CompTIA Security+ ExamStudy Topic
Threats, Weaknesses, and Defensive Reasoning Study Guide
Recognize threat patterns while distinguishing evidence, vulnerabilities, exposure, and confirmed impact.
Topic Overview
Start by separating the actor or event, the exploitable weakness, and the possible consequence. The same weakness can create different business risk depending on exposure, information sensitivity, and existing controls. A single suspicious event is a lead to investigate, not proof of every later conclusion.
For identity threats, distinguish reused compromised credentials, distributed password guesses, targeted social engineering, and unwanted approval prompts. Choose defenses that address the observed mechanism while keeping reporting and access decisions within the approved process.
For application weaknesses, identify the trust boundary between untrusted input and executable behavior or privileged resources. Parameter binding, context-appropriate encoding, request validation, and constrained server-side access solve different problems; do not treat one technique as a universal fix.
- Confusing a vulnerability with its threat actor or business impact.
- Treating familiar branding or project details as proof of sender identity.
- Assuming one symptom uniquely identifies a complete attack chain.
- Using a control for one input context as if it automatically protects every context.
Checkpoint Quiz
Test your understanding of Threats, Weaknesses, and Defensive Reasoning
These questions are for study practice only and are not official exam questions.
1. An investigation finds that an attacker tried username-password pairs previously exposed by an unrelated service. Which attack pattern does this most directly describe?
2. Logs show one common password attempted against many different accounts, with few attempts per account. Which pattern best matches the evidence?
3. A trusted software vendor distributes an update after its build pipeline is compromised. Customers install the signed update through their normal process. Which exposure is central to this scenario?
4. A user repeatedly receives authentication approval prompts they did not initiate. What should the user do?
5. An unknown person follows an employee through a controlled office door without presenting their own credential. Which physical-security concern is illustrated?
6. An authorized employee intentionally exports restricted customer data for personal gain. Which threat category best describes the employee role in this scenario?
7. An attack exploits a software vulnerability that was previously unknown to the vendor and defenders at the time of the attack. Which term best describes this scenario?
8. A finance employee receives an email tailored to a real project and impersonating the project director. It asks for a password through an unfamiliar link. Which description best fits the targeting?
9. A ransomware incident makes production files unreadable. The organization has backups but has never tested restoration. What uncertainty remains?
10. A public service becomes unavailable while receiving traffic from many distributed sources that exhaust its capacity. Which security objective is primarily affected?
Frequently asked questions
How are threat and vulnerability different?
A threat can cause harm; a vulnerability is a weakness it may exploit. Risk also depends on likelihood, impact, and the environment.
What is a false positive?
It is an alert for the monitored condition when that condition is absent in the verified case. The underlying activity may still have occurred.
Why does exposure change remediation priority?
Reachability, active exploitation, sensitive information, and business dependence can change the risk associated with the same technical flaw.
Should a suspicious request be tested with real credentials?
No. Verify through an approved trusted channel and follow the reporting workflow rather than supplying credentials to an unverified destination.
