D2: Threats, Vulnerabilities, and Mitigations — Security+ SY0-701

2.1 Threat Actors and Motivations

A threat actor is any entity (person, group, or organization) that carries out or intends to carry out malicious activity. The exam expects you to distinguish actor types by their attributes (where they sit, how well resourced they are, how sophisticated they are) and by their motivations (what they are trying to achieve).

Threat Actor Attributes

Every actor can be described along a few dimensions. These attributes often reveal the actor type in a scenario question.

Attribute	What it describes
Internal vs. external	Whether the actor operates from inside the organization (employee, contractor) or outside it
Resources and funding	Access to money, tooling, infrastructure, and personnel. Ranges from none to the budget of a national government.
Level of sophistication and capability	Technical skill and the ability to develop custom tools, exploits, and long-term operations

Threat Actor Types

Actor	Profile	Typical resources / sophistication
Nation-state	Government-sponsored groups conducting espionage, sabotage, or influence operations. Often the source of advanced persistent threats (APTs) that maintain long-term, stealthy access.	Very high; the best-funded and most capable actors
Unskilled attacker (script kiddie)	Uses tools and exploits written by others without deep understanding of how they work. Motivated by curiosity, notoriety, or disruption.	Low resources, low sophistication
Hacktivist	Driven by a political, social, or ideological cause. Uses defacement, DDoS, and data leaks to make a statement.	Variable; skill ranges widely, funding usually limited
Insider threat	A current or former employee, contractor, or partner who abuses legitimate access. May be malicious (revenge, profit) or negligent.	Low technical need; the advantage is trusted access, not skill
Organized crime	Professional criminal groups running attacks as a business. Behind most ransomware and large-scale financial fraud.	High resources, high sophistication, profit-focused
Shadow IT	Employees deploying hardware, software, or cloud services without IT approval. Not malicious by intent, but creates unmanaged, unmonitored risk.	Internal; a risk source rather than a deliberate attacker

Motivations

A single actor can have several motivations, and the motivation often points to the actor type. The exam lists these explicitly, so know them by name.

Data exfiltration: stealing data to sell, leak, or exploit
Espionage: gathering intelligence, commonly nation-state or corporate
Service disruption: taking systems offline, as with DDoS
Financial gain: ransomware, fraud, theft; the driver behind organized crime
Blackmail: threatening to release stolen or damaging data unless paid
Philosophical or political beliefs: the hacktivist driver
Ethical: authorized security testing that improves defenses (the motivation of ethical hackers)
Revenge: retaliation, frequently from a disgruntled insider
Disruption or chaos: causing damage for its own sake
War: state-on-state cyber operations supporting a military objective

2.2 Threat Vectors and Attack Surfaces

A threat vector is the path or method an attacker uses to gain access. The attack surface is the total set of points where an attacker could try to enter. Reducing the attack surface (closing ports, removing software, restricting access) reduces the number of usable vectors.

Technical and Physical Vectors

Vector	How it is abused
Message-based (email, SMS, instant message)	Phishing links, malicious attachments, and social engineering delivered through communication channels. The most common initial vector.
Image- and file-based	Malicious code embedded in images, documents, or executables. A file that looks like a harmless PDF or spreadsheet can carry a payload.
Voice call	Vishing: attackers call to impersonate helpdesk, banks, or executives and extract credentials or approvals in real time.
Removable device	USB drives dropped in parking lots or mailed to targets. When plugged in, they can auto-run malware or act as a malicious keyboard.
Vulnerable software	Unpatched or poorly written applications. Client-based software runs an installed agent that can be exploited; agentless software is accessed without a dedicated client but still exposes server-side flaws.
Unsupported systems and applications	End-of-life software that no longer receives security patches. Every newly discovered flaw stays open permanently.
Unsecure networks	Wireless, wired, and Bluetooth connections without proper encryption or authentication allow eavesdropping and unauthorized access.
Open service ports	Every listening port is a potential entry point. Unnecessary open ports expand the attack surface.
Default credentials	Devices and applications shipped with known usernames and passwords that are never changed. Trivial for attackers to look up and use.
Supply chain	Compromising managed service providers (MSPs), vendors, or suppliers to reach their customers. Trust in a third party becomes the vector.

