and …","url":"https://courseiva.com/questions/comptia/security-plus/a-web-form-stores-a-user-s-comment-and-later-displays-it-to"},{"@type":"ListItem","position":20,"name":"A user receives an SMS from 'IT Service Desk' saying their MFA enrollment expires today and includes a shortened link. F…","url":"https://courseiva.com/questions/comptia/security-plus/a-user-receives-an-sms-from-it-service-desk-saying-their-mfa"},{"@type":"ListItem","position":21,"name":"An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-ti…","url":"https://courseiva.com/questions/comptia/security-plus/an-employee-receives-an-email-from-someone-claiming-to-be-from"},{"@type":"ListItem","position":22,"name":"NetFlow and authentication logs show one workstation opening SMB and WinRM sessions to many internal hosts within ten mi…","url":"https://courseiva.com/questions/comptia/security-plus/netflow-and-authentication-logs-show-one-workstation-opening-smb"}]}
A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?
A.Reset MFA immediately, since the caller has provided enough internal details to seem credible.
B.Ask the caller to read a one-time code aloud so the technician can confirm their identity.
C.End the call and verify the request through a published help desk number or ticketing system.
D.Approve the request if the caller can name the supervisor and the contractor's project team.
AnswerC
The safest first action is to stop using information supplied by the caller and verify through a trusted, independently obtained contact path. Because the attacker already knows internal details and provided a callback number in a text, those channels cannot be trusted. Using a published help desk number or the official ticketing system preserves least risk and prevents social engineering from extending into account reset abuse.
Why this answer
The safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.
Exam trap
The trap here is that candidates may assume the caller's knowledge of internal details (supervisor name, org chart) is sufficient proof of identity, but CompTIA tests the principle that any unsolicited request for privileged actions must be independently verified through a trusted channel, not through information the caller provides.
How to eliminate wrong answers
Option A is wrong because resetting MFA immediately based on internal details alone is dangerous; attackers can gather org chart and supervisor names via OSINT or previous breaches, and MFA reset is a high-risk action that should require verified identity. Option B is wrong because asking the caller to read a one-time code aloud is insecure; a one-time code sent to the caller's device could be intercepted or the caller could be the attacker who generated the code themselves, and this method does not verify the caller's identity against a trusted source. Option D is wrong because naming a supervisor and project team is not sufficient authentication; these details are often publicly available or easily guessed, and approving the request without independent verification violates the principle of least privilege and allows unauthorized access.
Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?
A.DNS poisoning, because the hostname is resolving to the wrong server.
B.ARP spoofing, because false Layer 2 address mappings are redirecting traffic.
C.Replay attack, because packets are being resent to the gateway.
D.Rogue DHCP service, because clients are losing access to the default gateway.
AnswerB
ARP spoofing, also called ARP poisoning, happens when a host sends forged ARP messages that associate a target IP address with the attacker’s MAC address. In this case, the gateway IP is repeatedly being mapped to a workstation MAC, and traffic is being relayed through that workstation. That is a classic man-in-the-middle setup on a local network segment.
Why this answer
B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.
Exam trap
The trap here is that candidates often confuse ARP spoofing with DNS poisoning because both involve redirecting traffic, but ARP spoofing operates at Layer 2 (MAC address manipulation) while DNS poisoning operates at Layer 7 (hostname resolution).
How to eliminate wrong answers
Option A is wrong because DNS poisoning involves corrupting the DNS resolver cache or DNS server records to map a domain name to an incorrect IP address, not manipulating Layer 2 MAC-to-IP mappings on a local subnet. Option C is wrong because a replay attack involves capturing and retransmitting valid data packets to trick the receiver, not altering ARP tables to redirect traffic through a rogue host. Option D is wrong because a rogue DHCP service would assign incorrect IP configuration (including a fake gateway IP) to clients, but the symptom described is a specific MAC-to-IP mapping conflict for the existing gateway, not a DHCP lease issue.
