- How a threat vector differs from an attack surface and a vulnerability.
- How messages, images, files, voice calls, and removable devices can expose users and systems to threats.
- Why vulnerable or unsupported software, insecure networks, open service ports, and default credentials create exposure.
- How vendors, suppliers, and managed service providers can expand an organization’s attack surface.
- How human vectors and common social-engineering techniques fit into the SY0-701 objective.
- How to identify the most relevant vector or exposed surface in a scenario-based exam question.
- How basic attack-surface reduction and layered controls reduce exposure.
Explain common threat vectors and attack surfaces.
This lesson covers the listed objective categories. Social-engineering techniques are introduced here and will be examined in greater depth in Lesson 02.3.
What Is a Threat Vector?
A threat vector is a route, method, or means through which a threat actor can attempt to reach a target, exploit a weakness, obtain access, or cause harm. A vector may involve a person, message, file, device, network connection, exposed service, software weakness, or third-party relationship.
For example, a malicious email attachment is a message or file-based delivery route. An exposed remote-access service may provide an entry point through a network. A compromised supplier may introduce risk through an organization’s supply chain.
A threat vector describes how a threat may reach or affect a target. It does not automatically tell you who the actor is, whether the attempt succeeded, or what the actor’s ultimate motivation may be.
What Is an Attack Surface?
The attack surface is the set of points where an attacker may attempt to enter a system, cause an effect, or extract data. These points can include exposed services, applications, endpoints, accounts, communication channels, people, devices, interfaces, and third-party connections. NIST uses this concept to describe the points at a system’s boundary that an attacker may target. NIST CSRC: Attack Surface.
An organization can have several overlapping attack surfaces: its network perimeter, cloud environment, endpoints, web applications, employee identities, facilities, and supplier connections. The attack surface changes whenever new systems, accounts, interfaces, integrations, or services are introduced or removed.
Threat vector: the route or method an attacker may use.
Attack surface: the points or exposure that can be targeted.
Vulnerability: a weakness that may be exploited.
Example: an exposed remote-access service is part of an attack surface; an attacker may use a network-based vector to reach it; a software flaw or weak authentication may provide the vulnerability.
Threat Vector vs. Attack Surface vs. Vulnerability
| Concept | Key question | Example | Exam clue |
|---|---|---|---|
| Threat vector | How could the threat reach the target? | A malicious link delivered through a message. | Method, route, delivery channel, or entry path. |
| Attack surface | Which exposed points could be targeted? | Public-facing services, accounts, endpoints, and supplier integrations. | Exposed interfaces, services, devices, or access points. |
| Vulnerability | Which weakness could be exploited? | An unpatched application flaw or unchanged default password. | Weakness, flaw, misconfiguration, or unsupported component. |
| Threat actor | Who may carry out the activity? | A criminal group, insider, hacktivist, or nation-state actor. | Actor identity or category, if enough evidence is provided. |
1. Message-Based Threat Vectors
Messages can deliver malicious links, instructions, attachments, or requests designed to make a user disclose information or perform an unsafe action. CompTIA identifies email, Short Message Service (SMS), and instant messaging (IM) as message-based vectors. Official SY0-701 exam objectives.
Email Messages
An email may contain a malicious link, a harmful attachment, a fake invoice, or a request for credentials or payment.
Text Messages
SMS messages can direct a user to a deceptive website or pressure them to reveal information.
Instant Messaging
Messaging platforms can carry suspicious links, files, impersonation attempts, or requests from compromised accounts.
Important: a trusted communication platform does not make every message trustworthy. Verify unexpected requests through a known, independent channel—especially when they involve credentials, money, sensitive information, or changes to account settings.
2. Image-Based and File-Based Vectors
Images and Image Handling
Image-based exposure may involve a deceptive image used in a message, content crafted to exploit a weakness in an image-processing application, or an image that directs a user to an unsafe destination.
- A fake QR-code image directs employees to a fraudulent sign-in page.
- A malformed image targets a vulnerable image-processing component.
- An apparently harmless image is used to encourage a risky action.
Do not assume that every image is malicious or that an image file automatically executes code. The risk depends on the content, user action, application, and any exploitable weakness.
Documents, Archives, and Executables
Files can contain malicious code, exploit vulnerable software, abuse macros or scripts, or persuade users to run an unsafe program.
- A document exploits a vulnerable reader.
- An archive contains a disguised executable.
- A script or installer performs unauthorized actions when run.
File extensions, icons, or familiar-looking names are not proof of safety. Validate the source, apply appropriate scanning, and use controlled execution policies.
The channel identifies how the content arrives. The file or payload describes what is delivered. A malicious document sent by email can be both email-delivered and file-based, so use the question’s exact focus when choosing the best answer.