Human Vectors and Social Engineering

Social engineering manipulates people into breaking security procedures. It targets the human, not the technology, which is why awareness training is a core defense.

Technique	What it is
Phishing	Fraudulent email designed to steal credentials or deliver malware
Vishing	Voice phishing conducted over a phone call
Smishing	Phishing delivered by SMS or text message
Spear phishing	Phishing targeted at a specific individual or group using personalized detail
Whaling	Spear phishing aimed at senior executives ("big fish")
Business email compromise (BEC)	Impersonating an executive or trusted partner to authorize fraudulent payments or data release
Pretexting	Inventing a believable scenario to justify a request for information or access
Impersonation	Pretending to be someone with authority or a right to access
Watering hole attack	Compromising a legitimate website the target group is known to visit, so victims infect themselves
Brand impersonation	Mimicking a trusted brand's look and messaging to add credibility to an attack
Typosquatting	Registering domains that are common misspellings of real ones (e.g. exarnple.com) to catch mistyped traffic
Misinformation and disinformation	Spreading false or misleading content to manipulate opinion or behavior. Misinformation is spread without intent to deceive; disinformation is deliberate.

2.3 Types of Vulnerabilities

A vulnerability is a weakness that a threat can exploit. The exam groups vulnerabilities by where they live: applications, operating systems, hardware, virtualization, the cloud, the supply chain, and more.

Application and Web Vulnerabilities

Vulnerability	What it is
Memory injection	Inserting malicious code into a running process's memory space to alter its behavior
Buffer overflow	Writing more data into a buffer than it can hold, overwriting adjacent memory. Can crash a program or let an attacker run arbitrary code.
Race condition (TOCTOU)	A flaw where the outcome depends on timing. Time-of-check to time-of-use (TOCTOU) attacks exploit the gap between when a resource is checked and when it is used.
Malicious update	A software update that has been tampered with to deliver a payload, often through a compromised update channel
SQL injection (SQLi)	Inserting malicious SQL into an input field so it executes against the database, exposing or altering data
Cross-site scripting (XSS)	Injecting malicious scripts into web pages viewed by other users, hijacking sessions or stealing data

System, Hardware, and Virtualization Vulnerabilities

Vulnerability	What it is
Operating system based	Flaws in the OS kernel, services, or default configuration that grant access or elevate privileges
Firmware	Weaknesses in the low-level code that runs hardware. Hard to detect and patch, and persists below the OS.
End-of-life and legacy	Hardware or software no longer supported by the vendor. No patches means permanent exposure.
VM escape	Breaking out of a virtual machine to reach the hypervisor or other VMs on the same host
Resource reuse	Sensitive data left behind in memory or storage that is reallocated to another process or tenant without being cleared

Cloud, Supply Chain, and Other Vulnerabilities

Vulnerability	What it is
Cloud-specific	Misconfigured storage, overly permissive IAM, and exposed management APIs unique to cloud platforms
Supply chain	Weaknesses introduced through a service provider, hardware provider, or software provider that you inherit by trusting them
Cryptographic	Weak algorithms, poor key management, or flawed implementation that undermines encryption
Misconfiguration	Insecure settings: default credentials, open permissions, unnecessary services. One of the most common and preventable causes of breaches.
Mobile device (sideloading, jailbreaking)	Installing apps from outside official stores (sideloading) or removing OS restrictions (jailbreaking / rooting) bypasses built-in protections
Zero-day	A vulnerability unknown to the vendor with no available patch. Especially dangerous because no signature or fix yet exists.

2.4 Indicators of Malicious Activity

This objective is about recognizing attacks and malware from their behavior and telltale signs. It is the most memorization-heavy part of the domain, so focus on being able to identify each item from a description.