A Linux server is missing expected security-agent processes, but users can still connect to the application. Local command output does not show a suspicious daemon that another monitoring tool says is listening on port 4444. A raw disk scan reveals a kernel module loaded at boot, and several files appear only when viewed outside the normal operating system tools. What malware type is most likely?
A.Trojan, because it could have introduced the suspicious service after the initial compromise.
B.Spyware, because it may collect data while leaving the application functional.
C.Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.
D.Logic bomb, because the malware activates after startup and changes what administrators see.
AnswerC
A rootkit is the best answer because the evidence points to concealment at the operating system level. A kernel module loaded at boot, missing processes in standard listings, and files visible only through raw disk examination all indicate malicious hiding behavior. Rootkits are designed to obscure other malware or unauthorized access, making them especially dangerous and difficult to detect with normal administrative tools.
Why this answer
The scenario describes a rootkit: a kernel-level rootkit can load a malicious kernel module at boot, intercept system calls (e.g., `open`, `readdir`, `netstat`), and hide processes, files, and network listeners from user-mode tools like `ps`, `ls`, or `netstat`. The raw disk scan reveals files invisible to normal OS tools, and the missing security-agent processes and hidden daemon on port 4444 are classic signs of kernel-mode hooking that bypasses standard visibility.
Exam trap
The trap here is that candidates may confuse a rootkit with a Trojan or spyware because all three can persist, but only a rootkit operates at kernel level to hide its artifacts from user-mode commands like `ps`, `ls`, and `netstat`.
How to eliminate wrong answers
Option A is wrong because a Trojan is a type of malware that disguises itself as legitimate software but does not inherently provide kernel-level hiding capabilities; the key evidence here is kernel module loading and file/process concealment, which is the hallmark of a rootkit, not a Trojan. Option B is wrong because spyware focuses on data collection and typically does not modify the kernel to hide its own processes or files; the described behavior of hiding a daemon and files from normal tools goes far beyond spyware's typical user-mode surveillance.
A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.
Select 2 answers
A.Files are renamed or encrypted and no longer open normally
B.A ransom note demands payment for decryption or restoration
C.The mouse pointer moves slowly after long idle periods
D.The browser homepage changed after a software update
E.A new USB keyboard is detected by the operating system
AnswersA, B
Ransomware typically enumerates user files and applies symmetric encryption (e.g., AES) with a per-file key, then appends an extension such as .locked or .crypt. Renaming and encrypting prevents normal access via the OS file system, because the original file system metadata and content are replaced. This behavior is a direct, observable consequence of the malware's core objective: to hold data hostage until a ransom is paid.
Why this answer
Ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.
Exam trap
The trap here is that candidates may confuse general system performance issues (like a slow mouse) with ransomware indicators, but ransomware focuses on file encryption and ransom demands, not on input device behavior.
Based on the exhibit, what is the BEST response by the employee?
The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.
A.Verify the request using a known internal help desk number or portal before taking any action.
B.Reply with the six-digit code so the help desk can complete the repair quickly.
C.Open the linked repair page from the email and sign in immediately to avoid suspension.
D.Forward the message to the manager and continue using the account until the suspension occurs.
AnswerA
The employee should verify the request through an independently known help desk number or portal, not through any contact details embedded in the email. This message combines urgency, a mismatched reply-to address, and a request for an MFA code — classic indicators of a phishing or vishing attempt. Calling the official help desk number or logging into the official support portal confirms whether the repair request is legitimate before any sensitive action is taken. This out-of-band verification prevents both credential theft and MFA token compromise.
Why this answer
Verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.
Exam trap
The trap here is that candidates may assume the email is legitimate because it appears to come from a trusted internal source, leading them to choose an action that involves direct interaction with the email (like replying or clicking a link) rather than verifying through an independent channel, which is the core principle of social engineering defense.