3. Voice Calls and Removable Devices
Telephone and Voice-Based Exposure
A caller may impersonate a bank, executive, vendor, support desk, or government office to pressure someone into revealing data, approving a transaction, or changing a security setting.
- Requests to disclose one-time codes or passwords.
- Urgent demands to change payment details.
- Claims that a support technician needs remote access.
USB Drives and Portable Media
USB drives and other removable media can introduce malware, carry sensitive data out of an organization, or connect a device to an untrusted system.
- A found USB drive tempts an employee to plug it into a workstation.
- Unapproved removable media moves data outside managed storage.
- A device is used to introduce files that bypass normal delivery channels.
4. Vulnerable Software: Client-Based and Agentless Approaches
Software can become an entry point when it contains exploitable weaknesses, is misconfigured, or is exposed to untrusted inputs or connections. The risk can affect desktop applications, server software, browsers, mobile apps, management tools, plugins, and cloud-connected services.
Organizations use different approaches to assess or inventory systems and identify weaknesses. Two terms you should recognize are client-based and agentless.
| Approach | How it works | Potential benefit | Potential limitation |
|---|---|---|---|
| Client-based or agent-based | A software agent is installed on a managed endpoint or system to collect information or perform configured checks. | Can provide local visibility and collect information while the endpoint is away from the corporate network, depending on design. | Requires agent deployment, maintenance, compatibility, and protection. |
| Agentless | Assessment or inventory takes place remotely through supported protocols, interfaces, or credentials without installing a persistent agent on each target. | May simplify deployment and avoid maintaining an agent on every device. | Visibility depends on reachability, permissions, protocol support, and the assessment method. |
These terms describe approaches to collecting system or security information; neither approach automatically makes a system secure. The goal is to discover exposure, maintain an accurate inventory, assess weaknesses, and prioritize corrective action.
5. Unsupported Systems and Applications
An unsupported system or application no longer receives the expected vendor security updates or technical support. Unsupported software can retain known weaknesses because patches may not be available, and organizations may struggle to obtain reliable fixes.
A business continues to use an operating system after its vendor’s support period ends because an old application depends on it.
Risk: known or newly discovered vulnerabilities may remain unresolved, and the system may be difficult to defend using normal update processes.
Security response: prioritize replacement or upgrade, isolate the system where feasible, limit access, monitor activity, and document any approved exception and compensating controls.
Legacy systems may be necessary in some environments, but operational dependency is not evidence that the system is safe. Organizations should understand why the system remains, which assets depend on it, what exposure it creates, and how that risk will be managed.
6. Unsecure Networks: Wireless, Wired, and Bluetooth
A network becomes a threat vector when its access, configuration, protocols, devices, or traffic paths allow unauthorized activity. CompTIA specifically identifies wireless, wired, and Bluetooth networks under unsecured network vectors.
Wi-Fi Networks
Weak security settings, deceptive access points, poor segmentation, or unsafe use of public Wi-Fi can expose traffic, devices, or credentials.
Clue: a user connects to an untrusted hotspot and accesses sensitive services.
Wired Networks
Uncontrolled wall ports, exposed network equipment, weak port access controls, or poorly segmented internal networks can permit unauthorized connections.
Clue: an unknown device connects to an unprotected office network port.
Short-Range Wireless
Discoverable devices, unsafe pairing, outdated implementations, or unnecessary Bluetooth availability may increase exposure.
Clue: an unneeded wireless interface remains enabled and accepts unwanted connection attempts.
Network security depends on more than whether a connection is wireless or wired. Authentication, encryption, segmentation, configuration, patching, and monitoring all influence the level of exposure.
7. Open Service Ports
A service port is a logical endpoint used by networked applications and services. An open port may be necessary for business operations, but each listening service can create exposure if it is unnecessary, misconfigured, vulnerable, or reachable by the wrong users.
| Situation | Why it matters | Risk-reduction approach |
|---|---|---|
| A remote administration service is exposed to the public internet. | It may attract scanning, credential attacks, and exploitation attempts. | Restrict source access, require strong authentication, monitor use, and use an approved remote-access design. |
| An old service remains enabled even though the business no longer needs it. | It creates avoidable exposure and may contain unpatched weaknesses. | Disable or remove the unnecessary service and close its network path. |
| A required service is reachable from networks that do not need it. | More systems and users can attempt to reach it than the business requires. | Apply firewall rules, access control lists, segmentation, and least-privilege network access. |
Open ports are not inherently malicious. The question is whether the service is needed, properly secured, patched, monitored, and accessible only to appropriate sources. Reducing unnecessary exposure is the objective.