Malware Types

Malware	Defining behavior
Ransomware	Encrypts files or systems and demands payment for the decryption key
Virus	Attaches to a file or program and requires user action to execute and spread
Worm	Self-replicating malware that spreads across networks on its own, with no user action
Trojan	Disguised as legitimate software; delivers a hidden malicious payload once run
Spyware	Secretly gathers information about a user and their activity
Keylogger	Records keystrokes to capture passwords and other typed data
Rootkit	Hides its presence and grants privileged access, often operating below the OS to evade detection
Logic bomb	Dormant code that triggers when a condition is met (a date, an event, a departed employee's account)
Bloatware	Unnecessary preinstalled software that consumes resources and can expand the attack surface

Attack Categories

Physical attacks: brute force (forcing physical entry), RFID cloning (copying access badges), and environmental attacks (manipulating power, cooling, or fire suppression).
Network attacks: distributed denial-of-service (DDoS, including amplified and reflected variants), DNS attacks (poisoning, hijacking), wireless attacks, on-path attacks (formerly man-in-the-middle), credential replay, and malicious code.
Application attacks: injection, buffer overflow, replay, privilege escalation, request forgery, and directory traversal.
Cryptographic attacks: downgrade (forcing use of a weaker protocol), collision (two inputs producing the same hash), and birthday (exploiting hash collision probability).
Password attacks: spraying (trying one common password across many accounts to avoid lockout) and brute force (trying many passwords against one account).

Indicators of Compromise

Indicators are the observable signs that an attack is occurring or has occurred. Know these by name, since the exam asks you to map a symptom to its indicator.

Indicator	What it suggests
Account lockout	Repeated failed logins, often a sign of a brute-force or password-guessing attempt
Concurrent session usage	The same account active in two places at once, suggesting credential compromise
Impossible travel	Logins from distant locations in a timeframe no person could physically travel, indicating stolen credentials
Blocked content	Security tools blocking access to known-malicious resources
Resource consumption	Unusual spikes in CPU, memory, bandwidth, or storage, which can indicate mining, exfiltration, or DoS
Resource inaccessibility	Systems or data suddenly unavailable, a hallmark of ransomware or DoS
Out-of-cycle logging	Log entries at unexpected times, suggesting activity outside normal business hours
Missing logs	Gaps or deleted entries, a sign an attacker is covering their tracks
Published or documented	Stolen data appearing publicly, or the attack being reported by an outside party

2.5 Mitigation Techniques

Mitigation techniques reduce the likelihood or impact of an attack. This objective pairs naturally with the rest of the domain: given a threat or vulnerability, you should be able to name the control that addresses it.

Core Mitigation Techniques

Technique	What it does
Segmentation	Dividing a network into zones so a breach in one area cannot spread freely to others. Limits blast radius.
Access control	Enforcing who can reach what through access control lists (ACLs) and permissions
Application allow list	Permitting only approved applications to run; everything else is blocked by default
Isolation	Separating a system or process (for example, sandboxing) so a compromise cannot affect the rest of the environment
Patching	Applying vendor updates to close known vulnerabilities. The single most effective routine control.
Encryption	Protecting data in transit and at rest so that intercepted or stolen data is unreadable
Monitoring	Continuously watching systems and logs to detect and respond to malicious activity
Least privilege	Granting each user or process only the access needed to do its job, and no more
Configuration enforcement	Ensuring systems stay in a known-secure state through baselines and automated compliance checks
Decommissioning	Securely retiring and removing systems that are no longer needed, eliminating their attack surface

Hardening Techniques

Hardening reduces a system's attack surface by removing weaknesses and tightening its configuration.

Endpoint detection and response (EDR): monitors endpoints for malicious behavior and enables rapid response
Host-based firewall: filters traffic to and from an individual device
Host-based intrusion prevention system (HIPS): detects and blocks malicious activity on a host
Disabling unused ports and protocols: closes entry points that are not needed
Changing default passwords: removes one of the easiest and most exploited weaknesses
Removing unnecessary software: shrinks the attack surface by eliminating unused programs and services