CompTIA Security+ Objectives : Threats, Attacks and Vulnerabilities (2 of 7 Part Series)

CompTIA Security+ questions on threats, attacks, and vulnerabilities are where a lot of candidates lose points. The exam rarely hands you the answer on a silver platter. It gives you symptoms, logs, user complaints, or business impact, then expects you to identify the weakness, the attack path, and the best defensive move.

Exam	CompTIA Security+ SY0-701 as of November 2026
Primary Domain Focus	Threats, attacks, vulnerabilities, and response analysis as of November 2026
Exam Length	90 minutes as of November 2026
Question Count	Up to 90 questions as of November 2026
Passing Score	750 on a 100–900 scale as of November 2026
Recommended Background	CompTIA A+ and Network+ level knowledge as of November 2026
Cert Validity	3 years as of November 2026

This guide is built for readers who want to pass the exam and do better on the job. It also lines up with the CompTIA Security+ Certification Course (SY0-701) from ITU Online IT Training, because the same recognition skills that help on test day also help when you are triaging alerts, reviewing logs, or helping users through a security incident.

Why Threats, Attacks, and Vulnerabilities Matter in Security+

This domain matters because it connects almost everything else on the exam. If you cannot identify a vulnerability, you cannot understand why a control failed. If you cannot recognize a threat, you cannot estimate risk. If you cannot separate an attack from its symptom, you will choose the wrong response.

Security+ is built around practical security thinking, not just vocabulary. The NIST Cybersecurity Framework organizes security work around identifying, protecting, detecting, responding, and recovering. That mindset shows up constantly in Security+ questions, especially when the exam asks for the best next step rather than a textbook definition.

This also affects day-to-day operations. A help desk analyst may see repeated login failures and think “password problem,” while the real issue is credential stuffing or a compromised account. A system admin may blame an application crash on software bugs when the root cause is a denial-of-service event, a malformed request pattern, or poisoned traffic. The better you understand threats, attacks, and vulnerabilities, the faster you get to the truth.

Good defenders do not memorize attack names in isolation. They trace symptoms back to weakness, method, and impact, then pick the control that actually lowers risk.

Understanding the Core Relationship Between Threats, Attacks, and Vulnerabilities

Vulnerability is a weakness that can be exploited. It may be technical, like an unpatched web server; administrative, like a bad approval process; or human, like a user who trusts every urgent email. In Security+ terms, vulnerability is the opening.

Threat is anything capable of causing harm. That can include cybercriminals, malware, insiders, environmental events, or even a misconfigured system that creates its own damage. A threat is the source of possible danger.

Attack is the action used to exploit a weakness and create impact. If a threat actor sends a phishing email to steal credentials, the email is the attack method. If that email succeeds because users were not trained and MFA was disabled, the attack exploited a human and technical weakness together.

Simple examples that show the relationship

• Phishing exploits trust and urgency.
• Outdated software creates a path for known exploits.
• Weak passwords make unauthorized access easier.
• Poor network segmentation lets an attacker move farther after the first compromise.

Security+ likes to separate these ideas. A question may describe ransomware, but the real test is whether you can see that the underlying vulnerability was a user clicking a malicious attachment, a missing patch, or an exposed remote access service. The candidate who names the malware but misses the weakness will often miss the question.

For deeper framework context, the NIST SP 800-30 Risk Assessment Guide explains how threat likelihood and impact combine to create risk. That model is useful here because Security+ often tests whether the risk is coming from the threat itself, the vulnerability, or the business impact created by both.

How Security+ Scenario Questions Are Built

Security+ scenario questions usually start with evidence, not labels. You may get a help desk ticket, a firewall log, a user complaint, or an incident report. The exam expects you to identify the affected asset first, then work backward to the likely cause.

Start by asking what is under attack: an account, endpoint, server, application, network segment, or wireless device. That clue narrows the options quickly. A login issue points in a different direction than a bandwidth spike, and a database error is not the same as a Wi-Fi association failure.

