A healthcare organization issues smartphones to field nurses. The nurses use a custom app that stores patient data locally on the device for offline access. A recent audit reveals that the app stores the data in plaintext in the app's sandbox directory. Which of the following is the MOST appropriate control to mitigate this vulnerability?

Use MDM to restrict app installation to approved apps only.

Encrypt the local database using the device's hardware-backed keystore.

Require a strong device PIN and enable remote wipe capabilities.

Disable offline access and require a live connection to the central server.

A user is tricked into submitting a request that changes their password without their knowledge, by clicking a malicious link. Which web-based vulnerability is this?

Cross-site request forgery (CSRF)

A company discovers that a batch of USB drives purchased from a new supplier contains hidden hardware that can intercept keystrokes when plugged into a computer. The USB drives were distributed to employees as promotional items. Which of the following is the MOST effective mitigation?

Disable USB ports on all company computers.

Implement a policy that only allows approved USB drives from trusted vendors.

Use endpoint detection and response (EDR) to monitor for keystroke logging behavior.

Recall all distributed USB drives and replace them with drives from a verified supplier.

CompTIASecurity+

Domain 2Objective 3

Vulnerabilities SY0-701 Practice Questions (Page 3)

Part of the Threats, vulnerabilities, and mitigations domain, which accounts for 22% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

22%of the exam

Questions 11–15

11application · medium
A healthcare organization issues smartphones to field nurses. The nurses use a custom app that stores patient data locally on the device for offline access. A recent audit reveals that the app stores the data in plaintext in the app's sandbox directory. Which of the following is the MOST appropriate control to mitigate this vulnerability?
Select an answer first
12foundation · easy
An attacker submits malicious input to a web form that is then executed as part of a database query. Which application vulnerability is being exploited?
Select an answer first
13foundation · easy
A user is tricked into submitting a request that changes their password without their knowledge, by clicking a malicious link. Which web-based vulnerability is this?
Select an answer first
14expert · hard
A company discovers that a batch of USB drives purchased from a new supplier contains hidden hardware that can intercept keystrokes when plugged into a computer. The USB drives were distributed to employees as promotional items. Which of the following is the MOST effective mitigation?
Select an answer first
15foundation · easy
A malicious program running inside a virtual machine is able to break out of the VM's isolation and interact directly with the host operating system. Which virtualization vulnerability is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.

Vulnerabilities SY0-701 Practice Questions (Page 3)

Questions 11–15

An attacker submits malicious input to a web form that is then executed as part of a database query. Which application vulnerability is being exploited?

A user is tricked into submitting a request that changes their password without their knowledge, by clicking a malicious link. Which web-based vulnerability is this?

A company discovers that a batch of USB drives purchased from a new supplier contains hidden hardware that can intercept keystrokes when plugged into a computer. The USB drives were distributed to employees as promotional items. Which of the following is the MOST effective mitigation?

A malicious program running inside a virtual machine is able to break out of the VM's isolation and interact directly with the host operating system. Which virtualization vulnerability is this?

Keep studying — Threats, vulnerabilities, and mitigations