CompTIA Security+ Types of Attacks: Free Practice Questions + Study Guide

Social Engineering Attacks

Social engineering is the art of manipulating people into divulging confidential information or performing actions that compromise security. Rather than exploiting technical vulnerabilities, social engineering targets the human element - often the weakest link in any security chain. These attacks are heavily tested on the Security+ SY0-701 exam because they remain one of the most effective attack vectors in real-world breaches.

Phishing is the most common social engineering attack. It uses fraudulent emails, messages, or websites to trick victims into revealing credentials or installing malware. Several specialized variants exist:

• Spear phishing - targeted phishing directed at a specific individual or organization, using personalized information to appear legitimate
• Whaling - spear phishing that specifically targets high-level executives (CEO, CFO, board members)
• Vishing - voice phishing conducted over phone calls, often impersonating IT support or bank representatives
• Smishing - phishing via SMS text messages, frequently containing malicious links or urgent requests

Beyond phishing, other social engineering techniques include:

• Pretexting - creating a fabricated scenario (pretext) to gain a victim's trust and extract information, such as impersonating a vendor or auditor
• Baiting - leaving malware-infected physical media (USB drives) in public areas or offering enticing downloads to lure victims
• Tailgating - physically following an authorized person through a secured door or entrance without proper authentication
• Shoulder surfing - observing a victim's screen or keyboard to capture passwords, PINs, or other sensitive data

Malware Types

Malware (malicious software) is any software intentionally designed to cause damage, gain unauthorized access, or disrupt systems. Understanding the distinctions between malware types is critical for the Security+ exam, as questions often present a scenario and ask you to identify the type of malware involved.

Network Attacks

Network attacks target the infrastructure that connects systems. Understanding these attacks and their indicators is essential for both the Security+ exam and real-world security operations.

Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks aim to make a service unavailable by overwhelming it with traffic or exploiting resource limitations:

• SYN flood - sends thousands of TCP SYN packets without completing the three-way handshake, exhausting the server's connection table
• Amplification attacks - exploits protocols like DNS or NTP where a small request generates a much larger response, directed at the victim via IP spoofing
• DDoS - coordinates DoS attacks from many compromised systems (botnet), making them far harder to mitigate

On-path attacks (formerly known as man-in-the-middle) involve an attacker positioning themselves between two communicating parties to intercept or alter traffic:

• ARP spoofing/poisoning - sends falsified ARP messages to associate the attacker's MAC address with a legitimate IP address on the local network
• DNS poisoning - corrupts the DNS cache to redirect domain name lookups to malicious IP addresses
• Evil twin - a rogue wireless access point configured to mimic a legitimate network, tricking users into connecting through the attacker's AP

Application Attacks

Application-layer attacks exploit vulnerabilities in software - particularly web applications. These attacks target flaws in how applications process user input, making secure coding practices and input validation critical defenses.

Injection attacks insert malicious code or commands into application inputs:

• SQL injection (SQLi) - inserts malicious SQL statements into input fields to manipulate database queries, potentially exposing or modifying all stored data
• Command injection - injects operating system commands through application inputs to execute arbitrary commands on the server

Cross-site scripting (XSS) injects malicious scripts into web pages viewed by other users. Three main types exist:

• Stored (persistent) XSS - malicious script is permanently stored on the target server (e.g., in a database) and served to every user who views the affected page
• Reflected XSS - malicious script is embedded in a URL and reflected off the server in error messages or search results; requires the victim to click a crafted link
• DOM-based XSS - exploits client-side JavaScript to modify the page's DOM, executing the attack entirely in the browser without server involvement

Other critical application attacks include:

• Cross-site request forgery (CSRF) - forces an authenticated user's browser to send forged requests to a vulnerable application, performing actions without the user's knowledge
• Buffer overflow - sends more data than a buffer can hold, overwriting adjacent memory and potentially executing arbitrary code
• Directory traversal - uses sequences like ../ to access files outside the intended directory, potentially exposing sensitive system files

Password Attacks

Password attacks attempt to recover or bypass authentication credentials. As the Security+ exam emphasizes, understanding these attack methods is essential for implementing proper defenses like account lockout policies, MFA, and strong hashing algorithms.

• Brute force - systematically tries every possible character combination until the correct password is found; effective against short or simple passwords but extremely time-consuming for complex ones
• Dictionary attack - uses a precompiled list of common passwords and words rather than trying all combinations; faster than brute force but limited to known passwords
• Rainbow table attack - uses precomputed hash-to-password lookup tables to quickly reverse password hashes; defeated by salting (adding random data to each password before hashing)
• Credential stuffing - takes username/password pairs leaked from one data breach and tries them against other services, exploiting password reuse across sites
• Password spraying - tries a small number of commonly used passwords (e.g., "Password1!", "Summer2026!") against many accounts simultaneously, avoiding account lockout thresholds

CompTIA Security+ Attack Types Practice Questions

Test your understanding with these 5 expert-created questions. Each includes a detailed explanation to reinforce your learning.