What to do when two attacks look similar

Attack symptoms often overlap. A denial-of-service attack and a misconfigured service can both make a site unreachable. A brute-force attack and password spraying can both generate failed logins. The difference usually comes from the pattern: source IPs, timing, targeted usernames, geolocation, user behavior, or unusual request volume.

1. Read for the asset first so you know what is affected.
2. Read for the symptom second so you understand what changed.
3. Read for the vector third so you can see how the attacker got in.
4. Read for the impact last so you know what damage occurred.

For official exam guidance and objectives, use the CompTIA Security+ certification page. It is the best source for current exam focus, and it reflects how the SY0-701 blueprint emphasizes practical recognition over rote memorization.

Common Threat Categories You Must Recognize

Security+ expects you to recognize more than one kind of threat. External attackers include opportunists, criminal groups, and organized threat actors looking for money, access, or disruption. Insider threats include malicious insiders, careless users, and compromised accounts that behave like insiders even when the real attacker is outside the company.

Automated threats matter because they scale. Bots, scanners, and malware campaigns can test thousands of passwords, probe exposed ports, or launch repeated requests without a human watching each action. This is why a small weakness can become a large problem very quickly.

Supply chain risk also belongs here. A company can have strong internal controls and still get exposed through a vendor, software update, cloud integration, or managed service provider. That is why risk management has to include third-party dependencies, not just the local network.

What Security+ wants you to infer

• Intent — Is the actor trying to steal, disrupt, spy, or extort?
• Capability — Can the actor only scan, or can they exploit and persist?
• Impact — Is the result exposure, downtime, data theft, or account takeover?

For business impact framing, the Cybersecurity and Infrastructure Security Agency (CISA) publishes practical guidance on identifying and reducing common threats. That type of guidance is useful because Security+ does not test theory in a vacuum; it tests how threats show up in actual environments.

Social Engineering and Human-Targeted Attacks

Social engineering is manipulation of human behavior to bypass technical defenses. It works because people are trained to help, move fast, and trust familiar language. Security+ uses these attacks often because they remain effective even when firewalls and endpoint tools are in place.

Phishing is a broad email-based attack that tries to trick users into clicking links, opening attachments, or entering credentials. Spear phishing is targeted phishing aimed at a specific person or team. Whaling targets executives or other high-value users. Business email compromise usually focuses on fraudulent payment changes, gift cards, wire transfers, or invoice manipulation.

Common examples and red flags

• Urgent language that pressures immediate action.
• Unexpected attachments or shortened links.
• Spoofed domains that differ by one letter.
• Requests to bypass policy, MFA, or normal approval steps.
• Payment or banking changes sent from a “known” contact.

Vishing uses phone calls. Smishing uses text messages. Pretexting is the act of inventing a believable story to get information or access. Baiting uses something tempting, such as a free download or infected USB device. Tailgating and impersonation exploit physical trust at the door or in the office.

The CISA Secure Our World program is a useful reference for awareness and verification habits. It reinforces a key Security+ principle: awareness helps, but technical controls like MFA, mail filtering, and access restrictions still matter because people can be fooled under pressure.

Malware and Malicious Code Concepts

Malware is software designed to damage, disrupt, spy on, or gain unauthorized access. On Security+, you do not need to memorize every sample family in depth, but you do need to know what each type generally does and how it behaves.

Viruses attach to files and spread when those files are executed. Worms self-replicate across networks. Trojans disguise themselves as legitimate software. Ransomware encrypts data or locks systems for payment. Spyware steals information. Adware pushes unwanted advertising. Rootkits hide malicious activity and make detection harder.

Modern malware rarely stays simple. Many strains combine persistence, privilege escalation, credential theft, and evasion. That means the first visible symptom may not be the original infection point. A user may report slow performance while the real issue is lateral movement, data exfiltration, or command-and-control traffic.

How malware commonly enters environments

1. Email attachments and embedded links.
2. Drive-by downloads from compromised sites.
3. Infected removable media.
4. Software installers from untrusted sources.
5. Compromised legitimate websites or updates.

The MITRE ATT&CK framework is useful for understanding attacker behavior because it organizes tactics and techniques in a way that matches real-world intrusion patterns. That makes it easier to connect malware symptoms to persistence, execution, credential access, or exfiltration.