8. Default Credentials
Default credentials are usernames, passwords, or authentication settings supplied with a product or set during its initial installation. If an organization fails to replace them, an attacker may be able to use known or easily guessed credentials to access a device or application.
A newly installed network appliance is connected to the corporate network while its factory administrator password remains unchanged.
Exposure: the device may be accessible through a known login combination or predictable configuration.
Security response: change default credentials before deployment, use unique managed secrets, restrict administrative access, keep firmware updated, and monitor authentication activity.
Changing only the visible administrator password is not a complete security review. Organizations should also review built-in accounts, remote management settings, service accounts, unused interfaces, and any default keys or tokens supplied by the product.
9. Supply-Chain Threat Vectors
An organization’s exposure can extend beyond systems it owns and operates. Vendors, suppliers, software providers, and managed service providers may have access to its environment or deliver components on which it depends.
Managed Service Providers
An MSP may remotely administer systems, monitor infrastructure, or hold privileged access on behalf of several customers.
Risk: excessive privileges or compromise of provider access may affect customer environments.
Technology Vendors
Vendors may provide software, hardware, updates, integrations, or remote support that becomes part of the organization’s trusted environment.
Risk: a compromised update or poorly secured support channel may introduce exposure.
Suppliers and Dependencies
Suppliers may deliver components, services, data, or software that an organization uses in production.
Risk: weaknesses in a supplier’s process can flow into the receiving organization.
Supply-chain risk is not limited to software. Hardware, third-party service access, outsourced operations, and supplier workflows can also create dependencies and exposure.
Basic Supply-Chain Risk Controls
- Assess supplier security practices and the sensitivity of the access or service provided.
- Limit third-party permissions to what is required, and review access regularly.
- Require appropriate authentication, secure support channels, logging, and incident notification.
- Verify software and updates through approved processes, and maintain an inventory of important dependencies.
- Plan how access will be removed when a contract or business relationship ends.
10. Human Vectors and Social Engineering
People with access to accounts, facilities, systems, or sensitive information are part of an organization’s human attack surface. Social engineering attempts to influence people into disclosing information, transferring money, granting access, or performing another action that benefits the attacker.
Objective 2.2 lists the following human vectors and social-engineering techniques. Lesson 02.3 will cover these methods in greater depth, including how to distinguish similar-looking scenarios.
| Technique | Meaning | Typical clue |
|---|---|---|
| Phishing | Deceptive communication intended to trick a target into disclosing information or taking an unsafe action. | A fraudulent message requests login details or payment. |
| Vishing | Phishing conducted through voice calls or voice messages. | A caller pretends to be help desk staff and asks for an authentication code. |
| Smishing | Phishing delivered through SMS or text messaging. | A text message claims a parcel or bank account requires urgent action. |
| Misinformation | False or inaccurate information that may be spread without deliberate intent to deceive. | Incorrect information is shared and leads staff toward an unsafe decision. |
| Disinformation | False information intentionally created or spread to mislead. | A deliberately fabricated warning prompts employees to reveal information. |
| Impersonation | Pretending to be a trusted person, role, company, or authority. | A person claims to be an executive and demands an urgent transfer. |
| Business email compromise (BEC) | Fraud that abuses or impersonates business email communications to influence financial or sensitive business actions. | A supplier payment request appears to change bank details unexpectedly. |
| Pretexting | Using a fabricated story or situation to gain trust or obtain information. | A caller invents an account-verification problem to obtain employee details. |
| Watering hole | Compromising or abusing a website likely to be visited by a target group. | A niche professional website used by a target is altered to deliver harmful content. |
| Brand impersonation | Misusing a brand’s identity or appearance to make deceptive communications or destinations seem legitimate. | A fake cloud-service sign-in page imitates a well-known provider. |
| Typosquatting | Registering or using a domain name that resembles a legitimate domain, often by exploiting typing errors. | A user visits a look-alike web address with a subtle spelling change. |
Vishing points to voice; smishing points to SMS; pretexting points to a fabricated story; impersonation points to a false identity; and typosquatting points to a look-alike domain. One incident can combine several techniques, so select the term that best matches the question’s emphasis.
11. Reducing the Attack Surface
An organization cannot eliminate every possible risk, but it can reduce unnecessary exposure and make important systems harder to reach or misuse. Attack-surface reduction begins with knowing what is deployed, exposed, connected, and authorized.
Reduce Technical Exposure
- Remove unnecessary services and close unused ports.
- Patch supported systems and retire unsupported applications where possible.
- Change default credentials and use strong, unique authentication.
- Secure wireless, wired, and Bluetooth interfaces.
- Segment networks and restrict administration paths.
Reduce Human and Third-Party Exposure
- Train staff to verify unexpected requests through trusted channels.
- Limit access for employees, contractors, and suppliers.
