Free CompTIA Security+ Practice Test (SY0-701)

SQL injection → parameterized queries. Bound parameters keep user input from ever being interpreted as SQL.

Credential stuffing → MFA. The attacker has a valid username and password pair; a second factor is what stops the reused password from being enough. Account lockout helps less, because stuffing tries each pair only once.

ARP poisoning → dynamic ARP inspection. DAI checks ARP replies against the DHCP snooping table and drops forged ones at the switch.

DNS cache poisoning → DNSSEC validation. The resolver rejects answers whose signatures don't validate, so forged records never get cached.

Unapproved executables → application allow list. Only pre-approved binaries can run, so whatever is on the USB stick simply won't launch. Antivirus would only catch known-bad files; an allow list blocks anything unknown.

Password spraying: one source IP tries many different accounts, one attempt each, spaced about 30 seconds apart. That's the signature of spraying a few common passwords across lots of users while staying under per-account lockout thresholds.

fnguyen is compromised: a successful sign-in from the attacking IP, followed minutes later by an auto-forward rule to an outside free-mail address, is classic mailbox takeover and exfiltration.

Why the others are wrong: brute force would show many attempts against one account, and nothing here locks out. Every attempt comes from one IP, so it isn't distributed. The log records password sign-ins, not token reuse, so there's no evidence of replay.

Cryptographic erase destroys the drive's media encryption key, so everything stored on it becomes unreadable ciphertext, and the drive stays reusable. The certificate documents the sanitization for your records. The overwrite is the tempting wrong answer. On SSDs, wear leveling and over-provisioned blocks mean a software overwrite can miss data. Degaussing works on magnetic media and does nothing to flash. Shredding works, but it breaks the “usable” requirement.

SLE = asset value × exposure factor = $200,000 × 0.25 = $50,000. ARO = 1 event ÷ 5 years = 0.2. ALE = SLE × ARO = $50,000 × 0.2 = $10,000. Here's where each trap comes from: $50,000 stops at the SLE. $40,000 skips the exposure factor ($200,000 × 0.2). $250,000 multiplies by 5 years instead of by the 0.2 annual rate.

The program checked a condition and then acted on it later, and the attacker changed reality in between. That's a TOCTOU race condition. The fix is to make check-and-use atomic, for example by opening the file first and then checking the open handle, or by refusing to follow symlinks. Directory traversal is tempting because a sensitive path gets reached, but traversal abuses ../ sequences in user input. There's no path manipulation here, just a timing gap. No memory is overrun or injected, either.