CompTIA Security+ (Cengage Module 05: Endpoint Vulnerabilities, Attacks, and Defenses) - Quiz Review & Analysis

This comprehensive study guide reviews the questions, answer options, verified correct selections, and in-depth technical explanations based on Cengage's CompTIA Security+ Guide to Network Security Fundamentals. Each item includes precise rationale dissecting the security concepts and common textbook distractors.

Item #	Question Topic	Key Objective	Correct Answer
Question 1	Ransomware Characteristics	Identify threat characteristics & misconceptions	Once a device is infected with ransomware, it will never function normally.
Question 2	Indicators of Attack (IoA)	Differentiate textbook IoA classifications	resource manipulation
Question 3	Memory Vulnerabilities	Return address manipulation	buffer overflow attack
Question 4	Blocking Ransomware	Screen lockers & persistence mechanisms	It can be defeated by a double power cycle.
Question 6	Spyware Technologies	Categorize spyware behavioral vectors	active tracking technologies
Question 8	LOLBins (Living off the Land)	Recognize native binaries & frameworks	DLR
Question 9	Malware Classification	Infector mechanisms & file insertion	file-based virus
Question 10	Concurrency & Timing Vulnerabilities	NULL pointer dereference triggers	Time of check (TOC) to time of use (TOU)
Question 11	Web Application Attacks	Server-to-server trust manipulation	SSRF
Question 12	Trojan Architecture	RAT capabilities vs. self-propagating worms	A RAT and a worm have the same basic function.
Question 13	Lateral Movement & Ransomware	Assess enterprise threat severity	It can encrypt all files on any network that is connected to the employee's computer.
Question 14	Web Session Security	Secure cookie attributes & transport security	It is a means of protection of a web browser.
Question 15	Session Trust Exploitation	Credential inheritance across origins	CSRF
Question 16	Malicious Logic Analysis	Distinguishing routine tasks from logic bombs	Send an email to Rowan's inbox each Monday morning with the agenda of that week's department meeting.
Question 17	Keylogger vs. Spyware	Operational scope & keystroke extraction	Spyware typically secretly monitors users but unlike a keylogger makes no attempts to gather sensitive user keyboard input.
Question 20	Endpoint Terminology	Modern vs. legacy hardware naming conventions	endpoint

Detailed Question Breakdown & Rationale

Question 1 (1 of 20)

Question: Cillian is explaining to an intern why ransomware is considered to be the most serious malware threat. Which of the following reasons would Cillian NOT give?

• Once a device is infected with ransomware, it will never function normally. [CORRECT ANSWER]

• Launching a ransomware attack is relatively inexpensive and does not require a high degree of skill.

• Ransomware attacks occur with a very high frequency.

• Attacks from ransomware have a high impact on organizations.

Why: Ransomware targets accessibility and confidentiality (via encryption or lock screens); it does not destroy hardware or permanently corrupt a machine beyond recovery. Devices can routinely be restored to normal operation through malware remediation, reimaging the operating system, and restoring files from uncorrupted backups. The remaining statements accurately describe why ransomware is a critical modern threat: turnkey Ransomware-as-a-Service (RaaS) models lower technical barriers, attacks are omnipresent, and business downtime imposes severe financial and operational tolls.

Question 2 (2 of 20)

Question: Which of the following would NOT be considered an IoA?

• resource manipulation [CORRECT ANSWER]

• out-of-cycle logging

• account lockout

• blocked content

Why: In Cengage's CompTIA Security+ curriculum, Indicators of Attack (IoAs) focus on proactive, real-time behavioral evidence indicating that an intrusion is actively underway. The curriculum defines specific IoA categories: resource consumption (abrupt depletion of memory, storage, or CPU cycles), out-of-cycle logging, account lockouts (resulting from active credential attacks), blocked content, and concurrent session usage. "Resource manipulation" is an intentional phrasing distractor substituting the word "manipulation" for "consumption."

Question 3 (3 of 20)

Question: Which type of memory vulnerability attack manipulates the "return address" of the memory location of a software program?

• pointer attack

• stuffing attack

• integer overwrite

• buffer overflow attack [CORRECT ANSWER]

Why: In a stack-based buffer overflow, excessive input beyond the boundaries of an allocated buffer writes into adjacent memory space on the call stack. This directly overwrites the saved Instruction Pointer (EIP/RIP) or "return address," redirecting execution control flow to malicious shellcode injected by the adversary when the current function returns.

