Security+ Domain 2 Study Guide: Threats, Vulnerabilities, and Mitigations (SY0-701)
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Threats, Vulnerabilities, and Mitigations is 22% of the Security+ SY0-701 exam and has 5 objectives. This study guide lists each objective with its official title, summarizes the concepts you need in tables, flags the exam traps that cost points, and gives three original practice questions with explanations for every option. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
Domain 2 at a Glance
Threats, Vulnerabilities, and Mitigations is 22% of the Security+ SY0-701 exam. It has 5 objectives, listed below with their official titles. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
| Objective | Official title |
|---|---|
| 2.1 | Compare and contrast common threat actors and motivations. |
| 2.2 | Explain common threat vectors and attack surfaces. |
| 2.3 | Explain various types of vulnerabilities. |
| 2.4 | Given a scenario, analyze indicators of malicious activity. |
| 2.5 | Explain the purpose of mitigation techniques used to secure the enterprise. |
Threat Actors and Motivations
| Actor | Typical traits |
|---|---|
| Nation-state | Large budgets, high sophistication, long-term espionage or disruption |
| Organized crime | Well funded, financially motivated, runs ransomware and fraud at scale |
| Hacktivist | Driven by political or philosophical beliefs, often limited funding |
| Insider threat | Already has legitimate access and knowledge of internal systems |
| Unskilled attacker | Uses existing tools with little sophistication |
| Shadow IT | Unapproved technology that creates unmanaged risk |
Motivations include data exfiltration, espionage, financial gain, service disruption, blackmail, revenge, ethical hacking and political or philosophical beliefs.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Threat Vectors and Attack Surfaces
| Vector | Examples |
|---|---|
| Message-based | Email, SMS and instant messaging |
| File-based and image-based | Malicious attachments and documents, weaponized images |
| Voice call | Vishing |
| Removable device | Infected USB drives |
| Software | Vulnerable or unsupported systems and applications |
| Network | Unsecure wireless, wired or Bluetooth networks, open service ports, default credentials |
| Supply chain | Managed service providers, vendors and suppliers |
| Human | Phishing, pretexting, impersonation, business email compromise, watering hole attacks, typosquatting, misinformation and disinformation |
Types of Vulnerabilities
| Type | Examples |
|---|---|
| Application | Memory injection, buffer overflow, race conditions such as time-of-check to time-of-use, malicious updates |
| Web-based | SQL injection and cross-site scripting |
| Operating system and hardware | Unpatched systems, firmware flaws, end-of-life and legacy hardware |
| Virtualization | VM escape and resource reuse |
| Cloud, supply chain, cryptographic | Misconfigured cloud services, compromised providers, weak algorithms or keys |
| Misconfiguration and mobile | Insecure defaults, side loading and jailbreaking |
| Zero-day | A flaw with no patch available yet |
Malware and Attack Indicators
| Malware | Key trait |
|---|---|
| Ransomware | Encrypts data and demands payment |
| Trojan | Looks legitimate but carries a malicious payload |
| Worm | Spreads on its own across networks |
| Virus | Needs a host file and user action to spread |
| Spyware and keylogger | Collect information and keystrokes |
| Logic bomb | Dormant until a condition triggers it |
| Rootkit | Hides itself and other malware, often at a low level |
| Bloatware | Unwanted preinstalled software |
Indicators to recognize include account lockouts, impossible travel, concurrent sessions, unusual resource consumption, blocked content, out-of-cycle logging and missing logs. Password attacks include brute force and password spraying.
Mitigation Techniques
| Technique | What it does |
|---|---|
| Segmentation and isolation | Limit how far an attacker can move |
| Access control and least privilege | Give only the access needed |
| Application allow list | Only approved software may run |
| Patching | Fix known vulnerabilities |
| Encryption and monitoring | Protect data and spot problems |
| Configuration enforcement and hardening | Keep systems in a secure state, remove defaults and unneeded services |
| Decommissioning | Retire systems and data securely |
Common Exam Traps
These mix-ups cost points in this domain.
Virus versus worm
A worm spreads by itself. A virus needs a host and a user action. Read how the malware spreads in the scenario.
Spraying versus brute force
Password spraying tries a few common passwords against many accounts. Brute force tries many passwords against one account.
Typosquatting versus watering hole
Typosquatting relies on mistyped addresses. A watering hole compromises a site the targets already visit.
Logic bomb versus trojan
A logic bomb waits for a condition. A trojan disguises itself as legitimate software.
