Objective 2.3SY0-701

2.3 Explain various types of vulnerabilities

Objective 2.3 sits in Threats, Vulnerabilities, and Mitigations, which carries 22% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Threats, Vulnerabilities, and MitigationsEasy

Which risk does OWASP guidance identify as the single greatest danger of invoking third-party JavaScript tags on a website?

Correct.

The concept

Web-based and supply chain vulnerabilities can arise when a site depends on code it does not control.

Why this answer

A compromised vendor JavaScript server lets an attacker inject malicious code that then executes on every site loading the tag, which is described as the greatest risk of this dependency.

  • APerformance degradation is a real concern with vendor scripts but is not the risk singled out here.
  • This is the correct answer: server compromise leading to injected malicious code.
  • CA host-side permission error is a separate issue unrelated to the vendor server compromise described.
  • DTLS certificate expiration affects the host's own connection, not the vendor script supply chain.
Read the sourceOWASP Third Party JavaScript Management Cheat Sheet
Verified against owasp.org · 2026-07-27
web-based vulnerabilitiessupply chain vulnerabilitiesthird-party scripts

Now you: objective 2.3 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Threats, Vulnerabilities, and MitigationsModerate

A tag manager's graphical interface is configured to read an unvalidated URL parameter and write it into a page location where JavaScript executes. What does this configuration risk creating?

Sample question 2 of 3

Threats, Vulnerabilities, and MitigationsEasy

What is the OWASP Top Ten described as representing for web application security?

Sample question 3 of 3

Threats, Vulnerabilities, and MitigationsModerate

To stop a visitor's browser from directly contacting a third-party vendor's server and leaking headers and cookies, which defense should the host implement?

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Threats, Vulnerabilities, and Mitigations