CYBERSECURITY CERTIFICATION — COMPTIA
CompTIA Security+ Exam A+
2026/2027 | CompTIA
Complete Review with Questions
& Verified Answers 2026/2027
Official Examination — Professional Certification Level
A+ 5 100%
QUESTIONS VERIFIED EXAM DOMAINS COVERED RATIONALES INCLUDED
CATEGORIES
■ Threats, Attacks and Vulnerabilities
■ Architecture and Design
■ Implementation
■ Operations and Incident Response
■ Governance, Risk and Compliance
STUVIAACTUALEXAM
Passing Score: 65% (scaled) | 1 Mark per Question | Professional Certification
STUVIAACTUALEXAM Page 1
, SECTION 1: THREATS, ATTACKS AND VULNERABILITIES
Q1. A security analyst reviews SIEM alerts showing multiple failed login attempts followed by a successful login from an unfamiliar
geographic location. The account belongs to a finance employee who is currently on vacation in a different country. The analyst must
classify the most likely attack type.
A. A supply-chain compromise of the VPN appliance firmware
B. A watering-hole attack targeting the employee’s personal blog
C. Credential stuffing using previously breached username-password pairs
D. An insider threat involving a co-worker who knows the password
Correct Answer: C
Rationale: The pattern of many failed attempts followed by success from an unexpected location is characteristic of credential stuffing, in which attackers
automate login attempts with credentials obtained from prior breaches.
Q2. During a penetration test the red team sends a crafted email that appears to come from the CEO, urging the CFO to wire funds to a
new vendor account. The email contains no malicious links or attachments. What social-engineering technique is being demonstrated?
A. Phishing that relies on a malicious payload
B. Dumpster diving for printed financial records
C. Tailgating into a restricted facility
D. Business email compromise / spear-phishing focused on authority and urgency
Correct Answer: D
Rationale: Impersonating a senior executive to induce a financial transfer is a classic business-email-compromise (BEC) or spear-phishing scenario that
exploits authority and urgency without requiring malware.
Q3. A web application firewall logs repeated requests that include long strings of encoded characters designed to overflow a buffer in a
legacy input-validation routine. The attack is unsuccessful because the application now uses memory-safe coding practices. Which
vulnerability class was the attacker attempting to exploit?
A. SQL injection
B. Buffer overflow
C. Cross-site scripting
D. XML external entity injection
Correct Answer: B
Rationale: Long, carefully crafted input intended to overwrite adjacent memory is the hallmark of a buffer-overflow attempt. Modern memory-safe
languages and bounds checking mitigate this class of vulnerability.
Q4. An organization discovers that a previously unknown vulnerability in a widely used open-source library is being actively exploited in
the wild. No patch is yet available from the maintainer. How is this type of vulnerability commonly classified?
A. A zero-day vulnerability
B. A known public CVE that has been patched for months
C. A misconfiguration rather than a software flaw
D. An advanced persistent threat exclusive to nation-state actors
Correct Answer: A
Rationale: A zero-day is a vulnerability that is unknown to the vendor or for which no patch exists at the time it is exploited, leaving defenders without an
official remediation.
Q5. A network sensor detects a sudden flood of SYN packets directed at a public web server, exhausting the server’s backlog queue and
preventing legitimate connections. Which attack is occurring?
A. ARP spoofing man-in-the-middle
B. SYN flood denial-of-service
C. DNS cache poisoning
D. Pass-the-hash lateral movement
Correct Answer: B
Rationale: A SYN flood overwhelms a target by sending large numbers of TCP SYN packets without completing the handshake, consuming
connection-state resources and denying service to legitimate clients.
Q6. A security engineer notices that several workstations are communicating with an external IP address on a non-standard high port
and are also making DNS queries for randomly generated domain names. What type of malware behavior is most consistent with these
indicators?
A. Ransomware that only encrypts local files with no network activity
B. Adware that displays pop-up advertisements
C. A simple keylogger that stores data only on the local disk
D. A botnet client using domain-generation algorithms for command-and-control
Correct Answer: D
Rationale: Domain-generation algorithms (DGAs) produce rapidly changing domain names so that malware can locate its command-and-control
infrastructure even when individual domains are blocked, a common botnet trait.
STUVIAACTUALEXAM Page 2
, Q7. An attacker gains initial access to a workstation through a malicious macro and then uses legitimate administrative tools already
present on the system to move laterally and escalate privileges. Which technique describes this approach?
A. Physical theft of a domain controller
B. Deployment of a custom rootkit that replaces kernel modules
C. Living-off-the-land (LotL) using dual-use tools
D. Exploitation of a zero-day in the browser rendering engine only
Correct Answer: C
Rationale: Living-off-the-land attacks rely on native operating-system binaries and administrative utilities (PowerShell, WMI, PsExec, etc.) to avoid
introducing new malicious binaries that would be easier to detect.
Q8. A company receives a ransom note claiming that sensitive customer data has been exfiltrated and will be published unless payment
is made. Forensic analysis confirms that data left the network weeks earlier. What type of modern ransomware campaign does this
describe?
