2.2 Explain common threat vectors and attack surfaces
Objective 2.2 sits in Threats, Vulnerabilities, and Mitigations, which carries 22% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A build pulls a package whose name closely resembles an internal library, published to a public registry by an unknown author. Which supply chain threat does this describe?
The concept
A build resolves names to artifacts, and the resolution order decides which source wins when the same name exists in more than one place. An attacker who can publish into a source the resolver trusts does not need to breach anything.
Why this answer
Publishing a lookalike name to a public registry the build also searches lets the attacker's package be selected instead of the intended internal one, without touching the organisation's systems at all.
- Correct.
- BA stolen signing certificate lets an attacker sign their own artifact as trusted. The problem here is which package is chosen, not whether its signature validates.
- CA compromised agent tampers with the build as it runs. This build is doing exactly what it was told, using a package it should not have.
- DAn exposed repository leaks or accepts artifacts directly. Here the public registry is behaving normally and the resolution order is the weakness.
Now you: objective 2.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An API key is passed to a container through a Docker ENV instruction in the image definition. Why does this widen the attack surface?
Sample question 2 of 3
A public web endpoint still negotiates SSL 3.0 for older clients. A review flags the endpoint. What is the objection?
Sample question 3 of 3
A TLS session to a public site is established successfully. What has the server learned about the identity of the client?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.