CompTIA Security+ SY0-601 Exam
Practice Questions & Solutions (100%
Accurate)
2025
CompTIA SECURITY+
[Company address]
, CompTIA Security+ SY0-601 Exam
Practice Questions & Solutions (100%
Accurate)
An attacker installs Trojan malware that can execute remote backdoor commands, such
as the ability to upload files and install software to a victim PC. What type of Trojan
malware is this? - ANSWER - A Remote Access Trojan (RAT)
A hacker is trying to gain remote access to a company computer by trying brute force
password attacks using a few common passwords in conjunction with multiple
usernames. What specific type of password attack is the hacker most likely performing?
- ANSWER - Password spraying attack
An attacker can exploit a weakness in a password protocol to calculate the hash of a
password. Which of the following can the attacker match the hash to, as a means to
obtain the password? (Select all that apply.) - ANSWER - -A rainbow table
-A dictionary word
Which of the following attacks do security professionals expose themselves to, if they
do not salt passwords with a random value? - ANSWER - A rainbow table attack
How can an attacker make unauthorized use of acquired user and account details from
a user's smart card? - ANSWER - Clone it.
What type of attack is occurring when a counterfeit card reader is in use? - ANSWER -
Skimming
An attacker discovered an input validation vulnerability on a website, crafted a URL with
additional HTML code, and emailed the link to a victim. The victim unknowingly defaced
(vandalized) the web site after clicking on the malicious URL. No other malicious
operations occurred outside of the web application's root directory. This scenario is
describing which type of attack? - ANSWER - Cross-site scripting (XSS)
An attacker escalated privileges to a local administrator and used code refactoring to
evade antivirus detection. The attacker then allowed one process to attach to another
and forced the operating system to load a malicious binary package. What did the
attacker successfully perform? - ANSWER - DLL injection
Using an open connection to a small company's network, an attacker submitted arbitrary
queries on port 389 to the domain controllers. The attacker initiated the query from a
client computer. What type of injection attack did the attacker perform? - ANSWER -
LDAP injection
, How can the lack of logic statement tests on memory location variables be detrimental
to software in development? - ANSWER - A malicious process can alter the execution
environment to create a null pointer, and crash the program.
A user used an administrator account to download and install a software application.
After the user launched the .exe extension installer file, the user experienced frequent
crashes, slow computer performance, and strange services running when turning on the
computer. What most likely happened to cause these issues? - ANSWER - The user
installed Trojan horse malware.
A security operations center (SOC) analyst investigates the propagation of a memory-
resident virus across the network and notices a rapid consumption of network
bandwidth, causing a Denial of Service (DoS). What type of virus is this? - ANSWER - A
worm
A user purchased a laptop from a local computer shop. After powering on the laptop for
the first time, the user noticed a few programs like Norton Antivirus asking for
permission to install. How would an IT security specialist classify these programs? -
ANSWER - PUP (potentially unwanted program)
A fileless malicious software can replicate between processes in memory on a local
host or over network shares. What other behaviors and techniques would classify
malware as fileless rather than a normal virus? (Select all that apply.) - ANSWER - -
Uses lightweight shellcode
-Uses low observable characteristic attacks
An attacker is planning to set up a backdoor that will infect a set of specific computers at
an organization, to inflict a set of other intrusion attacks remotely. Which of the following
will support the attackers' plan? (Select all that apply.) - ANSWER - -Computer Bots,
-Command & Control
If a user's computer becomes infected with a botnet, which of the following can this
compromise allow the attacker to do? (Select all that apply.) - ANSWER - -Launch a
Distributed Denial of Service (DDoS) attack
-Establish a connection with a Command and Control server
-Launch a mass-mail spam attack
If a user's device becomes infected with crypto-malware, which of the following is the
best way to mitigate this compromise? - ANSWER - Have up-to-date backups.
