SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
SY0-801 · Domain 2

Threats, Vulnerabilities, and Attacks practice questions

Threats, Vulnerabilities, and Attacks is worth 24% of the SY0-801 exam — the 2nd-heaviest of the 5 domains. Threat and vulnerability characteristics, threat actors, threat vectors, vulnerability types, indicators of malicious activity, and AI-related threats. Official weighting 24%. 6 fully worked examples are further down this page, answers included.

Exam weight
24%
the 2nd-heaviest of the 5 domains
Questions
257
across 6 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 5 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Threats, Vulnerabilities, and Attacks questions, fully explained

Questions from the SY0-801 bank mapped to domain 2, with the answer key and the reasoning behind every option. None of them repeat the examples on the main SY0-801 practice page.

Question 1Threats, Vulnerabilities, and Attacks

A company applies the vendor patch that fixes a critical flaw in its internet-facing VPN gateway. The same threat groups continue to target the company. Which of the following has changed as a direct result of the patch?

Choose one.

  • a
    The number of threat actors targeting it

    The patch does nothing to the attackers themselves; the stem says the same groups keep targeting the company. Threats exist independently of the organization's weaknesses.

  • b
    The likelihood of a successful attack Correct

    Patching removes the weakness the attackers would use, so the probability that an attack on the gateway succeeds drops.

  • c
    The impact if the gateway were breached

    Impact depends on what an attacker could reach and the harm it would cause, which is unchanged - the gateway still fronts the same network and data.

  • d
    The value of the assets behind the gateway

    Asset value is a business property of the data and systems; fixing a flaw does not make them more or less valuable.

The concept

Patching a vulnerability lowers the likelihood of a successful attack; it does not change the threat or the impact if a breach still happened.

Why that’s the answer

Risk is driven by likelihood and impact. Removing the weakness the attackers would use lowers the likelihood that an attack succeeds. The threat actors are outside the company's control and keep targeting it, and the impact of a breach is set by the gateway's position and the assets behind it, both unchanged. The tempting answer is impact, because 'less risk' feels like 'less damage', but the damage of a breach that did occur is the same.

How to reason it out
  1. Identify what the patch actually removes: the vulnerability.
  2. Ask which risk factor depends on the vulnerability: the likelihood of success.
  3. Check the threat: the stem says the same groups keep targeting the company.
  4. Check the impact: the assets and network behind the gateway are unchanged.

Exam tip: Fixing a weakness lowers likelihood; reducing the harm of a breach (backups, segmentation) lowers impact.

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE Explained — the lesson that teaches this.

Question 2Threats, Vulnerabilities, and Attacks

A risk analyst compares two findings. One is an unpatched kiosk on an isolated network segment that displays only public brochures. The other is an internet-facing payroll server with a flaw that is being actively exploited elsewhere. Which of the following describes the payroll server compared with the kiosk?

Choose one.

  • a
    Higher likelihood and higher impact Correct

    Internet exposure plus active exploitation raise the chance of attack, and payroll data is far more harmful to lose than public brochures.

  • b
    Higher likelihood and similar impact

    The likelihood part is right, but losing payroll data (personal and financial records) is far more harmful than exposing public brochures.

  • c
    Similar likelihood and higher impact

    The impact part is right, but an internet-facing server with an actively exploited flaw is much more likely to be attacked than an isolated kiosk.

  • d
    Similar likelihood and similar impact

    Both factors differ sharply: internet exposure and active exploitation raise the payroll server's likelihood, and payroll records are far more harmful to lose than public brochures.

The concept

Likelihood reflects how probable a successful attack is (exposure, exploit availability); impact reflects the harm if it succeeds (data sensitivity, business disruption).

Why that’s the answer

Rate each factor separately. Likelihood: the payroll server is reachable from the internet and its flaw is being exploited in the wild, while the kiosk is isolated - so likelihood is higher. Impact: payroll records are sensitive personal and financial data, while the kiosk holds only public material - so impact is higher too. Each other option gets at least one of the two factors wrong.

How to reason it out
  1. Rate likelihood from exposure and exploit activity.
  2. Rate impact from the sensitivity and business value of what would be lost.
  3. Combine the two ratings rather than judging the overall 'feel' of the finding.

Exam tip: Judge likelihood and impact separately: exposure and exploitation drive likelihood; data and business value drive impact.

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE Explained — the lesson that teaches this.

Question 3Threats, Vulnerabilities, and Attacks

During a risk assessment, an analyst estimates that a ransomware outbreak on the order-processing servers would stop shipments for three days and cost the company about $400,000. Which of the following is the analyst estimating?

Choose one.

  • a
    The impact Correct

    Lost shipments and a dollar cost are the magnitude of harm if the event occurs - the impact.

