Domain 2: Threats, Vulnerabilities, and Mitigations
This domain is about the other side: who attacks, how they get in, what weaknesses they use, how you’d notice, and what reduces the risk. It’s about 22% of SY0-701.
What changes in V8 for this domain: V8 renames this domain 'Threats, Vulnerabilities, and Attacks' (about 24%) and adds a new objective on AI-related risks: models, prompts, privacy and data exposure. In CompTIA's V8 summary, mitigation is no longer its own objective here.
Threat actors and motivations
Attackers differ in resources, skill, access, and motive. Look at capability and motivation separately.
- Nation-state / APT: well-funded and patient. Often after strategic information (espionage).
- Organized crime: in it for money, through ransomware, fraud and theft.
- Hacktivists: driven by a cause or ideology.
- Insider threats: people who already have access and misuse it, on purpose or by accident.
- Unskilled attackers: rely on existing tools and scripts.
- Shadow IT: well-meaning staff using unapproved tech, which creates unmanaged risk.
Threat vectors and attack surface
A vector is the path in. The attack surface is everything exposed: public services, accounts, devices, apps, vendors, and people.
- Phishing (email), vishing (voice), and smishing (SMS) trick people into handing over access.
- Watering hole: attackers compromise a site their targets already visit.
- Supply chain: attackers get in through a trusted vendor, update or dependency.
- Removable media / baiting: a USB stick left where someone will plug it in.
Shrinking the attack surface means turning off what you don’t need: unused services, open ports, old accounts.
Vulnerability types
A vulnerability is a weakness. A threat is something that could exploit it.
- SQL injection: user input changes a database query. Fix it with parameterized queries.
- Cross-site scripting (XSS): injected script runs in other users’ browsers.
- CSRF: tricks a logged-in browser into sending a request the user didn’t intend.
- Buffer overflow: writing past the end of a memory buffer.
- Race condition: a bug that depends on the timing between operations.
- Zero-day: a flaw attackers know about before a fix exists.
- Misconfiguration: a public storage bucket, default passwords, an open admin port.
Indicators of malicious activity
One odd event is a lead, not proof. Look for signs that line up:
- Beaconing: regular check-ins to an outside server (command and control).
- Impossible travel: logins from two places too far apart for the time between them.
- Privilege escalation and lateral movement: an attacker gaining rights and spreading.
- Data exfiltration: unusual outbound transfers.
- New scheduled tasks or services, unexpected file changes, and account lockouts.
Mitigation techniques
- Segmentation: limits where an attacker can move.
- Hardening: removes unneeded services, defaults and access.
- Patching: fixes known flaws, followed by a check that nothing broke.
- Application allowlisting: only approved software can run.
- Least privilege, isolation/quarantine, and compensating controls for systems you can’t patch.
- Defense in depth: layers of protection, so one failure isn’t fatal.
Key terms
Try to define each term before you tap it.
Nation-state
Government-backed actor often interested in strategic intelligence
Hacktivist
Ideologically motivated attacker
Organized crime
Often profit-driven groups pursuing extortion, theft, or fraud
Insider threat
Someone with legitimate access who misuses it or makes damaging mistakes
Unskilled attacker
Relies on existing tools and scripts with limited technical skill (older slang: "script kiddie")
APT
Persistent, coordinated intrusion often associated with significant resources
Phishing
Fraudulent messages seeking credentials or malicious actions
Vishing
Voice-based social engineering
Smishing
SMS-based social engineering
Watering hole
Compromise of a website regularly visited by intended targets
Supply-chain attack
Compromise through vendor, update, or upstream dependency
Attack surface reduction
Disable unnecessary exposure, services, accounts, and paths
USB baiting
Social engineering through attractive or planted removable media
SQL injection
Untrusted input alters backend database queries
Cross-site scripting
Untrusted script executes in users’ browsers
CSRF
Causes a logged-in browser to submit unwanted actions
Zero-day
A vulnerability exploited or disclosed before a fix is available; terminology varies by context
Misconfiguration
Unsafe settings such as public storage or open administrative ports
Buffer overflow
Writing beyond intended memory boundaries
Race condition
Unexpected behavior caused by timing between operations
Beaconing
Repeated outbound communication to a remote endpoint
Privilege escalation
Obtaining higher permissions than initially held
Lateral movement
Moving between systems after initial access
Impossible travel
Logins from geographically incompatible locations in a short period
Data exfiltration
Unauthorized movement of information out of an environment
File integrity alert
Signal that monitored files have changed
Segmentation
Separates traffic and limits lateral movement
Hardening
Removes unnecessary services, default settings, and access
Patching
Installs updates that remediate known flaws
Application allowlisting
Permits only approved executables or applications
Least privilege
Restricts accounts to the minimum necessary access
Quarantine
Separates a potentially compromised asset for investigation
Compensating mitigation
Alternative risk reduction when direct remediation is infeasible
Quick self-check
5 practice questions in our own words. Pick an answer to see the explanation. Practice only: it doesn't predict exam results.
A well-funded group quietly copies a company's proprietary research over many months. What is the most likely motivation? Obj. 2.1
Show answer
B. Espionage. Long, quiet, targeted theft of strategic information points to espionage, often by an APT or nation-state group.
A trusted vendor ships a software update that contains malicious code. Which threat vector is this? Obj. 2.2
Show answer
B. Supply chain. The malware reached victims through a trusted supplier's product, which makes it a supply chain attack.
An app builds database queries by pasting raw user input into the SQL text. What is the best fix? Obj. 2.3
Show answer
B. Use parameterized queries. Parameterized queries keep user input as data so it can never change the structure of the SQL command. The other options do not fix the root cause.
One workstation contacts the same unfamiliar external IP every 60 seconds, around the clock. What pattern is this? Obj. 2.4
Show answer
A. Beaconing. Regular, repeated check-ins to an outside host are a classic sign of command-and-control beaconing.
An unsupported legacy device cannot be patched. What most directly limits an attacker's ability to move from it to other systems? Obj. 2.5
Show answer
A. Network segmentation. Segmentation controls which systems the device can talk to, which limits lateral movement even when the device itself stays vulnerable.
Official exam details, objectives and pricing: CompTIA Security+ (official page) (opens in new tab).
NeonKey isn't affiliated with or endorsed by CompTIA. Security+ is a trademark of CompTIA. No pass guarantees — check CompTIA for current exam details.