How to eliminate wrong answers
Option B is wrong because replying with a six-digit code directly to the email sender could provide an attacker with a one-time passcode (OTP) or verification code, enabling them to bypass multi-factor authentication (MFA) or gain unauthorized access to the employee's account. Option C is wrong because opening a linked repair page from the email and signing in immediately could lead to a credential harvesting site that captures the employee's username and password, compromising their account. Option D is wrong because forwarding the message to the manager and continuing to use the account until suspension occurs does not prevent potential compromise; the employee remains vulnerable to further exploitation while the manager investigates, and the account could be used maliciously in the interim.
A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?
A.Ignore the finding because the scanner produced a false positive
B.Request a risk exception and document compensating controls until patching is possible
C.Disable the vulnerability scanner to prevent repeated alerts
D.Immediately retire the server even though the application is still business-critical
AnswerB
This is the best response because the team has confirmed the issue cannot be immediately remediated, but the organization still needs formal risk ownership. A risk exception documents the temporary acceptance, while compensating controls capture what is being done to reduce exposure until a supported patch becomes available. That is the right balance between operational constraints and security governance.
Why this answer
The vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.
Exam trap
The trap here is that candidates confuse a 'false positive' (scanner error) with a 'vulnerability that is mitigated by a compensating control' — the scanner is correct, but the risk is lower than the raw CVSS score suggests.
How to eliminate wrong answers
Option A is wrong because the scanner did not produce a false positive; the vulnerable package is indeed installed, and the scanner correctly identified it. The fact that the code path is disabled is a compensating control, not a false positive. Option C is wrong because disabling the vulnerability scanner would eliminate visibility into all findings, including legitimate ones, and violates security monitoring best practices.
Option D is wrong because retiring a business-critical server without a replacement or migration plan would cause unacceptable operational impact, and the risk is already mitigated by the disabled code path.
A security team suspects a rootkit after seeing hidden processes, boot-time persistence, and altered system files on a laptop. What is the best next step after confirming the suspicion?
A.Run a quick cleanup script and return the laptop to the user
B.Disconnect the laptop, then reimage it from a known-good source
C.Disable the user account and leave the device in place
D.Delete the suspected hidden files manually from Windows Explorer
AnswerB
Disconnecting the laptop isolates it from the network, stopping any ongoing command-and-control communication, data exfiltration, or lateral movement. Reimaging from a known-good source (after securely erasing the disk, and ideally verifying firmware integrity) removes not only the visible malware but also any kernel-level or boot-level persistence mechanisms. This is the only option that provides a trustworthy, verifiable baseline for returning the device to service.
Why this answer
Once a rootkit is confirmed, the system's integrity is compromised at the kernel or boot level, making any software-based cleanup unreliable. Reimaging from a known-good source ensures all malicious code, including bootkits and hidden processes, is completely eradicated. This aligns with the SY0-701 domain of incident response, where containment and eradication require a trusted baseline.
Exam trap
The trap here is that candidates may think a cleanup script or manual deletion is sufficient, but rootkits operate below the OS level, making reimaging the only reliable method to restore integrity.
How to eliminate wrong answers
Option A is wrong because a quick cleanup script cannot remove rootkits that operate at ring 0 or modify the Master Boot Record (MBR); the malware will persist or reinfect. Option C is wrong because disabling the user account does not remove the rootkit from the laptop, leaving the device compromised and potentially spreading to other systems on the network. Option D is wrong because manually deleting files from Windows Explorer cannot remove kernel-mode rootkits that hide their processes and files from user-mode tools, and it may trigger anti-forensic mechanisms.
A security team is reviewing vulnerabilities in a web application. Which three of the following are common web application vulnerabilities that should be addressed? (Choose three.)
Cross-site scripting (XSS) is a common web application vulnerability where an attacker injects malicious scripts into web pages viewed by other users, often through input fields or URL parameters. SQL injection occurs when an application improperly sanitizes user input in SQL queries, allowing attackers to manipulate the database. XML external entity (XXE) injection exploits poorly configured XML parsers to process external entities, leading to data disclosure or server-side request forgery.
These three are consistently listed in the OWASP Top 10 as critical web application flaws.
