→ Threat actors differ by resources, sophistication, access, and motivation. Distinguish nation-state actors, organized crime, hacktivists, insider threats, and unskilled attackers by the scenario—not by one keyword alone.

→ A threat vector is a route or method used to reach a target; an attack surface is the set of exposed points that could be targeted. Common vectors include messages, files, removable media, insecure networks, exposed ports, default credentials, and vulnerable software.

→ Recognize social engineering by its method: phishing uses deceptive messages, smishing uses SMS, vishing uses voice, and business email compromise abuses trusted business communications. Pretexting, baiting, impersonation, tailgating, and typosquatting are distinct techniques.

→ Do not confuse a vulnerability, a threat, an exploit, and risk. Vulnerabilities can affect applications, web services, operating systems, hardware, virtualization, cloud environments, mobile devices, cryptography, configurations, and supply chains.

→ Know application and web weaknesses such as SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), command injection, buffer overflows, directory traversal, and insecure deserialization. Identify the affected component and the attack's actual outcome. Copy point

→ Distinguish malware types including viruses, worms, Trojans, ransomware, spyware, rootkits, keyloggers, remote-access Trojans, logic bombs, fileless malware, and wipers. A virus generally needs a host; a worm can self-propagate. Copy point

→ Recognize network, wireless, and physical attack techniques, including denial of service, distributed denial of service, on-path attacks, ARP spoofing, DNS poisoning, rogue access points, evil twins, deauthentication, jamming, and unauthorized physical access. Copy point

→ Understand cryptographic attacks and password attacks. Distinguish brute force, dictionary attacks, password spraying, credential stuffing, and offline password cracking; do not treat them as interchangeable. Copy point

→ Indicators of malicious activity may include unusual account behavior, repeated failed logins, unexpected processes, unexplained resource usage, suspicious outbound traffic, unauthorized configuration changes, and abnormal network patterns. Investigate indicators in context. Copy point

→ Mitigation techniques include segmentation, access control, application allowlisting, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, secure decommissioning, and system hardening. Select controls that address the weakness described in the scenario. Copy point

← Previous Domain Domain 01: General Security Concepts Next Domain Domain 03: Security Architecture

Back to Security+ Study Guide

🛡️

Ready to test yourself?

Practice domain-specific Security+ SY0-701 questions with timer, scoring, and explanations.

Take Practice Exam →

Domain 02: Threats, Vulnerabilities & Mitigations

Lessons in This Domain

Threat Actors, Motivations, and Capabilities: Security+ SY0-701 Lesson 02.1

Threat Vectors and Attack Surfaces: Common Entry Points Explained

Social Engineering Attacks: Phishing, Vishing, Smishing, BEC, and More

https://networkustad.com/security-plus/lessons/vulnerability-fundamentals-misconfigurations-zero-day-security-plus-sy0-701/

Indicators of Malicious Activity: Malware, Network, Password, and Application Attacks

Domain 2.0 Summary & Common Exam Pitfalls

Ready to test yourself?