Security+ Threats, Vulnerabilities and Attacks Practice Questions
Domain 2 of 5 · 22% of SY0-701 and 24% of SY0-801
90 questions across all five domains in 90 minutes, with a score for each domain so you know where you stand.
Free Threats and Vulnerabilities drillAn attacker in an airport lounge watches an employee type her laptop password. What is this attack?
Threats, Vulnerabilities, and Attacks on the Security+ exam
Threats is 22% of SY0-701 and 24% of SY0-801, about 20 of 90 questions on SY0-701 and 22 on SY0-801. SY0-701 calls the domain Threats, Vulnerabilities, and Mitigations; SY0-801 renames it Threats, Vulnerabilities, and Attacks, moves mitigation techniques to Security Operations and adds a new objective on threats from AI. Most questions describe a symptom or scenario and ask you to name the attack or actor.
- Share of the exam
- 22% of SY0-701 (about 20 of 90 questions) and 24% of SY0-801 (about 22)
- Our drill
- 10 questions from 88 Threats and Vulnerabilities questions, untimed, a note on every option or row; one free attempt, unlimited with a pass
What Threats and Vulnerabilities questions test
- Threat actors (nation-state, organized crime, hacktivist, insider, unskilled attacker) and their motivations and resources
- Threat vectors: email, SMS and voice phishing, QR codes, removable media, watering holes, supply chain and managed service providers, wireless and Bluetooth
- Vulnerabilities: unsupported and unpatched systems, misconfigurations, race conditions, hardcoded secrets, VM escape, sideloading, zero-days, CVE and CVSS
- Indicators of malicious activity: ransomware, worms, Trojans, rootkits, logic bombs, DDoS, DNS poisoning, on-path, downgrade and replay attacks, injection, XSS, CSRF, password spraying and credential stuffing, impossible travel and missing logs
- AI threats (SY0-801): prompt injection, data poisoning, jailbreaking, hallucinations, evasion, explainability, bias, privacy and data loss
Sit the full exam under the real clock
90 questions across all five domains in 90 minutes, with a score for each domain so you know where you stand.
Free Threats and Vulnerabilities drillHow to study it
- Build a symptom table: for each attack, the one clue that identifies it (one password across many accounts is spraying; many passwords on one account is brute force).
- Separate vectors (how the attack arrives) from attacks (what it does) from actors (who is behind it).
- Read the log and scenario details carefully; Domain 2 questions hinge on one phrase.
- If you are taking SY0-801, drill the AI threats until each term is automatic; they are new and easy to confuse.
Common questions
What changed in Domain 2 between SY0-701 and SY0-801?
The name changed from Threats, Vulnerabilities, and Mitigations to Threats, Vulnerabilities, and Attacks, its weight rose from 22% to 24%, mitigation techniques such as segmentation and hardening moved to Security Operations, and a new objective covers threats and vulnerabilities from AI usage.
How many threat and attack questions are on Security+?
Domain 2 is 22% of SY0-701, about 20 of 90 questions, and 24% of SY0-801, about 22 of 90.
90 questions across all five domains in 90 minutes, with a score for each domain so you know where you stand.
Free Threats and Vulnerabilities drillMore Security+ practice
Sources
Original practice questions for exam preparation, written to the CompTIA Security+ SY0-701 domain weights and the SY0-801 exam objectives; none comes from a real exam. Independent practice, not affiliated with or endorsed by CompTIA. CompTIA and Security+ are trademarks of CompTIA, Inc.