Exam trap
The SY0-701 exam often tests the distinction between web application vulnerabilities (like XSS, SQLi, XXE) and network-level attacks (like ARP poisoning, DNS cache poisoning, evil twin), so candidates mistakenly select network attacks because they are familiar, but they are not specific to web applications.
Users on a branch VLAN intermittently reach a fake login page even though DNS records have not changed. A packet capture shows the default gateway MAC address changing every 60 seconds, and the switch logs list repeated unsolicited ARP replies from one workstation. Which attack is most likely?
A.DNS poisoning, because name resolution is directing users to the wrong server.
B.ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.
C.Replay attack, because previously captured traffic is being resent to the network.
D.Denial of service, because the branch users cannot reliably reach websites.
AnswerB
ARP poisoning is the best fit because the attacker is sending unsolicited ARP replies to rewrite the local IP-to-MAC mapping. The changing gateway MAC address and repeated ARP activity are classic signs of a man-in-the-middle setup on a switched LAN. Once traffic is redirected through the attacker, fake login pages and credential interception become possible.
Why this answer
The repeated unsolicited ARP replies from one workstation, combined with the default gatewayMAC address changing every 60 seconds, directly indicate an ARP poisoning attack. The attacker is sending forged ARP replies to associate the gateway IP with its own MAC address, causing traffic destined for the gateway to be intercepted. This allows the attacker to redirect users to a fake login page without altering DNS records.
Exam trap
The trap here is that candidates see 'fake login page' and 'DNS records have not changed' and jump to DNS poisoning, but the key indicator is the MAC address changing every 60 seconds, which is a classic sign of ARP poisoning, not DNS manipulation.
How to eliminate wrong answers
Option A is wrong because DNS poisoning involves altering DNS records or cache entries to redirect name resolution, but the scenario explicitly states DNS records have not changed and the packet capture shows MAC address changes, not IP resolution changes. Option C is wrong because a replay attack resends captured legitimate traffic to impersonate a user or disrupt a session, but here the attacker is actively sending unsolicited ARP replies to redirect traffic, not replaying old packets. Option D is wrong because a denial of service attack would prevent users from reaching websites entirely, but the users intermittently reach a fake login page, indicating traffic is being redirected, not blocked.
Several users on the same subnet report intermittent loss of access to the default gateway. A packet capture shows repeated unsolicited ARP replies mapping the gateway IP address to a different MAC address. Traffic is occasionally sent through an unknown workstation. What attack is most likely occurring?
ARP poisoning is a Layer 2 attack that exploits the lack of authentication in the Address Resolution Protocol. An attacker on the same subnet sends forged ARP replies, associating the default gateway IP address with the attacker's MAC address. Victims update their ARP cache incorrectly, so all outbound traffic intended for the gateway is sent to the attacker's device. This causes intermittent connectivity as the attacker may drop, delay, or forward frames selectively, and the unusual ARP traffic would be visible in packet captures.
Why this answer
The attack is ARP poisoning (also known as ARP spoofing). The attacker sends unsolicited ARP replies to associate the gateway's IP address with the attacker's MAC address, causing traffic destined for the gateway to be redirected through the attacker's workstation. This results in intermittent connectivity as the attacker can forward or drop packets, and the repeated unsolicited replies overwrite the legitimate ARP cache entries on the victim hosts.
Exam trap
The trap here is confusing ARP poisoning with DNS cache poisoning because both involve 'poisoning' a cache, but ARP operates at Layer 2 (MAC addresses) while DNS operates at Layer 7 (domain names), and the symptoms of intermittent gateway access and unsolicited ARP replies are unique to ARP attacks.
How to eliminate wrong answers
Option B (DNS cache poisoning) is wrong because that attack corrupts DNS resolver caches to redirect domain names to malicious IP addresses, not to manipulate Layer 2 MAC-to-IP mappings via ARP. Option C (Replay attack) is wrong because a replay attack involves capturing and retransmitting valid data packets to impersonate a user or gain unauthorized access, not sending unsolicited ARP replies to redirect traffic. Option D (Amplification attack) is wrong because amplification attacks (e.g., DNS amplification, NTP amplification) exploit stateless protocols to flood a target with large responses from many servers, not to poison ARP caches on a local subnet.