Question 4 (4 of 20)

Question: Which of the following is NOT a feature of blocking ransomware?

• A message on the user's screen appears pretending to be from a reputable third party.

• It prevents a user from using their computer in a normal fashion.

• It can be defeated by a double power cycle. [CORRECT ANSWER]

• It is the earliest form of ransomware.

Why: Power cycling a computer (once or multiple times) does not remove blocking ransomware or clear its persistence mechanisms. Blocking ransomware modifies operating system startup configurations, registry run keys, or system shells to relaunch its lock screen immediately upon system reboot. The other options reflect standard attributes: screen lockers were the earliest major ransomware category, restricted normal UI usage, and frequently impersonated federal law enforcement agencies demanding payment of fraudulent fines.

Question 6 (6 of 20)

Question: Which of the following is NOT a technology used by spyware?

• tracking software

• system-modifying software

• active tracking technologies [CORRECT ANSWER]

• automatic download of software

Why: Cengage’s Security+ framework explicitly categorizes spyware into three functional technology pillars: (1) Automatic download of software, (2) System-modifying software (which alters browser homepages, search engines, and network settings), and (3) Tracking software. "Active tracking technologies" is an invented distractor term not defined within the text's taxonomy.

Question 8 (8 of 20)

Question: Which of the following is NOT a Microsoft Windows common LOLBin?

• DLR [CORRECT ANSWER]

• .NET Framework

• Macro

• PowerShell

Why: Living-off-the-Land Binaries, Scripts, and Libraries (LOLBins/LotL) exploit trusted, pre-installed administrative software and frameworks to evade signature-based defenses. The Cengage curriculum groups PowerShell, the native .NET Framework (e.g., InstallUtil, MSBuild), and Office Visual Basic for Applications (VBA) Macros as standard built-in tools co-opted in LotL attacks. "DLR" (Dynamic Language Runtime) is a runtime environment, not classified as a common Windows LOLBin.

Question 9 (9 of 20)

Question: Which of the following types of computer viruses is malicious computer code that becomes part of a file?

• file-based virus [CORRECT ANSWER]

• jump virus

• fileless virus

• RAM-Check virus

Why: A file-based virus (or file infector) attaches its malicious executable code directly to a host file or script, modifying the host binary so that when the legitimate file is executed, the viral payload runs first. Fileless viruses reside exclusively in volatile memory or run via trusted LOLBins without attaching code to existing files. "Jump virus" and "RAM-Check virus" are non-existent distractors.

Question 10 (10 of 20)

Question: What race condition can result in a NULL pointer/object dereference?

• Conflict race condition

• Value-based race condition

• Thread race condition

• Time of check (TOC) to time of use (TOU) [CORRECT ANSWER]

Why: A Time-of-Check to Time-of-Use (TOCTOU) race condition represents a concurrency vulnerability where a program validates the status or validity of a shared resource (such as a pointer, file, or object) and subsequently dereferences or writes to it. If an asynchronous thread modifies, deallocates, or clears that resource to NULL during the execution window between the check and the actual use, dereferencing the pointer triggers an unhandled NULL pointer exception or application crash.

Question 11 (11 of 20)

Question: Which of the following manipulates the trusting relationship between web servers?

• SSRF [CORRECT ANSWER]

• CSRF

• EXMAL

• SCSI

Why: Server-Side Request Forgery (SSRF) exploits the trust relationship between an internet-facing web application server and back-end systems, APIs, cloud metadata endpoints, or internal microservices. In SSRF, the external attacker induces the web server to forge HTTP requests to internal, unroutable network resources. In contrast, CSRF abuses the trust relationship between a web application and the victim's client browser.

Question 12 (12 of 20)

Question: Which of the following is NOT true about RATs?

• A RAT gives the threat agent unauthorized remote access to the victim's computer by using specially configured communication protocols.

• A RAT and a worm have the same basic function. [CORRECT ANSWER]

• A RAT allows the attacker to not only monitor what the user is doing but also can change computer settings, browse and copy files, and even use the computer to access other computers connected on the network.

• A RAT creates an opening into the victim's computer, allowing the threat actor unrestricted access.