A. Traditional ransomware that only encrypts files with no exfiltration
B. Double-extortion ransomware that combines encryption with data theft and threats of disclosure
C. A pure DDoS extortion campaign with no data involvement
D. A phishing campaign that never resulted in actual compromise
Correct Answer: B
Rationale: Double-extortion (or multi-extortion) ransomware operators both encrypt systems and steal data, then threaten to leak the data if the ransom is
not paid, increasing pressure on the victim.
Q9. A developer reviews code and finds a function that concatenates user input directly into a SQL query string without parameterization.
What vulnerability does this introduce?
A. SQL injection
B. Cross-site request forgery
C. Server-side request forgery
D. Insecure deserialization
Correct Answer: A
Rationale: Constructing SQL statements by direct concatenation of untrusted input allows an attacker to alter the query’s logic, which is the definition of a
SQL-injection vulnerability.
Q10. An employee receives a USB drive labeled “Q4 Financial Bonuses” left in the parking lot. The employee plugs it into a corporate
laptop out of curiosity. Which attack vector is being used?
A. A supply-chain attack on the laptop firmware
B. A remote network exploit requiring no user interaction
C. A physical social-engineering attack that relies on removable media
D. A watering-hole attack on a frequently visited website
Correct Answer: C
Rationale: Leaving infected or malicious removable media in a location where employees are likely to find and insert it is a classic physical
social-engineering technique.
Q11. A security team observes traffic that appears to be legitimate HTTPS but, when decrypted at a proxy, contains commands that
download additional payloads. The initial foothold was gained through a phishing email. What stage of the attack lifecycle is represented
by the encrypted command channel?
A. Command-and-control (C2) communication
B. Initial reconnaissance only
C. Purely passive vulnerability scanning
D. Final data destruction with no further communication
Correct Answer: A
Rationale: After initial compromise, attackers establish a command-and-control channel to issue instructions and retrieve additional tools; encrypting that
channel helps evade detection.
Q12. A web application accepts file uploads and stores them in a directory that is directly reachable by the web server. An attacker
uploads a script and then requests it via the browser, achieving remote code execution. What vulnerability enabled this outcome?
A. Unrestricted file upload combined with improper storage location
B. Broken authentication on the login page
C. Missing HTTP Strict Transport Security header
D. Insufficient logging of administrative actions
Correct Answer: A
Rationale: Allowing arbitrary file uploads and placing them in a web-accessible directory without proper validation or execution controls enables an
attacker to upload and then execute malicious code.
STUVIAACTUALEXAM Page 3
CompTIA Security+ Exam A+
2026/2027 | CompTIA
Complete Review with Questions
& Verified Answers 2026/2027
Official Examination — Professional Certification Level
A+ 5 100%
QUESTIONS VERIFIED EXAM DOMAINS COVERED RATIONALES INCLUDED
CATEGORIES
■ Threats, Attacks and Vulnerabilities
■ Architecture and Design
■ Implementation
■ Operations and Incident Response
■ Governance, Risk and Compliance
STUVIAACTUALEXAM
Passing Score: 65% (scaled) | 1 Mark per Question | Professional Certification
STUVIAACTUALEXAM Page 1
, SECTION 1: THREATS, ATTACKS AND VULNERABILITIES
Q1. A security analyst reviews SIEM alerts showing multiple failed login attempts followed by a successful login from an unfamiliar
geographic location. The account belongs to a finance employee who is currently on vacation in a different country. The analyst must
classify the most likely attack type.
A. A supply-chain compromise of the VPN appliance firmware
B. A watering-hole attack targeting the employee’s personal blog
C. Credential stuffing using previously breached username-password pairs
D. An insider threat involving a co-worker who knows the password
Correct Answer: C
Rationale: The pattern of many failed attempts followed by success from an unexpected location is characteristic of credential stuffing, in which attackers
automate login attempts with credentials obtained from prior breaches.
Q2. During a penetration test the red team sends a crafted email that appears to come from the CEO, urging the CFO to wire funds to a
new vendor account. The email contains no malicious links or attachments. What social-engineering technique is being demonstrated?
A. Phishing that relies on a malicious payload
B. Dumpster diving for printed financial records
C. Tailgating into a restricted facility
D. Business email compromise / spear-phishing focused on authority and urgency
Correct Answer: D
Rationale: Impersonating a senior executive to induce a financial transfer is a classic business-email-compromise (BEC) or spear-phishing scenario that
exploits authority and urgency without requiring malware.
Q3. A web application firewall logs repeated requests that include long strings of encoded characters designed to overflow a buffer in a
legacy input-validation routine. The attack is unsuccessful because the application now uses memory-safe coding practices. Which
vulnerability class was the attacker attempting to exploit?
A. SQL injection
B. Buffer overflow
C. Cross-site scripting
D. XML external entity injection
Correct Answer: B
Rationale: Long, carefully crafted input intended to overwrite adjacent memory is the hallmark of a buffer-overflow attempt. Modern memory-safe
languages and bounds checking mitigate this class of vulnerability.