  • b
    The likelihood

    Likelihood is how probable the outbreak is. The analyst is describing the consequences if it happens, not how often or how probably it would happen.

  • c
    The risk appetite

    Risk appetite is how much risk the organization is willing to accept in pursuit of its goals; it is a leadership decision, not an estimate of one event's consequences.

  • d
    The threat level

    A threat level describes how active or capable an adversary is. The analyst's figures describe the damage to the business, not the attacker.

The concept

Impact is the magnitude of harm if a threat succeeds; likelihood is the probability that it does.

Why that’s the answer

Days of downtime and a monetary loss describe what the business suffers if the ransomware event happens, which is impact. Likelihood would be expressed as a probability or frequency. Risk appetite is an organizational tolerance set by leadership, and a threat level describes the adversary.

How to reason it out
  1. Look at what the estimate measures: downtime and cost.
  2. Those are consequences of an event that has happened.
  3. Consequences are impact; probability would be likelihood.

Exam tip: Cost and downtime = impact; probability or frequency = likelihood.

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE Explained — the lesson that teaches this.

Question 4Threats, Vulnerabilities, and Attacks

A flaw in an internal HR application has had a public proof-of-concept exploit for a week, and the application was recently opened to the internet for remote staff. The data it holds has not changed. Which of the following risk factors has increased the MOST?

Choose one.

  • a
    Likelihood Correct

    Public exploit code lowers the skill needed and internet exposure widens the pool of attackers, so the probability of a successful attack rises sharply.

  • b
    Impact

    Impact depends on the harm a compromise would cause. The stem says the data has not changed, so the damage from a breach is about the same.

  • c
    Asset value

    Asset value is what the data and system are worth to the business; exposing the application does not change that worth.

  • d
    Risk tolerance

    Risk tolerance is the variation in outcomes the organization is willing to accept. It is set by the business and does not rise because a system became more exposed.

The concept

Exploit availability and exposure are the main drivers of likelihood; they do not change impact.

Why that’s the answer

Two things changed: an exploit is publicly available and the application became reachable from the internet. Both make a successful attack more probable, so likelihood rises. The data, and therefore the harm of a breach, is unchanged, so impact and asset value stay the same. Risk tolerance is a business decision, not a property of the system.

How to reason it out
  1. List what changed: public exploit code and internet exposure.
  2. Ask whether each change affects the probability or the harm of a breach.
  3. Both affect the probability; the stem rules out a change in harm.
  4. Probability of a successful attack is likelihood.

Exam tip: Public exploit code + wider exposure = higher likelihood, even when the impact stays the same.

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE Explained — the lesson that teaches this.

Question 5Threats, Vulnerabilities, and Attacks

Which of the following controls primarily reduces the impact, rather than the likelihood, of a ransomware attack on a file server?

Choose one.

  • a
    Email attachment filtering

    Filtering stops many malicious attachments from arriving, which lowers the chance of infection - a likelihood control.

  • b
    Application allowlisting

    Allowlisting blocks unapproved executables such as ransomware from running, lowering the chance of a successful attack - a likelihood control.

  • c
    Immutable offline backups Correct

    Backups do not stop the infection, but they let the organization restore files without paying, which limits the harm - an impact control.

  • d
    Phishing awareness training

    Training makes users less likely to open the lure that delivers ransomware, which lowers likelihood rather than the damage once encryption happens.

The concept

Controls that stop an attack from succeeding lower likelihood; controls that limit the damage once it succeeds lower impact.

Why that’s the answer

Filtering, allowlisting and awareness training all try to stop ransomware from getting in or running, so they reduce the probability of a successful attack. Immutable offline backups assume the attack succeeds and limit the consequence: encrypted files can be restored, shortening downtime and removing the need to pay.

How to reason it out
  1. Ask of each control: does it stop the attack, or soften its result?
  2. Filtering, allowlisting and training work before infection - likelihood.
  3. Backups work after encryption by enabling recovery - impact.

Exam tip: Prevent it = lower likelihood; recover from it = lower impact.

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE Explained — the lesson that teaches this.

Question 6Threats, Vulnerabilities, and Attacks

A security operations team wants its SIEM to receive malicious IP addresses, domains and file hashes automatically as an external provider publishes them. Which of the following should the team subscribe to?

Choose one.

  • a
    A threat feed Correct

    A threat feed is a continuously updated stream of indicators such as IPs, domains and hashes, designed to be ingested automatically by tools like a SIEM or firewall.

  • b
    A threat map

    A threat map is a visual display of attack activity around the world. It is useful for awareness but does not deliver machine-readable indicators to a SIEM.

