Security+
CompTIA Security+ SY0-801 / All lessons / Domain 2.0: Threats, Vulnerabilities, and Attacks
2Domain 2.0: Threats, Vulnerabilities, and Attacks
Security+ topic 2.5

Indicators of Malicious Activity

This objective asks you to read a scenario and name the attack. Malware includes ransomware, trojans, worms, spyware, rootkits, logic bombs, and fileless malware that runs in memory with built-in tools. Physical attacks include brute-forcing doors, RFID cloning, and tailgating. Network attacks include DDoS, on-path, DNS attacks, and credential replay. Application attacks include SQL injection, cross-site scripting, directory traversal, and privilege escalation. Password attacks include brute force, password spraying, and credential stuffing. Look for the indicators: account lockouts, impossible travel, concurrent sessions, blocked content, unusual resource use, out-of-cycle logging, and missing logs.

Picture it
Input: admin' OR '1'='1' --
 
SELECT * FROM users
WHERE name = 'admin' OR '1'='1' --' AND pass = '…'
 
'1'='1' is always true and -- comments out the password check.
Fix: parameterized queries and input validation.
SQL injection: input is pasted into a database query, so special characters change what the query does.

Indicators of Malicious Activity vocabulary

  • Fileless malware: Malware that runs in memory with legitimate system tools instead of a file on disk.
  • Password spraying: Trying a few common passwords against many accounts to avoid lockouts.
  • SQL injection: Putting database commands into an input field so the database runs them.
  • Impossible travel: Logins from places too far apart to reach in the time between them, a sign of a stolen account.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

1. A security tool finds no malicious files on a laptop, but memory analysis shows a PowerShell script downloading commands and running them without saving anything to disk. Which of the following is this?

  1. (A) A logic bomb
  2. (B) Fileless malware
  3. (C) A worm
  4. (D) Adware
Show answer

(B) Fileless malware Malware that lives in memory and uses built-in tools is fileless.

2. Logs show one failed login for each of 3,000 accounts, all using the password "Winter2026!". Which of the following attacks is most likely?

  1. (A) Brute force
  2. (B) Password spraying
  3. (C) Credential stuffing
  4. (D) Pass the hash
Show answer

(B) Password spraying Trying one common password across many accounts avoids lockouts and is password spraying.

3. A user's account logs in from New York and then from Singapore 10 minutes later. Which of the following indicators is this?

  1. (A) Impossible travel
  2. (B) Resource exhaustion
  3. (C) Missing logs
  4. (D) Concurrent session limit
Show answer

(A) Impossible travel No one can travel that far that fast, so impossible travel suggests a compromised account.

A web server log shows this login attempt: username = admin' OR '1'='1' --

4. Which of the following attacks is being attempted?

  1. (A) Cross-site scripting
  2. (B) SQL injection
  3. (C) Directory traversal
  4. (D) Buffer overflow
Show answer

(B) SQL injection Quote marks and OR '1'='1' try to change the database query, which is SQL injection.

5. A request to a web server contains /../../../etc/passwd. Which of the following attacks is this?

  1. (A) Directory traversal
  2. (B) Replay attack
  3. (C) DDoS
  4. (D) DNS poisoning
Show answer

(A) Directory traversal Using ../ to climb out of the web folder is directory traversal.

6. An attacker on a coffee shop network secretly relays traffic between users and the router, reading their unencrypted traffic. Which of the following is this?

  1. (A) On-path attack
  2. (B) Watering hole attack
  3. (C) Privilege escalation
  4. (D) Logic bomb
Show answer

(A) On-path attack Sitting between two parties to read or change traffic is an on-path attack.

Open 2.5 in the interactive course