Controls that matter here include endpoint protection, application allowlisting, patching, sandboxing, and least privilege. If users can install anything, run anything, and write everywhere, malware has a much easier time surviving and spreading.

Network-Based Attacks and Vulnerabilities

Network attacks target communication paths, identity checks, and trust relationships. Man-in-the-middle attacks let an attacker observe or alter traffic between two parties. Spoofing makes a device, address, or identity look legitimate. Poisoning corrupts trust data, such as name resolution. Hijacking takes over a session or connection.

Denial-of-service attacks try to reduce availability. A distributed denial-of-service attack usually uses multiple systems to flood the target with traffic or requests. On Security+, availability is a major concern because many organizations can tolerate a small error rate but not a service outage.

Password attacks are also network attacks when they target online authentication services. Brute force tries many combinations. Dictionary attacks use likely words and passwords. Password spraying tests a few common passwords across many accounts. Credential stuffing reuses stolen username-password pairs from previous breaches.

What makes these attacks possible

• Weak or reused passwords.
• Insecure or deprecated protocols.
• Open services exposed to the internet.
• Poor segmentation between internal zones.
• Missing rate limits, lockout policies, or MFA.

Network defenders often rely on DNS logs, firewall alerts, VPN records, and proxy data to spot suspicious activity. That is why the Cloudflare DDoS resource and similar vendor references are useful for understanding traffic-based disruption patterns at a practical level. The exam may not ask for vendor-specific details, but it does expect you to recognize availability attacks quickly.

Application and Web Attack Concepts

Applications are a major attack surface because they process input, store data, and make decisions. When developers fail to validate input, enforce authorization, or protect sessions correctly, attackers can manipulate the application into doing something it should never do.

Injection issues happen when untrusted input is treated as code or query logic. Cross-site scripting lets malicious script run in a victim’s browser. Session attacks target tokens or session cookies. Insecure direct object references let attackers access resources by changing identifiers they should never control.

Security+ often cares more about the root cause than the exploit syntax. If the question describes a user seeing data from another account, the likely issue may be weak authorization or broken access control. If the question describes odd redirects or unexpected script execution, the issue may be input validation or browser-side injection.

Defender clues to watch for

• Unexpected error messages or verbose stack traces.
• Data exposure across user sessions.
• Repeated malformed requests.
• Privilege escalation after a low-privilege login.
• Odd redirects or script behavior in a browser.

Secure coding, patching, regular testing, and web application firewalls all help reduce risk. The OWASP Top 10 remains a strong reference for common web application failure patterns and is useful for exam prep because it maps real weaknesses to real impacts.

Wireless, Mobile, and Remote Access Weaknesses

Wireless and remote access problems are common because they combine convenience and trust. Insecure Wi-Fi settings, weak encryption, and rogue access points create easy openings. An evil twin attack sets up a fake access point that looks like a real one, then tries to capture traffic or credentials.

Mobile devices add another layer of risk. Lost devices, untrusted apps, and unmanaged BYOD endpoints can expose company data or credentials. Remote access services can also become dangerous when exposed to the internet with weak passwords, poor MFA adoption, or outdated software.

Common weak points in remote environments

• Open or poorly secured wireless networks.
• Misconfigured VPN access.
• Exposed RDP services.
• Weak device posture checks.
• Unmanaged personal devices with corporate access.

Compensating controls matter here. Strong encryption, mobile device management, network segmentation, certificate-based authentication, and conditional access policies reduce the blast radius when users work outside the office. The U.S. government’s security guidance on remote work and authentication also reinforces this approach through NIST publications and related federal cybersecurity recommendations.

For Security+, the key idea is simple: remote access is not automatically unsafe, but weak remote access becomes a high-value path for attackers. If a question mentions a public Wi-Fi network, a fake login page, and stolen credentials, the likely answer is not “bad laptop.” It is a wireless attack enabled by weak trust validation.

Vulnerability Management and Exposure Reduction

Vulnerability management is the ongoing process of finding, assessing, prioritizing, and fixing weaknesses. It is not a one-time scan. It is a repeatable cycle that combines inventory, scanning, validation, remediation, and re-checking.