  • c
    A vulnerability database

    A vulnerability database lists known flaws in products (for example with CVE IDs and scores). It does not provide indicators of attacker infrastructure.

  • d
    A CVSS calculator

    A CVSS calculator computes a severity score from metric values. It has nothing to do with collecting attacker indicators.

The concept

A threat feed delivers machine-readable indicators of compromise that security tools can ingest and act on automatically.

Why that’s the answer

The requirement is automatic delivery of indicators - IPs, domains, hashes - into a SIEM. That is the purpose of a threat feed. A threat map is a visual awareness tool, a vulnerability database describes product flaws rather than attacker infrastructure, and a CVSS calculator only scores severity.

How to reason it out
  1. Note what is needed: indicators of attacker activity.
  2. Note how they must arrive: automatically, into a tool.
  3. Pick the source built to stream machine-readable indicators.

Exam tip: Threat feeds stream indicators (IPs, domains, hashes) into security tools.

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE Explained — the lesson that teaches this.

What SY0-801 domain 2 tests, topic by topic

The official exam guide breaks Threats, Vulnerabilities, and Attacks into 6 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published SY0-801 practice questions per topic in Threats, Vulnerabilities, and Attacks
TopicWhat it coversQuestions
Explain characteristics of threats and vulnerabilitiesOfficial SY0-801 objective 2.1. Threats (threat feeds, likelihood, impact, intelligence sources, life cycle); vulnerabilities (scoring with CVSS, prioritization, vulnerability types, CVE).43
Describe common threat actors and motivationsOfficial SY0-801 objective 2.2. Actors (organized crime, terrorist, unskilled attacker, hacktivist, insider, accidental, competitor, state-sponsored); motivations (financial, influence, intellectual property, notoriety, espionage, fear/chaos, extortion, curiosity, revenge, ideological, political, ethical); attributes (internal/external, resources/funding, sophistication).43
Describe threat vectors and sourcesOfficial SY0-801 objective 2.3. APT; message-based (email, SMS, RCS, IM, collaboration tools); image-based (QR codes, embedded content, CAPTCHA); attachments (macros, RTF, PDF); browser-based (extensions, JavaScript, password managers, cookies, session tokens); network, remote access (RDP, VNC, VPN) and endpoint vectors incl. living-off-the-land tools; supply chain (third parties, MSPs, logistics, SaaS); malicious USB; human-based (impersonation, contractor, visitor, watering hole); IoT, OT, physical and signal-based (Bluetooth, RF, NFC).42
Explain types of vulnerabilities and attack surfacesOfficial SY0-801 objective 2.4. Unsupported, unpatched, obsolete and unmanaged systems; ports and services; application flaws (race conditions TOC/TOU, malicious update); code (hardcoded secrets, unsafe exception handling); OS-based; virtualization; zero-day; cryptographic weaknesses; unmanaged/stale credentials; rogue devices; shadow IT; wireless and low-powered comms; LLMs; identity providers; mobile devices; misconfiguration; public repositories and public object storage.43
Given a scenario, analyze indicators of malicious activityOfficial SY0-801 objective 2.5. Malware (ransomware, trojan, worm, spyware, adware, virus, rootkit, keylogger, logic bomb, fileless); physical attacks (tailgating, shoulder surfing, skimming, forced entry); network attacks (DDoS, protocol downgrade, rogue, sniffing, spoofing, on-path, DNS attacks, cache poisoning); social engineering (smishing, vishing, phishing, whaling, spear phishing, quishing, impersonation, deepfake); application attacks (injection, buffer overflow, replay, privilege escalation, forgery, directory traversal); credential attacks (password spraying, brute force, user enumeration, MFA bypass); indicators of compromise (hashes, IPs, domains, processes, file-system artifacts, log manipulation, resource consumption, account lockout, impossible travel, concurrent sessions).43
Summarize threats and vulnerabilities associated with artificial intelligence (AI) usageOfficial SY0-801 objective 2.6 (new in V8). Model manipulation, poisoning, prompt injection, data loss, bias, explainability, hallucinations, jailbreaking, evasion, privacy, ethical considerations, session hijacking and code execution.43
Total257

