FirstTry

Objective 2.3

SY0-701

Explain various types of vulnerabilities

Objective 2.3 sits in Threats, Vulnerabilities, and Mitigations, which carries 22% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-3Threats, Vulnerabilities, and Mitigations

Which risk does OWASP guidance identify as the single greatest danger of invoking third-party JavaScript tags on a website?

Exhaustion of the client browser's memory from unoptimized vendor scriptsPerformance degradation is a real concern with vendor scripts but is not the risk singled out here.
Compromise of the third-party JavaScript server, injecting malicious codeCorrect · your answerThis is the correct answer: server compromise leading to injected malicious code.
Misconfiguration of the host site's own content management permissionsA host-side permission error is a separate issue unrelated to the vendor server compromise described.
Expiration of the host site's TLS certificate during a vendor's outageTLS certificate expiration affects the host's own connection, not the vendor script supply chain.

Correct.

Checked against owasp.org, July 2026

Concept

Web-based and supply chain vulnerabilities can arise when a site depends on code it does not control.

Why B

A compromised vendor JavaScript server lets an attacker inject malicious code that then executes on every site loading the tag, which is described as the greatest risk of this dependency.

Source

The single greatest risk is a compromise of the third party JavaScript server, and the injection of malicious JavaScript into the original tag JavaScript.

OWASP Third Party JavaScript Management Cheat Sheet, checked July 2026
#web-based vulnerabilities#supply chain vulnerabilities#third-party scripts

Now you: objective 2.3 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-3Threats, Vulnerabilities, and Mitigations

A tag manager's graphical interface is configured to read an unvalidated URL parameter and write it into a page location where JavaScript executes. What does this configuration risk creating?

Sample question 2 of 3

2-3Threats, Vulnerabilities, and Mitigations

What is the OWASP Top Ten described as representing for web application security?

Sample question 3 of 3

2-3Threats, Vulnerabilities, and Mitigations

To stop a visitor's browser from directly contacting a third-party vendor's server and leaking headers and cookies, which defense should the host implement?

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Threats, Vulnerabilities, and Mitigations