Security+ SY0-801 Practice Questions: Threats, Vulnerabilities, and Attacks

Correct answer: C. CVSS base score

C is correct because the Common Vulnerability Scoring System rates the severity of a vulnerability on a 0.0 to 10.0 scale. A is a unique name for a publicly known vulnerability and carries no severity rating. B classifies the type of underlying weakness, such as improper input validation, rather than scoring severity. D identifies a source of threat intelligence and does not rate individual scan findings.

Correct answer: D. To give one publicly known vulnerability a unique, shared name

D is correct because CVE entries give each publicly disclosed vulnerability a standard identifier so different sources can refer to it consistently. A is the role of a CVSS score, while a CVE identifier carries no severity rating. B describes a CWE category, which groups weaknesses by type rather than naming one specific vulnerability. C is not recorded in a CVE identifier, which names the flaw and not any attacker.

Correct answer: C. A threat feed

C is correct because a threat feed is an ongoing stream of indicators and intelligence that security tools can ingest automatically. A lists weaknesses found on the company's own systems, not malicious indicators observed elsewhere. B documents the findings of an authorized test against the company, not a live list of external indicators. D describes the scoring metrics of a single vulnerability and contains no indicators to match against logs.

Correct answer: B. Likelihood

B is correct because the rule makes a successful exploit less probable, while the damage an exploit would cause stays the same. A is the harm a successful attack would cause, which is unchanged because the same data is still exposed if exploited. C reflects what the application and its data are worth to the business, which the WAF rule does not change. D describes the category of the flaw itself, which remains the same until the application is patched.

Correct answer: B. Impact

B is correct because removing old records from the exposed system limits the harm a successful breach could cause. A describes how easily a flaw can be used by an attacker, which is not affected by where archives are stored. C is the path an attacker uses to reach the system, which stays the same after the archive is moved. D is how probable a successful attack is, which moving archived records does not change for the main database.

Correct answer: A. An industry information sharing and analysis center

A is correct because these sector-based groups let members share threat details relevant to their industry under agreed confidentiality. B lists and scores publicly disclosed vulnerabilities rather than sharing attack indicators among hospitals. C detects known malware broadly and is not a sector-specific exchange of attack details. D is freely available to everyone and is not confidential sharing among hospitals.

Correct answer: C. Dark web monitoring

C is correct because the analyst gathered intelligence from hidden criminal forums and markets where stolen access and data are sold. A relies on member organizations reporting what they have seen, not on monitoring criminal forums directly. B reviews events recorded on company systems, which would not reveal an offer posted on an outside marketplace. D probes the company's own systems for weaknesses and does not observe criminal marketplaces.

Correct answer: D. Processing

D is correct because processing turns raw collected data into a usable, normalized form ready for analysis. A delivers finished intelligence to stakeholders, which happens after analysis is complete. B defines what questions the intelligence must answer, which comes before any data is collected. C gathers the raw data from sources, which has already been completed in this scenario.

Correct answer: A. Feedback

A is correct because stakeholders evaluate whether the intelligence met their needs, and their input refines requirements for the next cycle. B is the delivery of the report itself, which already happened before the fraud managers responded. C normalizes raw data before analysis and has no role in evaluating whether a report met its purpose. D interprets processed data to produce findings, but it does not gather the consumers' reaction to the delivered report.

Correct answer: D. Fix the actively exploited vulnerability first

D is correct because evidence of real-world exploitation raises the likelihood of attack, so it should be remediated ahead of an equal score. A leaves the flaw that attackers are already using open for longer, which increases risk. B ignores threat intelligence that shows one flaw is far more likely to be used against the company. C leaves a known, actively exploited flaw open based on an arbitrary score threshold.