Revise Threats, Vulnerabilities, and Attacks before you drill it

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE ExplainedObjective 2.1 is tested mostly with short definitions and one-detail scenarios. You may be asked to classify an item as a threat, a vulnerability or a risk; to say whether a change or a control affects likelihood or impact; to pick the intelligence source or feed property that fits a stated need or failure; or to name the life cycle phase that a description or a breakdown points to. Vulnerability items set near-twin resources against each other (CVE, CWE, CVSS, EPSS, KEV, ATT&CK, NVD) and ask which one serves a purpose. CVSS items ask for a qualitative band, for the vector fragment that matches a scenario (attack vector, privileges required, user interaction), or for the metric group that holds a given fact, with distractors that mix up v3.1 and v4.0 group names. The harder items combine two facts, such as an exploitation signal plus exposure when ordering fixes, or a Threat and an Environmental adjustment to the same score. The specific vulnerability types and the vulnerability management process are covered by other objectives.Security+ SY0-801 Threat Actors and MotivationsObjective 2.2 is tested mostly through short scenarios: an incident is described with a few observable details (how access was gained, what happened afterwards, whether anyone claimed it or demanded anything) and you name the threat actor, the motivation or an attribute. Harder items ask for two dimensions at once, such as an actor and a motivation, or funding and capability, with options that mirror each other so that only careful reading of the evidence separates them. Expect near-twin pairs to be set against each other: financial and extortion, intellectual property and espionage, ideological and political, revenge and ethical disclosure, insider and accidental, hacktivist and terrorist, organized crime and state-sponsored. Some items disguise one actor as another or include several people, each of whom must be classified separately. Advanced persistent threats are covered under threat vectors and sources rather than this objective.Security+ SY0-801 Threat Vectors and Attack SourcesObjective 2.3 is tested mostly with short scenarios that describe how an attack arrived (a message in a particular app, a file type, a port seen in a scan, a device plugged in, a badge cloned at a distance) and ask which vector or source it represents, with the other options drawn from sibling vectors in the same category. Harder items combine two facts: why a control that is already in place did not stop the vector (macros blocked but an RTF exploited, MFA enforced but a session token replayed, mass storage blocked but a keyboard-emulating device, challenge-response cards but a live relay), or which control best fits a constraint such as PDFs that must still be readable or OT controllers that cannot be patched yet. Some items ask for the most direct control rather than the label, and distractors are often real controls aimed at a different channel.Security+ SY0-801 Vulnerability Types and Attack SurfacesObjective 2.4 is tested mainly with short scenarios that describe one weakness through an observable detail (a scan result, an access review finding, a code review note, a cloud permission) and ask which vulnerability type or attack surface it represents. The options are usually sibling entries from the same 2.4 list, so the decision rests on one fact: whether a fix exists and is installed, whether the asset was approved and is managed, whether a setting can be changed, or which layer (application, OS, hypervisor, cryptography) holds the flaw. Harder items combine two facts, such as a timeline that moves a flaw from zero-day to unpatched, an outdated system that still receives fixes, or an error path that grants access. Some ask for the most effective fix or first response rather than the label, such as making a check atomic, disabling an unneeded service, or rotating a leaked secret.Security+ SY0-801 Indicators of Malicious ActivityObjective 2.5 is a 'given a scenario' objective, so most items describe evidence, such as a log excerpt, an EDR alert, a door-access record, a message a user received or a pattern in authentication logs, and ask which attack or indicator it shows. Options are sibling terms from the same list (four malware types, four social-engineering variants, four credential attacks), so the deciding detail is usually small: whether a user ran anything, which server returned the wrong DNS answer, whether the browser or the server sent a forged request, whether accounts locked out, or which channel the attacker used. Harder items combine two indicators in one scenario, such as log clearing and timestamp tampering, or a sequence of enumeration followed by spraying, and some ask which indicator will stay useful longest. How attacks are delivered (threat vectors) and which weaknesses they exploit (vulnerability types) belong to neighbouring objectives.Security+ SY0-801 AI Threats and VulnerabilitiesObjective 2.6 is tested mainly through short scenarios: an AI system misbehaves or is misused, and you name the threat or vulnerability from the official list. Because the options are usually other items from the same list, you need to know what separates the near-twins: poisoning, model manipulation and evasion; prompt injection and jailbreaking; data loss and privacy; bias, explainability and hallucinations; and ethical considerations against regulatory compliance. Harder items combine two facts, ask for the underlying vulnerability rather than the resulting harm, or place a familiar attack such as session hijacking or code execution in an AI assistant, agent or model file. Some items are simple definitions.

Other SY0-801 domains

Domain 1: General Security Concepts16% of the exam · 176 questionsDomain 3: Security Architecture19% of the exam · 202 questionsDomain 4: Security Operations27% of the exam · 288 questionsDomain 5: Security Program Management and Oversight14% of the exam · 150 questionsAll SY0-801 practice questionsMixed sessions across all 5 domains — the way the real exam interleaves them.

Threats, Vulnerabilities, and Attacks: your questions

Threats, Vulnerabilities, and Attacks is domain 2 of the SY0-801 exam guide and carries 24% of the scored content — the 2nd-heaviest of the 5 domains. On a 90-question paper that works out to roughly 22 questions, though CompTIA does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official SY0-801 exam guide.