presents a question followed by the correct answer and a full explanation of why the other options are wrong. To maximize value: read the question, form your own answer, then read the explanation. Track which questions you miss by topic — this identifies your weak areas for targeted final review. Domains 1 and 2 together represent about 30 questions on the real exam.

Q1 — CIA Triad: An organization encrypts customer data before storing it. Which CIA principle is primarily addressed? Answer: Confidentiality — encryption prevents unauthorized disclosure. Integrity is addressed by hashing; Availability by redundancy.

Q2 — Authentication Factors: A bank requires a PIN and fingerprint scan. What factors are used? Answer: Something you know (PIN) + Something you are (fingerprint/biometric). The three factors are Know / Have / Are. Two factors of the same type (two passwords) is two-step verification, not true MFA. Geolocation adds a fourth factor: Somewhere you are.

Q3 — Credential Stuffing: 10,000 login failures using username/password pairs from a prior breach at another company. Answer: Credential stuffing — replays breach pairs against a different service exploiting password reuse. Brute force tries all combinations; password spraying tries one password against many accounts; dictionary attack tries word lists.

Q4 — Malware Classification: Malware spreading machine-to-machine with no user interaction via a print spooler vulnerability. Answer: Worm — self-replicates across networks autonomously. A virus requires a host file and user action. A Trojan does not self-replicate. Ransomware is a payload type, not a propagation mechanism.

Q5 — Pretexting/Vishing: An attacker calls claiming to be IT helpdesk, creates urgency about a compromised account, and the employee gives their password. Answer: Pretexting via vishing — fabricated scenario delivered by phone using urgency and authority levers.

Q6 — Password Storage: A developer needs to store passwords that cannot be recovered if the database is stolen. Answer: Hash with Argon2id + unique salt per user. AES encryption is reversible (stealing the key reveals all passwords). Bare SHA-256 is too fast for password storage. HMAC requires a secret key but is still insufficiently slow.

Q7 — Hacktivist: An attacker defaces a corporation's website with political messaging opposing their environmental policies. Answer: Hacktivist — motivated by ideology/political causes. Cybercriminals are financially motivated; nation-states have strategic objectives; script kiddies seek notoriety.

Q8 — Deterrent Controls: Security cameras prominently placed with 'Under 24-Hour Surveillance' signage. Answer: Deterrent control — visible cameras with signage primarily discourage attackers. Cameras can also be detective (recording for investigation), but visible placement prioritizes deterrence over detection.

Q9 — Whaling: The CFO receives a personalized email referencing her name, title, recent acquisition, requesting an urgent wire transfer appearing from the CEO. Answer: Whaling — highly targeted phishing of C-suite executives. Spear phishing targets specific individuals but not necessarily executives. BEC is the fraud scheme (wire transfer), whaling is the delivery technique.

Q10 — Vulnerability + Threat = Risk: Unpatched Apache with a known buffer overflow, plus an attacker group actively exploiting it in the sector. Answer: Risk exists because both a vulnerability AND a threat to exploit it exist simultaneously — this should be prioritized for immediate remediation. Risk requires both elements; without a threat, a vulnerability creates only potential risk.

Q11 — Non-Repudiation: Vendor contracts that prevent parties from denying agreement. Answer: Digital signatures using asymmetric cryptography — only the private key holder could sign, proving identity. HMAC uses a shared key (either party could have signed it, so no non-repudiation). Hashing alone provides integrity but not attribution.

Q12 — DNS Tunneling: A workstation makes periodic DNS queries every 60 seconds to a domain with 40-character random subdomains. Answer: DNS tunneling C2 communication — regular beaconing + encoded long subdomains in TXT records = attacker encodes data in DNS queries to evade firewall rules that allow DNS.

Q13 — Rootkit: Scanner shows no unusual processes but network monitoring shows outbound C2 connections and OS binary integrity check failures. Answer: Rootkit — intercepts OS API calls to hide itself from security tools; kernel modification explains binary integrity failures.

Q14 — CVSS 9.8: CVSS ranges: 9.0-10.0 = Critical. Unauthenticated remote code execution scores 9.8 = Critical priority — patch within 24-48 hours. CVSS 7.0-8.9 = High, 4.0-6.9 = Medium, 0.1-3.9 = Low.

Q15 — Supply Chain Attack: Attackers compromised a software vendor's build system and inserted a backdoor into a legitimate update distributed to 18,000 customers (SolarWinds SUNBURST). Answer: Supply chain attack — targeting the vendor to reach customers who trust and install the vendor's products.

Q16 — Asymmetric Key Usage: Alice sends Bob a message only Bob can read. Answer: Encrypt with Bob's PUBLIC key — only Bob's private key decrypts. Sign with private key; verify with public key. Public key = for others to use on your behalf; private key = personal only.

Q17 — Fileless Malware: PowerShell executes encoded Base64 commands downloading and running code entirely in memory without writing files to disk. Answer: Fileless/Living-off-the-Land (LotL) attack — abuses legitimate tools (PowerShell, WMI) to avoid file-based antivirus signatures. Defenses: Script Block Logging, AMSI, behavioral EDR.

Q18 — BEC: Attacker monitors email for two weeks, then sends a look-alike domain email requesting a new bank account for invoices. Answer: Business Email Compromise (BEC) with email spoofing — financial fraud using context gained from monitoring. Defense: out-of-band verification (call vendor at known number) before any banking change.

Q19 — Zero-Day: Exploiting a vulnerability with no existing CVE and no patch. Answer: Zero-day vulnerability — vendor has had zero days to fix it. Once patched, it is no longer technically zero-day.

Q20 — Defense in Depth: Perimeter firewall + network IDS + host-based firewall + EDR + data encryption. Answer: Defense in depth (layered security) — multiple independent controls so if one layer fails, others remain. Contrasts with least privilege (minimum access), separation of duties (split critical functions), and zero trust (verify all access).

Q21-25 Rapid Review: HSTS = forces HTTPS, refuses HTTP connections. Logic bomb = executes when specific condition met (date/action). Watering hole = compromises site frequented by targets. Typosquatting = registers misspelled domains (goggle.com). Threat intelligence vs vulnerability assessment = TI describes adversary capabilities; VA identifies weaknesses in your own systems.

Critical distinctions tested in Domains 1 and 2: Encryption vs Hashing — encryption is reversible (needs a key); hashing is one-way (no key). Use encryption for confidentiality; use hashing for integrity and password storage. Virus vs Worm — virus needs a host file and user action to spread; worm spreads autonomously over networks. Phishing hierarchy — mass phishing targets everyone; spear phishing targets specific individuals; whaling targets executives; vishing uses voice. Control categories — preventive stops attacks, detective identifies them, corrective limits damage, deterrent discourages, compensating is an alternative when primary control is not feasible.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this mock exam part you reviewed: CIA triad applications — encryption addresses confidentiality, hashing addresses integrity, redundancy addresses availability, attack type distinctions — worms vs viruses, credential stuffing vs brute force, whaling vs spear phishing vs vishing, supply chain attacks, and zero-day vulnerabilities, and security control categories — preventive/detective/corrective/deterrent/compensating with their real-world examples. These concepts form the 34% of the exam covered by Domains 1 and 2. Next up is Mock Exam Part 2 covering Security Architecture and Infrastructure.