Q4. An organization discovers that a previously unknown vulnerability in a widely used open-source library is being actively exploited in
the wild. No patch is yet available from the maintainer. How is this type of vulnerability commonly classified?
A. A zero-day vulnerability
B. A known public CVE that has been patched for months
C. A misconfiguration rather than a software flaw
D. An advanced persistent threat exclusive to nation-state actors
Correct Answer: A
Rationale: A zero-day is a vulnerability that is unknown to the vendor or for which no patch exists at the time it is exploited, leaving defenders without an
official remediation.
Q5. A network sensor detects a sudden flood of SYN packets directed at a public web server, exhausting the server’s backlog queue and
preventing legitimate connections. Which attack is occurring?
A. ARP spoofing man-in-the-middle
B. SYN flood denial-of-service
C. DNS cache poisoning
D. Pass-the-hash lateral movement
Correct Answer: B
Rationale: A SYN flood overwhelms a target by sending large numbers of TCP SYN packets without completing the handshake, consuming
connection-state resources and denying service to legitimate clients.
Q6. A security engineer notices that several workstations are communicating with an external IP address on a non-standard high port
and are also making DNS queries for randomly generated domain names. What type of malware behavior is most consistent with these
indicators?
A. Ransomware that only encrypts local files with no network activity
B. Adware that displays pop-up advertisements
C. A simple keylogger that stores data only on the local disk
D. A botnet client using domain-generation algorithms for command-and-control
Correct Answer: D
Rationale: Domain-generation algorithms (DGAs) produce rapidly changing domain names so that malware can locate its command-and-control
infrastructure even when individual domains are blocked, a common botnet trait.
STUVIAACTUALEXAM Page 2
, Q7. An attacker gains initial access to a workstation through a malicious macro and then uses legitimate administrative tools already
present on the system to move laterally and escalate privileges. Which technique describes this approach?
A. Physical theft of a domain controller
B. Deployment of a custom rootkit that replaces kernel modules
C. Living-off-the-land (LotL) using dual-use tools
D. Exploitation of a zero-day in the browser rendering engine only
Correct Answer: C
Rationale: Living-off-the-land attacks rely on native operating-system binaries and administrative utilities (PowerShell, WMI, PsExec, etc.) to avoid
introducing new malicious binaries that would be easier to detect.
Q8. A company receives a ransom note claiming that sensitive customer data has been exfiltrated and will be published unless payment
is made. Forensic analysis confirms that data left the network weeks earlier. What type of modern ransomware campaign does this
describe?
A. Traditional ransomware that only encrypts files with no exfiltration
B. Double-extortion ransomware that combines encryption with data theft and threats of disclosure
C. A pure DDoS extortion campaign with no data involvement
D. A phishing campaign that never resulted in actual compromise
Correct Answer: B
Rationale: Double-extortion (or multi-extortion) ransomware operators both encrypt systems and steal data, then threaten to leak the data if the ransom is
not paid, increasing pressure on the victim.
Q9. A developer reviews code and finds a function that concatenates user input directly into a SQL query string without parameterization.
What vulnerability does this introduce?
A. SQL injection
B. Cross-site request forgery
C. Server-side request forgery
D. Insecure deserialization
Correct Answer: A
Rationale: Constructing SQL statements by direct concatenation of untrusted input allows an attacker to alter the query’s logic, which is the definition of a
SQL-injection vulnerability.
Q10. An employee receives a USB drive labeled “Q4 Financial Bonuses” left in the parking lot. The employee plugs it into a corporate
laptop out of curiosity. Which attack vector is being used?
A. A supply-chain attack on the laptop firmware
B. A remote network exploit requiring no user interaction
C. A physical social-engineering attack that relies on removable media
D. A watering-hole attack on a frequently visited website
Correct Answer: C
Rationale: Leaving infected or malicious removable media in a location where employees are likely to find and insert it is a classic physical
social-engineering technique.
Q11. A security team observes traffic that appears to be legitimate HTTPS but, when decrypted at a proxy, contains commands that
download additional payloads. The initial foothold was gained through a phishing email. What stage of the attack lifecycle is represented
by the encrypted command channel?
A. Command-and-control (C2) communication
B. Initial reconnaissance only
C. Purely passive vulnerability scanning
D. Final data destruction with no further communication
Correct Answer: A
Rationale: After initial compromise, attackers establish a command-and-control channel to issue instructions and retrieve additional tools; encrypting that
channel helps evade detection.
Q12. A web application accepts file uploads and stores them in a directory that is directly reachable by the web server. An attacker
uploads a script and then requests it via the browser, achieving remote code execution. What vulnerability enabled this outcome?
A. Unrestricted file upload combined with improper storage location
B. Broken authentication on the login page
C. Missing HTTP Strict Transport Security header
D. Insufficient logging of administrative actions
Correct Answer: A
Rationale: Allowing arbitrary file uploads and placing them in a web-accessible directory without proper validation or execution controls enables an
attacker to upload and then execute malicious code.
STUVIAACTUALEXAM Page 3