A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?
A.Reflected cross-site scripting, because the tester's input is being echoed back into the response.
B.Command injection, because the application is pausing while executing system-level sleep commands.
C.Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.
D.Session fixation, because the tester is manipulating how the application handles user input over time.
AnswerC
The timing pattern is the critical clue. When an application does not reveal errors or data directly, an attacker can still infer whether injected SQL changes control flow by measuring response delays. A single quote plus a conditional sleep is a classic sign of time-based blind SQL injection. The normal-looking results and consistent pauses show the query is being influenced even without visible error output.
Why this answer
The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.
Exam trap
The trap here is that candidates confuse a time-based delay with command injection (Option B) because both involve a pause, but the key differentiator is the single quote syntax and the database-specific sleep function, not an OS-level command.
How to eliminate wrong answers
Option A is wrong because reflected cross-site scripting requires the tester's input to be echoed back in the HTML/JavaScript context, not a server-side delay; the absence of error messages and the consistent timing point to database-level behavior, not client-side script execution. Option B is wrong because command injection would involve system-level commands (e.g., 'ping -n 5 127.0.0.1') and typically shows a delay from the OS, not a database-specific sleep function triggered by a single quote; the application is a web application, not a command shell. Option D is wrong because session fixation involves an attacker forcing a known session ID on a victim to hijack their session later, not manipulating input to cause server-side delays; the tester's repeated requests and timing analysis are unrelated to session management.
Based on the exhibit, which finding should the security team remediate first?
A.LAP09 because user devices are always the easiest to patch
B.WEB01 because it is internet-facing and has a critical exploitable vulnerability
C.PRN01 because firmware issues can affect many users
D.FILE02 because internal servers are always more important than public ones
AnswerB
WEB01 should be remediated first because it is public-facing, rated critical, and already has a known exploit. Exposure and exploitability greatly increase risk, so this finding has the highest immediate urgency. When patching resources are limited, internet-facing critical vulnerabilities are typically prioritized before internal or low-severity issues.
Why this answer
WEB01 is internet-facing and has a critical exploitable vulnerability, meaning an attacker can directly compromise it from the public internet with minimal effort. This represents the highest risk because it combines high likelihood (exploit available) with high impact (full compromise of a public-facing server). Remediating this first aligns with the principle of prioritizing externally exposed systems with known critical flaws over internal or less severe issues.
Exam trap
The trap here is that candidates prioritize based on ease of remediation (A) or internal importance (D) instead of applying a risk-based approach that considers both the severity of the vulnerability and the exposure of the asset.
How to eliminate wrong answers
Option A is wrong because LAP09 being 'easiest to patch' does not equate to highest risk; patching ease is irrelevant when a critical internet-facing vulnerability exists. Option C is wrong because PRN01's firmware issue, while potentially affecting many users, is internal and typically lower severity than a critical remote code execution on a public server. Option D is wrong because internal servers are not inherently more important than public ones; the criticality and exposure of the vulnerability determine priority, not a blanket rule about server location.
A user forwards an email that says a shared document is available and must be reviewed within 10 minutes. The display name looks like a trusted vendor, but the Reply-To address points to a free webmail account. Which two details are strongest indicators that this is a phishing attempt? Select two.
Select 2 answers
A.The message creates a short deadline and pressures the user to act quickly.
B.The Reply-To address uses a free webmail domain instead of the vendor's corporate domain.
C.The message includes the company's logo and professional-looking formatting.
D.The email refers to a shared document that the user should review.
E.The message was received during normal business hours.
AnswersA, B
Urgency is a classic phishing tactic because it pushes recipients to react before verifying the request. A short deadline increases the chance that the user clicks a link or shares credentials without checking the sender or context.
Why this answer
Phishing attacks frequently use urgency and time pressure to bypass the victim's rational analysis, exploiting the psychological principle of scarcity to trigger impulsive clicks. The 10-minute deadline is a classic social engineering tactic to prevent the user from verifying the email's legitimacy through normal channels.