Why: RATs and worms possess fundamentally different architectures and objectives. A Remote Access Trojan provides an interactive, operator-driven command-and-control backdoor for persistent unauthorized control. A computer worm is an autonomous, self-propagating program designed to spread across network connections by exploiting system vulnerabilities without user intervention or manual administrative operation.

Question 13 (13 of 20)

Question: Finn's team leader has just texted him that an employee, who violated company policy by bringing in a file on a USB flash drive, has just reported that their computer is infected with locking ransomware. Why would Finn consider this a serious situation?

• It sets a precedent by encouraging other employees to violate company policy.

• It can encrypt all files on any network that is connected to the employee's computer. [CORRECT ANSWER]

• The organization may be forced to pay up to $500 for the ransom.

• The employee would have to wait at least an hour before their computer could be restored.

Why: The critical threat posed by ransomware entering an enterprise perimeter is lateral traversal and cryptographic compromise of connected network resources. Once executed, ransomware routines enumerate mapped network drives, SMB shares, and shared cloud repositories, encrypting centralized organizational assets far beyond the local endpoint.

Question 14 (14 of 20)

Question: Which of the following is NOT correct about a secure cookie?

• It is a means of protection of a web browser. [CORRECT ANSWER]

• A secure cookie is only sent to the server with an encrypted request.

• It uses the HTTPS protocol.

• It prevents an unauthorized person from intercepting a cookie that is being transmitted.

Why: A secure cookie protects the confidentiality of session data during network transit by enforcing the `Secure` attribute; it does not protect the client web browser itself from vulnerabilities, malware, or client-side exploits. By attaching the `Secure` directive, browsers are restricted from passing the cookie over unencrypted HTTP channels, successfully mitigating man-in-the-middle eavesdropping.

Question 15 (15 of 20)

Question: Which of the following attacks is based on the principle that when a user is currently authenticated on a website and then loads another webpage, the new page inherits the identity and privileges of the first website?

• SSFR

• DLLS

• CSRF [CORRECT ANSWER]

• DRCR

Why: Cross-Site Request Forgery (CSRF) operates by exploiting browser-managed credential persistence (such as session cookies and HTTP basic authentication headers). When a user browses to a malicious site while logged into a vulnerable web service, the attacker's script submits unauthorized requests to the target service. The browser automatically attaches the victim's session tokens, causing the application to process the actions with the victim's inherited authority.

Question 16 (16 of 20)

Question: Which of these would NOT be considered the result of a logic bomb?

• Send an email to Rowan's inbox each Monday morning with the agenda of that week's department meeting. [CORRECT ANSWER]

• If the company's stock price drops below $50, then credit Oscar's retirement account with one additional year of retirement credit.

• Erase the hard drives of all the servers 90 days after Alfredo's name is removed from the list of current employees.

• Delete all human resource records regarding Augustine one month after he leaves the company.

Why: A logic bomb is defined as malicious code intentionally inserted into an application that remains dormant until triggered by a specific event, condition, or date to inflict harm, wipe data, or commit fraud. Sending a recurring department meeting agenda every Monday morning is a benign, scheduled business automation task, lacking unauthorized intent or malicious payload.

Question 17 (17 of 20)

Question: What is the difference between a keylogger and spyware?

• A keylogger operates much faster than spyware.

• Spyware is illegal while a keylogger is not.

• Spyware typically secretly monitors users but unlike a keylogger makes no attempts to gather sensitive user keyboard input. [CORRECT ANSWER]

• Spyware can be installed using a hardware device while a keylogger cannot.

Why: In Cengage's differentiation, standard spyware focuses on broad user behavioral surveillance, browser tracking, search hijacking, and demographic data collection without intercepting sequential low-level keystrokes. A keylogger is explicitly engineered to capture raw keystroke data to extract credentials, passphrases, and confidential text input. Furthermore, keyloggers can be deployed as physical hardware dongles, disproving the final option.

Question 20 (20 of 20)

Question: What word is the currently accepted term that is used today to refer to network-connected hardware devices?

• host

• endpoint [CORRECT ANSWER]

• device

• client

Why: Modern cybersecurity taxonomy has shifted from legacy networking terminology ("host," rooted in early ARPANET and RFC RFC-era client/mainframe models) to endpoint. "Endpoint" serves as the standard industry umbrella term denoting all network-connected hardware—including workstations, laptops, servers, mobile devices, and IoT hardware—subject to centralized monitoring and defense.