- Review vendor and MSP access, contracts, and offboarding.
- Use approved file-sharing and removable-media procedures.
- Monitor activity and investigate anomalous access.
Controls should be selected to match the specific exposure. For example, patching addresses known software weaknesses; closing an unnecessary port removes an entry point; changing default credentials reduces predictable authentication exposure; and supplier-access reviews address third-party risk.
12. How to Analyze a Security+ Scenario
Look for the message, file, call, device, port, credential, network, application, or third party described.
A delivery method and a vulnerability can occur together, but they answer different questions.
Consider the affected user, endpoint, service, network, application, information, or supplier relationship.
If asked how the attack arrived, identify the vector; if asked what can be targeted, identify the attack surface; if asked about a weakness, identify the vulnerability.
Common Security+ Exam Traps
- Threat vector is not the same as attack surface. One describes a route; the other describes exposed points.
- An open port is not automatically a vulnerability. The service may be required, but it should be secured and appropriately restricted.
- Unsupported software is a risk even without a confirmed active exploit. Missing security updates can leave weaknesses unresolved.
- Agent-based and agentless are assessment approaches. Their visibility and deployment trade-offs depend on implementation.
- Supply-chain risk includes service providers. A trusted third party can have access to multiple customer environments.
- Not every social-engineering technique is a message-based vector. Voice, websites, domains, fabricated stories, and impersonation also matter.
- A file delivered by email can involve multiple vectors. Choose the category that best fits the question’s wording.
Quick Reference
| Scenario clue | Best-fit concept |
|---|---|
| Deceptive email, text, or instant message | Message-based vector |
| Image or QR code directs the target to unsafe content | Image-based exposure |
| Document, archive, script, or executable carries risk | File-based vector |
| Caller pressures someone to disclose data or approve an action | Voice vector; possibly vishing or impersonation |
| Unknown USB device is inserted into a managed system | Removable-device vector |
| Old application no longer receives security updates | Unsupported system or application |
| Wireless, wired, or Bluetooth access is poorly secured | Unsecured network vector |
| Unnecessary externally reachable service is enabled | Open service port and exposed attack surface |
| Factory password remains unchanged | Default credentials |
| Provider or supplier has risky access to a customer environment | Supply-chain or third-party exposure |
| Look-alike web address exploits a spelling mistake | Typosquatting |
Identify the route, the exposed point, and the weakness separately. The fastest way to the right answer is to ask: How could the attacker reach the target, what can be targeted, and what weakness makes the attempt possible?
Practice Questions
10 scenario-based questions. Expand any question to reveal the answer and explanation.
Exam Quiz
Lesson 02.2 — Threat Vectors and Attack Surfaces · 15 questions · 10 minutes
Threat Vectors — Exam Simulation
Practice identifying message, file, network, software, removable-device, service-port, credential, supply-chain, and human vectors for Security+ SY0-701 objective 2.2.
15 Questions
Lesson 02.2 scope
10 Minutes
Timed attempt
Instant Feedback
Explanation after each answer
Answer Review
Score and explanations
Lesson 02.2 — Summary
Threat Vectors and Attack Surfaces: Common Entry Points Explained
Domain 2.0 — Threats, Vulnerabilities and Mitigations · 22% of Security+ SY0-701
📌 Key Takeaways from Lesson 02.2
Examples include messages, files, calls, devices, and network paths.
Accounts, interfaces, systems, services, applications, people, and third-party connections.
Patch supported systems, remove unnecessary services, and restrict access.
Review vendors, suppliers, managed service providers, and external access.
Verify unexpected requests and recognize impersonation or deceptive messages.
Inventory assets, limit access, close unused ports, and monitor activity.
⚡ Exam Tips — Lesson 02.2
- Identify how the attack arrives before naming a vector.
- Do not confuse the attack surface with a specific attack route or a vulnerability.
- Remember email, SMS, and instant messaging as separate message-based channels.
- Understand client-based versus agentless assessment at a high level.
- Recognize wireless, wired, Bluetooth, open ports, default credentials, unsupported software, and supplier access as potential exposure.
- Learn the social-engineering terms now; Lesson 02.3 will examine their differences in depth.
⚠️ Common Pitfalls — Lesson 02.2
📋 Complete Security+ SY0-701 Guide Series — 5 Domains · 57 Numbered Lessons
Further Reading and Related Guides
Continue learning on NetworkUstad:
- Security+ Domain 2.0 Guide Hub — browse the Domain 2 lesson sequence.
- Security+ SY0-701 Guide Hub — access the complete certification guide series.
External references:
- CompTIA Security+ SY0-701 Exam Objectives — official Domain 2 objective list.
- NIST CSRC: Attack Surface — definition of attack surface.