Exam trap
CompTIA often tests the distinction between easily spoofed visual elements (logos, formatting) and verifiable technical indicators (Reply-To domain mismatch, urgency cues) to catch candidates who rely on superficial appearance rather than email authentication mechanisms.
After a workstation reboot, users see many files renamed with random extensions. A ransom note demands cryptocurrency, and Volume Shadow Copies were deleted from the machine. What malware type is most likely?
A.Trojan, because the malware may have been disguised as a legitimate application.
B.Worm, because the malware likely spread automatically to other systems.
C.Ransomware, because the files were encrypted and payment was demanded.
D.Rootkit, because the attacker would want to hide persistence on the system.
AnswerC
Ransomware commonly encrypts files, deletes recovery options, and leaves a ransom note demanding payment. The random extensions and removed shadow copies are classic clues that the attacker wants to block restoration until payment is made.
Why this answer
The scenario describes files renamed with random extensions (indicating encryption), a ransom note demanding cryptocurrency, and deletion of Volume Shadow Copies (VSS) to prevent file recovery. These are hallmark behaviors of ransomware, specifically a crypto-ransomware variant that encrypts user data and removes backup copies to maximize extortion pressure.
Exam trap
The trap here is that candidates see 'files renamed' and 'ransom note' but may confuse the delivery method (Trojan) or propagation (Worm) with the actual malware type, which is defined by its payload—encryption for extortion—not how it arrived or spread.
How to eliminate wrong answers
Option A is wrong because a Trojan is a type of malware that disguises itself as legitimate software, but the core behavior here is file encryption and ransom demand, not just deception. Option B is wrong because a Worm self-replicates and spreads automatically across networks without user interaction, but the question focuses on the post-reboot encryption and ransom note, not propagation. Option D is wrong because a Rootkit is designed to hide its presence and maintain stealthy persistence, but the visible symptoms are encrypted files and a ransom demand, not hidden processes or stealth.
Based on the exhibit, which malware type best explains the behavior?
A.Trojan
B.Rootkit
C.Logic bomb
D.Spyware
AnswerB
The exhibit shows a hidden listener associated with PID 4, an unsigned driver, and a mismatch between user-mode process enumeration and kernel telemetry. Those are classic rootkit indicators because rootkits operate at a low level to conceal processes, ports, or files from standard tools. The suspicious driver name and kernel-level inconsistency are especially strong clues that the malware is trying to hide itself from the operating system and defenders.
Why this answer
A rootkit is designed to hide its presence and the presence of other malware by modifying the operating system's kernel or system calls, allowing it to evade detection by security tools. The exhibit likely shows behavior such as file hiding, process concealment, or system call interception, which are hallmarks of rootkit activity. This aligns with the SY0-701 objective on understanding malware types and their characteristics.
Exam trap
The trap here is that candidates often confuse a rootkit's stealth capabilities with a Trojan's deceptive delivery method, failing to recognize that the exhibit's focus on hiding and persistence at the OS level is unique to rootkits, not general malware types.
How to eliminate wrong answers
Option A (Trojan) is wrong because a Trojan disguises itself as legitimate software to trick users into installing it, but it does not inherently hide its presence or modify the kernel to evade detection; the exhibit's behavior of stealth and system-level concealment is not typical of a Trojan. Option C (Logic bomb) is wrong because a logic bomb is a piece of code that executes a malicious payload when specific conditions are met (e.g., a date or user action), but it does not actively hide itself or its processes; the exhibit's ongoing stealth behavior is inconsistent with a dormant trigger-based mechanism. Option D (Spyware) is wrong because spyware focuses on covertly collecting user data (e.g., keystrokes, browsing habits) and sending it to an attacker, but it does not typically modify the OS kernel or hide its own files and processes at the rootkit level; the exhibit's system-level concealment goes beyond spyware's typical user-space monitoring.
Based on the exhibit, which security issue should the analyst report first?