A security specialist discovers a malicious script on a computer. The script is set to
execute if the administrator's account becomes disabled. What type of malware did the
specialist discover? - ANSWER - A logic bomb
End-users at an organization contact the cybersecurity department. After downloading a
file, they are being redirected to shopping websites they did not intend to navigate to,
Practice Questions & Solutions (100%
Accurate)
2025
CompTIA SECURITY+
[Company address]
, CompTIA Security+ SY0-601 Exam
Practice Questions & Solutions (100%
Accurate)
An attacker installs Trojan malware that can execute remote backdoor commands, such
as the ability to upload files and install software to a victim PC. What type of Trojan
malware is this? - ANSWER - A Remote Access Trojan (RAT)
A hacker is trying to gain remote access to a company computer by trying brute force
password attacks using a few common passwords in conjunction with multiple
usernames. What specific type of password attack is the hacker most likely performing?
- ANSWER - Password spraying attack
An attacker can exploit a weakness in a password protocol to calculate the hash of a
password. Which of the following can the attacker match the hash to, as a means to
obtain the password? (Select all that apply.) - ANSWER - -A rainbow table
-A dictionary word
Which of the following attacks do security professionals expose themselves to, if they
do not salt passwords with a random value? - ANSWER - A rainbow table attack
How can an attacker make unauthorized use of acquired user and account details from
a user's smart card? - ANSWER - Clone it.
What type of attack is occurring when a counterfeit card reader is in use? - ANSWER -
Skimming
An attacker discovered an input validation vulnerability on a website, crafted a URL with
additional HTML code, and emailed the link to a victim. The victim unknowingly defaced
(vandalized) the web site after clicking on the malicious URL. No other malicious
operations occurred outside of the web application's root directory. This scenario is
describing which type of attack? - ANSWER - Cross-site scripting (XSS)
An attacker escalated privileges to a local administrator and used code refactoring to
evade antivirus detection. The attacker then allowed one process to attach to another
and forced the operating system to load a malicious binary package. What did the
attacker successfully perform? - ANSWER - DLL injection
Using an open connection to a small company's network, an attacker submitted arbitrary
queries on port 389 to the domain controllers. The attacker initiated the query from a
client computer. What type of injection attack did the attacker perform? - ANSWER -
LDAP injection
, How can the lack of logic statement tests on memory location variables be detrimental
to software in development? - ANSWER - A malicious process can alter the execution
environment to create a null pointer, and crash the program.
A user used an administrator account to download and install a software application.
After the user launched the .exe extension installer file, the user experienced frequent
crashes, slow computer performance, and strange services running when turning on the
computer. What most likely happened to cause these issues? - ANSWER - The user
installed Trojan horse malware.
A security operations center (SOC) analyst investigates the propagation of a memory-
resident virus across the network and notices a rapid consumption of network
bandwidth, causing a Denial of Service (DoS). What type of virus is this? - ANSWER - A
worm
A user purchased a laptop from a local computer shop. After powering on the laptop for
the first time, the user noticed a few programs like Norton Antivirus asking for
permission to install. How would an IT security specialist classify these programs? -
ANSWER - PUP (potentially unwanted program)
A fileless malicious software can replicate between processes in memory on a local
host or over network shares. What other behaviors and techniques would classify
malware as fileless rather than a normal virus? (Select all that apply.) - ANSWER - -
Uses lightweight shellcode
-Uses low observable characteristic attacks
An attacker is planning to set up a backdoor that will infect a set of specific computers at
an organization, to inflict a set of other intrusion attacks remotely. Which of the following
will support the attackers' plan? (Select all that apply.) - ANSWER - -Computer Bots,
-Command & Control
If a user's computer becomes infected with a botnet, which of the following can this
compromise allow the attacker to do? (Select all that apply.) - ANSWER - -Launch a
Distributed Denial of Service (DDoS) attack
-Establish a connection with a Command and Control server
-Launch a mass-mail spam attack
If a user's device becomes infected with crypto-malware, which of the following is the
best way to mitigate this compromise? - ANSWER - Have up-to-date backups.
A security specialist discovers a malicious script on a computer. The script is set to
execute if the administrator's account becomes disabled. What type of malware did the
specialist discover? - ANSWER - A logic bomb
End-users at an organization contact the cybersecurity department. After downloading a
file, they are being redirected to shopping websites they did not intend to navigate to,
