2.3 Explain various types of vulnerabilities
Objective 2.3 sits in Threats, Vulnerabilities, and Mitigations, which carries 22% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Which risk does OWASP guidance identify as the single greatest danger of invoking third-party JavaScript tags on a website?
The concept
Web-based and supply chain vulnerabilities can arise when a site depends on code it does not control.
Why this answer
A compromised vendor JavaScript server lets an attacker inject malicious code that then executes on every site loading the tag, which is described as the greatest risk of this dependency.
- APerformance degradation is a real concern with vendor scripts but is not the risk singled out here.
- This is the correct answer: server compromise leading to injected malicious code.
- CA host-side permission error is a separate issue unrelated to the vendor server compromise described.
- DTLS certificate expiration affects the host's own connection, not the vendor script supply chain.
Now you: objective 2.3 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A tag manager's graphical interface is configured to read an unvalidated URL parameter and write it into a page location where JavaScript executes. What does this configuration risk creating?
Sample question 2 of 3
What is the OWASP Top Ten described as representing for web application security?
Sample question 3 of 3
To stop a visitor's browser from directly contacting a third-party vendor's server and leaking headers and cookies, which defense should the host implement?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.