A.Outdated component, because the scan did not list software version details.
B.Exposed service, because VNC and the web admin interface are reachable from untrusted networks.
C.Weak permissions, because SSH requires password login only.
D.Default credentials, because the server is in the DMZ.
AnswerB
The most important issue is the exposed service because remote management interfaces are reachable from any source network, and VNC authentication is disabled. That combination creates a high-risk attack surface, especially for a server in the DMZ that stores sensitive customer information.
Why this answer
The scan reveals that VNC (port 5900) and a web admin interface (port 443 or 8080) are exposed to untrusted networks, such as the internet. This violates the principle of least exposure, as these services are known attack vectors for remote code execution and credential theft. The analyst should prioritize this issue because an exposed service directly increases the attack surface and risk of unauthorized access, whereas other findings may be less immediately critical.
Exam trap
The trap here is that candidates often focus on missing version details (Option A) or default credentials (Option D) as the most critical finding, but CompTIA emphasizes that exposed services on untrusted networks pose the highest immediate risk because they are directly exploitable without requiring prior access.
How to eliminate wrong answers
Option A is wrong because the absence of software version details in the scan does not necessarily indicate an outdated component; it may simply mean the scanner could not fingerprint the version due to banner hiding or firewall restrictions. Option C is wrong because SSH requiring password login only is not inherently a weak permission; weak permissions refer to file or directory access controls, not authentication methods, and password-based SSH is still common in many environments. Option D is wrong because default credentials are not indicated by the server being in the DMZ; the scan does not show any evidence of default username/password usage, and the DMZ placement alone does not confirm this vulnerability.
A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?
A.Trojan
B.Fileless attack
C.Rootkit
D.Worm
AnswerB
This is the correct classification. Fileless attacks leverage trusted system tools (e.g., PowerShell, WMI, or .NET) to execute malicious code directly in memory, avoiding writing an executable to disk. The alert's focus on in-memory execution and the absence of a dropped file are hallmarks of this technique. These attacks are particularly dangerous because they leave few forensic traces, evade signature-based detection, and often exploit legitimate administrative capabilities.
Why this answer
The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.
Exam trap
The trap here is that candidates see 'downloaded an encoded command' and assume a file was written, but the key distinction is that no executable file was written to disk, making it a fileless attack rather than a Trojan or rootkit.
How to eliminate wrong answers
Option A is wrong because a Trojan is a malicious program disguised as legitimate software that typically writes a file to disk and requires user installation, whereas this attack uses a scheduled task to launch PowerShell and never writes a suspicious executable. Option C is wrong because a rootkit is designed to hide the presence of malware or maintain privileged access by modifying the operating system kernel or boot process, which is not indicated by the PowerShell-to-rundll32 chain and lack of persistence mechanisms described.
A web form stores a user's comment and later displays it to other users. A tester submits <script>alert(1)</script> and the script runs in the browser. What vulnerability is this?
A.SQL injection
B.Cross-site request forgery
C.Cross-site scripting
D.Command injection
AnswerC
The application reflects untrusted input into a page without proper encoding, allowing script execution.
Why this answer
The tester's input <script>alert(1)</script> is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.
Exam trap
The trap here is that candidates may confuse XSS with SQL injection because both involve injecting malicious input, but XSS targets the browser's execution context while SQL injection targets the database query layer.
How to eliminate wrong answers
Option A is wrong because SQL injection involves injecting SQL commands into database queries (e.g., ' OR 1=1 --), not client-side script execution; the input here does not alter a database query. Option B is wrong because cross-site request forgery (CSRF) tricks a victim into performing an unintended action on an authenticated site, but the tester's input directly executes script in the browser without requiring a forged request. Option D is wrong because command injection targets server-side operating system commands (e.g., ; ls -la), not client-side JavaScript execution in the browser.
A user receives an SMS from 'IT Service Desk' saying their MFA enrollment expires today and includes a shortened link. Five minutes later, the user gets a phone call from the same number asking them to read back the code shown in the authenticator app so the ticket can be closed. Which two attack channels are used in this campaign? Select two.
