2.4 Given a scenario, analyze indicators of malicious activity
Objective 2.4 sits in Threats, Vulnerabilities, and Mitigations, which carries 22% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
In blind (inferential) SQL injection, which characteristic distinguishes it from inband injection?
The concept
SQL injection is classified into inband, out-of-band, and inferential (blind) categories based on how results are obtained.
Why this answer
Blind injection involves no direct data transfer; the attacker infers results by watching how the server behaves to different requests.
- AThis describes out-of-band injection, where a separate channel like email carries the results.
- Correct: blind injection relies on inference from server behavior rather than direct data return.
- CThis describes inband injection, where results appear directly on the page.
- DThis is an example of out-of-band exfiltration, not the inferential class.
Now you: objective 2.4 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A company relies on a productive, closed source, third-party application with a known SQL injection flaw that cannot be modified. What is the most appropriate remediation approach?
Sample question 2 of 3
An attacker submits a username containing wildcard and special characters into a login form, causing the application's directory query to return every user record. Which attack occurred?
Sample question 3 of 3
An application lets users choose the sort column for a report, and that value is placed directly into the ORDER BY clause where bind variables cannot be used. Which defense applies?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.