Try It: Three Domain 2 Practice Questions
Answer these before you read the key. They are original questions written to the published objectives, and none are real exam questions.
Question 1. Attackers compromise a trade association website that employees of their target industry visit regularly, so that visitors are infected with malware. Which of the following BEST describes this technique?
- A. Typosquatting
- B. Business email compromise
- C. Watering hole attack
- D. Vishing
Question 2. A malicious script lies dormant on a file server and deletes all shared project folders when a specific employee account is disabled. Which of the following types of malware is this?
- A. Network worm
- B. Logic bomb
- C. Trojan horse
- D. Kernel rootkit
Question 3. Which of the following BEST distinguishes an insider threat from most external threat actors?
- A. The actor already holds legitimate access and knowledge of internal systems
- B. The actor always has greater technical sophistication than outsiders
- C. The actor is always motivated by financial gain rather than revenge
- D. The actor can only operate by exploiting zero-day vulnerabilities
Answer Key and Explanations
Question 1: C. Watering hole attack (objective 2.2)
A watering hole attack infects a site that the intended victims are known to frequent.
- A. Typosquatting. Typosquatting depends on mistyped domains, not on compromising a legitimate site.
- B. Business email compromise. Business email compromise targets payment or data requests through email impersonation.
- D. Vishing. Vishing is social engineering over a voice call.
Question 2: B. Logic bomb (objective 2.4)
A logic bomb stays dormant until a defined condition, such as an account being disabled, triggers its payload.
- A. Network worm. A worm self-propagates across systems and is not triggered by an account change.
- C. Trojan horse. A trojan disguises itself as legitimate software, which is not the defining behavior here.
- D. Kernel rootkit. A rootkit hides its presence and does not wait on a trigger condition.
Question 3: A. The actor already holds legitimate access and knowledge of internal systems (objective 2.1)
Insiders start with authorized access and knowledge of internal processes, which lets them bypass many perimeter controls.
- B. The actor always has greater technical sophistication than outsiders. Insiders range from unsophisticated to highly skilled, so sophistication does not define them.
- C. The actor is always motivated by financial gain rather than revenge. Insiders may act out of revenge, negligence, or other motives, not only money.
- D. The actor can only operate by exploiting zero-day vulnerabilities. Insiders rarely need zero-days because they can misuse access they already have.
How to Study Domain 2
Domain 2 carries 22% of the exam. See our objectives explained for all five domains, the study plan for how to split your days by weight, and the commonly confused terms cheat sheet for the pairs that appear here.
Build an attack table
List each attack, how it works and the best defense, then quiz yourself from the defense back to the attack.
Practice reading scenarios for indicators
Objective 2.4 is a scenario objective, so practice naming the attack from a short description of the symptoms.
Retry misses on different days
A widely cited review of learning techniques rated practice testing and spaced practice as high utility. Return to the questions you miss a few days later instead of rereading the same pages.
Practice With DD Academy
DD Academy has Security+ flashcards and practice questions for every objective in Domain 2, plus an AI tutor that explains why each option is right or wrong. It is free to start on iPhone and the web.
The bottom line
Know the 5 Domain 2 objectives, learn the concept tables until you can explain each term without notes, watch for the traps listed above and keep practicing with scenario questions across all five domains.
Frequently asked questions
What percentage of Security+ is Domain 2?
Threats, Vulnerabilities, and Mitigations is 22% of SY0-701 according to CompTIA. On SY0-801 the domain is renamed Threats, Vulnerabilities, and Attacks and is 24%.
How many objectives are in Domain 2?
Five on SY0-701: 2.1 threat actors, 2.2 vectors and attack surfaces, 2.3 vulnerabilities, 2.4 indicators of malicious activity and 2.5 mitigation techniques.
What is the difference between a virus and a worm?
A virus needs a host file and a user action to spread. A worm spreads on its own across networks without user action.
What is a watering hole attack?
An attack that compromises a website the intended victims are known to visit, so they are infected when they browse it. It is different from typosquatting, which relies on mistyped addresses.
What is password spraying?
Trying a small set of common passwords against many accounts, which avoids lockout thresholds. It differs from brute force, which tries many passwords against one account.
Where did the mitigation objective go in SY0-801?
SY0-801 moves mitigation topics out of Domain 2 and consolidates them in objective 4.1 in the Security Operations domain, and adds a new objective on AI threats.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