Select 2 answers
A.Email phishing is used because the attacker is requesting a login action.
B.Smishing is used because the first lure arrives by text message.
C.Vishing is used because the follow-up request occurs by phone call.
D.Baiting is used because the attacker offers a free reward or device.
E.Tailgating is used because the attacker follows someone into a restricted area.
AnswersB, C
Smishing is phishing delivered through SMS or another text-based mobile messaging channel. The fake IT Service Desk text with a shortened link is a classic example because it attempts to get the user to click a link and interact outside the normal support process.
Why this answer
The initial attack vector is an SMS message containing a shortened link, which is the definition of smishing (SMS phishing). The attacker uses this to create urgency and lure the victim into engaging with the MFA enrollment scam.
Exam trap
The trap here is that candidates may focus on the phone call as the only attack channel and overlook the initial SMS, or they may confuse smishing with vishing, not recognizing that both channels are used sequentially in a single campaign.
An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?
A.Tailgating, because the attacker is trying to enter a secure area physically.
B.Pretexting, because the attacker is using a fake identity and story to gain trust.
C.DDoS, because the message is designed to overwhelm the mailbox server.
D.Shoulder surfing, because the attacker is watching the screen from nearby.
AnswerB
Pretexting is a social engineering technique where the attacker fabricates a scenario and adopts a trusted role—here, an IT support agent—to elicit sensitive information. The email invents a believable reason, such as account verification or troubleshooting, to lower the victim's suspicion and prompt disclosure of the one-time code. This relies on establishing false trust and exploiting the victim's willingness to comply with an authority figure, making it distinct from technical attacks.
Why this answer
The attacker is using a fabricated identity (IT support) and a false scenario (mailbox repair requiring a verification code) to manipulate the employee into divulging sensitive information. This is the classic definition of pretexting, where the attacker creates a believable pretext to lower the victim's defenses and extract data or access.
Exam trap
The trap here is that candidates confuse pretexting with phishing, but pretexting specifically relies on a fabricated scenario or identity (the 'pretext') rather than a generic lure like a malicious link or attachment.
How to eliminate wrong answers
Option A is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area, not a social engineering technique involving email or phone. Option C is wrong because a DDoS (Distributed Denial of Service) attack overwhelms a server with traffic to disrupt service, not to trick a user into revealing a code. Option D is wrong because shoulder surfing involves directly observing someone's screen or keyboard from close proximity to steal information, not using a remote email message.
NetFlow and authentication logs show one workstation opening SMB and WinRM sessions to many internal hosts within ten minutes. The same source also generates a sharp rise in Kerberos service-ticket requests and attempts to access administrative shares. Which three observations most strongly support lateral movement rather than normal admin activity? Select three.
Select 3 answers
A.A rapid burst of SMB and WinRM connections to many internal systems from one source host.
B.A sharp increase in Kerberos service-ticket requests from the same workstation.
C.Repeated attempts to access administrative shares such as ADMIN$ or C$.
D.Regular outbound DNS lookups for common internet services like time synchronization or content delivery.
E.A successful sign-in to the user's cloud email account from the employee's home network at lunchtime.
AnswersA, B, C
A sudden fan-out of administrative protocols from one workstation is a classic sign of lateral movement. Normal admin activity is usually more targeted and scheduled. A burst like this suggests an automated attempt to enumerate, authenticate, or execute remotely across the environment.
Why this answer
A rapid burst of SMB and WinRM connections from a single workstation to many internal hosts is a classic indicator of lateral movement. Normal administrative activity typically involves targeted, sequential connections to specific systems for maintenance, not a broad, automated sweep. This pattern suggests an attacker using tools like PsExec or PowerShell remoting to propagate across the network.
Exam trap
The trap here is that candidates may confuse normal administrative tasks with malicious lateral movement, but the key differentiator is the rapid, broad, and automated nature of the connections, combined with the specific targeting of administrative shares and Kerberos ticket requests, which are not typical for routine admin work.