Security+ SY0-701 Threats, Vulnerabilities, and Mitigations
Table of Contents
Click Here to Return To the CompTIA Security+ Course Page
Threats, Vulnerabilities, and Mitigations is 22% of the CompTIA Security+ SY0-701 exam, the second-largest domain. This module covers threat actors, attack vectors, vulnerabilities, malicious indicators, and mitigations. Know the attacker, the attack, and the fix for each scenario the exam presents.
You cannot defend what you do not understand. This module teaches who attacks, how they get in, where systems are weak, and how you close the gaps. It is the offensive knowledge a defender needs.
Threat Actors
You profile attackers by motivation and capability.
| Actor | Motivation | Resources |
|---|---|---|
| Nation-state | May seek espionage or disruption | Varies by actor and operation |
| Organized crime | Often seeks financial gain | Varies by group |
| Hacktivist | May seek publicity or change | Varies by group |
| Insider threat | Revenge, money, mistakes | Trusted access |
| Unskilled attacker | Motivation unknown without evidence | May rely on published tools |
| Shadow IT | Convenience | Internal, unsanctioned |
Attributes differ: internal vs external, resources/funding, and level of sophistication. Do not infer actor identity from a single indicator. Investigate the operation and evidence.
Attack Vectors and Surfaces
You identify how attackers reach a target.
- Message-based: phishing (email), vishing (voice), smishing (SMS).
- Business email compromise (BEC) uses a message which appears to come from a known source to induce a fraudulent request. The impersonated person need not be an executive.
- Supply chain attacks compromise a trusted vendor or update.
- Removable media spreads malware over USB.
- Unsecured networks expose wireless and wired traffic.
Vulnerability Types
You categorize weaknesses by where they live.
| Vulnerability | Example |
|---|---|
| Application | Injection, memory leaks, race conditions |
| Operating system | Unpatched kernel flaws |
| Hardware | Firmware, end-of-life devices |
| Virtualization | VM escape, resource reuse |
| Cloud | Misconfiguration, weak IAM |
| Zero-day | A previously unknown vulnerability at the time of attack. Track awareness, disclosure, exploitation, and fix status separately. |
A zero-day attack exploits a previously unknown vulnerability. Once discovered, the same flaw still needs a patch and exposure review. Track awareness, disclosure, exploitation, and fix status separately. Misconfigurations are one important, preventable source of exposure.
Indicators of Malicious Activity
You recognize attacks by their signs.
| Attack | Indicator |
|---|---|
| Malware | Unexpected processes, beaconing traffic |
| Ransomware | Encrypted files, ransom note |
| Password attack | Many failed logins, spraying |
| DDoS | Traffic spike, service outage |
| DNS attack | Redirected or poisoned lookups |
| On-path (MITM) | Certificate warnings |
You also know application attacks: SQL injection runs database commands, XSS runs script in a victim’s browser, buffer overflow writes past memory bounds, and CSRF forces an action with a logged-in session.
Social Engineering
You defend against attacks on people.
- Pretexting invents a believable scenario.
- Impersonation poses as IT, a vendor, or an executive.
- Watering hole infects a site the target trusts.
- Tailgating and piggybacking bypass physical access.
- Pharming redirects users to fake sites.
Training, reporting channels, and technical controls reduce the impact of social engineering.
Mitigation Techniques
You reduce risk with layered controls.
| Technique | Effect |
|---|---|
| Patching | Closes known vulnerabilities |
| Encryption | Protects data confidentiality |
| Segmentation | Limits lateral movement |
| Least privilege | Shrinks the blast radius |
| Monitoring | Detects activity early |
| Hardening | Removes unneeded services and defaults |
| Access control (ACL) | Restricts who reaches what |
Hardening disables unused ports and services, changes default credentials, and applies secure baselines. To see why legacy systems stay exposed, read why OT/ICS PLC cybersecurity is fundamentally broken .
Practice: Trace an Attack Chain
Continue the fictional Harbor Library case. An employee receives a message asking them to open a new invoice. An attachment runs a script on laptop-17. The security log later shows an unusual sign-in to the archive account and a member export to /tmp/out. The observed facts are message, script execution, sign-in, and export. The actor’s identity and intent are unknown.
Build a six-column worksheet: observation and timestamp, attack vector, exploited weakness, possible impact, control, and validation. For example, the message is a possible phishing vector; the attachment execution needs verification through endpoint telemetry. The export suggests a confidentiality risk, but you still need destination, owner, and authorization evidence.
Choose at least three layered controls: block or isolate risky attachments, use phishing-resistant MFA for the archive role, and restrict exports by role and destination. Add monitoring for unusual exports and a tested backup for recovery. Explain which control is preventive, detective, or corrective. State a residual risk: an authorized user or compromised endpoint might still misuse permitted access. Validate with synthetic negative and positive access cases; mark them unrun if no disposable lab exists.
Pass when the worksheet distinguishes indicator from conclusion, avoids naming a threat actor without evidence, names an owner for each control, and gives a test which would show a control working. Review the CompTIA SY0-701 objectives and NIST CSF 2.0 .
Worked attack-chain answer
The following evidence is fictional and exists only in this lesson. laptop-17 reports an attachment launch at 09:00. Two archive-account failures occur at 09:01 and 09:02, then a successful sign-in at 09:04. The records app reports a member export at 09:06. No destination or account-owner statement is available.
| Observation | Vector | Weakness to test | Possible impact | Control | Validation |
|---|---|---|---|---|---|
| Invoice message at 08:58 | Message-based | Sender trust decision unknown | User opens file | Report and isolate suspicious message | Confirm mailbox record and report |
| Attachment launch at 09:00 | File-based | Execution rule may allow untrusted file | Endpoint code runs | Attachment policy and endpoint protection | Benign test file blocked and approved file allowed |
| Two failed sign-ins | Credential attack is possible | MFA status unknown | Account probing | Phishing-resistant MFA and alert | Synthetic failures alert; normal sign-in allowed |
| Successful sign-in | Access via archive account | Account authorization unclear | Restricted data access | Least privilege and owner confirmation | Allowed read and denied export cases |
| Member export | App action | Destination control unknown | Data disclosure | Export restriction and monitoring | Approved count-only export succeeds; named export denied |
Do not label the actor from this sequence. Ask for source telemetry, account-owner confirmation, approved work record, export destination, and file access rules. A benign explanation remains possible. Residual risk: an authorized user might misuse permitted export access. The records lead decides whether the role needs export rights and reviews the test evidence.
Award one point each for a correct observation sequence, at least two alternative explanations, three layered controls, an owner and positive/negative test for each control, and a stated residual risk. Pass at 5 of 5. Mark any unperformed test not run, never passed.
Next Steps
Continue with Security Architecture to design defenses, and Security Operations to detect and respond. Review the General Security Concepts module for controls. Return to the CompTIA Security+ Course .