Vulnerability scanning looks for known weaknesses. Assessment adds context, such as asset criticality and likelihood. Penetration testing goes further by attempting to exploit weaknesses in a controlled way. Security+ expects you to understand the difference because each activity answers a different business question.

Practical ways to reduce exposure

1. Inventory assets so you know what exists.
2. Scan regularly to find known weaknesses early.
3. Prioritize by risk instead of fixing in random order.
4. Patch and harden systems that matter most.
5. Use compensating controls when immediate fixes are not possible.
6. Re-test to confirm the weakness is actually gone.

Not every finding needs emergency treatment, but high-severity issues on internet-facing systems usually move up the queue. If patching creates operational risk, change control, maintenance windows, isolation, or service retirement may be better options. The NIST SP 800-40 Guide to Enterprise Patch Management Planning is a strong reference for how mature organizations handle this work.

This is also where business reality matters. Security teams do not fix systems in a vacuum. They balance downtime, support load, vendor limitations, and the risk of leaving exposure in place too long. Security+ reflects that real-world tradeoff in many “best solution” questions.

Indicators, Logs, and Clues That Help You Identify Attacks

Security+ expects you to read clues, not just recognize buzzwords. Indicators of compromise can show up in logs, alerts, user complaints, endpoint telemetry, or traffic patterns. No single indicator proves everything, but multiple weak signals together often point to the right answer.

Repeated failed logins, strange geolocation, and logins outside normal hours may indicate credential misuse. Unknown processes, persistence mechanisms, or unusual CPU and network activity can point to malware. Port scans, beaconing, DNS anomalies, and suspicious outbound connections may suggest reconnaissance or command-and-control activity.

What strong baselines help you see

• Normal login times and locations.
• Expected traffic volumes and destinations.
• Typical application behavior.
• Common privileged account activity.
• Standard endpoint process trees.

The more you know what normal looks like, the easier it is to spot abnormal. That is why baselining matters in both security operations and exam prep. If a question says a payroll server suddenly sends traffic to an unfamiliar external IP at 2 a.m., the issue is not just “odd traffic.” It may be exfiltration, beaconing, or unauthorized access.

For log interpretation and incident handling, Splunk’s security resources and similar SIEM documentation can help you understand how correlated events reveal a larger picture. Security+ does not require one specific tool, but it does expect you to understand how correlation turns scattered clues into a real incident.

Defensive Actions and Best-Practice Controls

Good defenses reduce likelihood, impact, or both. Multi-factor authentication, patching, segmentation, backups, and least privilege are baseline controls because they stop common attacks or limit what happens after one succeeds.

Awareness training helps with phishing and pretexting, but training alone is not enough. If users can approve payments without verification, click links without inspection, or reuse passwords everywhere, human controls will fail under pressure. Technical controls have to support the behavior you want.

Controls that show up often on Security+

• MFA for user and admin accounts.
• Least privilege to reduce blast radius.
• Segmentation to limit lateral movement.
• EDR to detect suspicious endpoint behavior.
• Email security gateways to block malicious messages.
• DNS filtering to reduce access to malicious domains.
• Backups to recover from ransomware and destructive attacks.

When the exam asks for the best next step, think in terms of containment and recovery as well as prevention. If an endpoint is already infected, the best answer may be isolation before eradication. If credentials have been exposed, resetting passwords without reviewing MFA and session tokens may not be enough. The NIST CSF remains the best simple model for tying controls to real outcomes.

Risk management is not about perfect security. It is about making the attack path expensive, noisy, and hard to repeat.

How to Study CompTIA Security+ Threats, Attacks, and Vulnerabilities

The fastest way to learn this domain is to study each threat as a complete chain: weakness, method, symptom, and defense. That is much more effective than memorizing isolated definitions. If you can explain how a phishing email becomes account compromise, you are much closer to passing the exam.

Use flashcards, but make them useful. A good card should include the attack name, one or two identifying clues, the weakness exploited, and the best mitigation. That format trains your brain to think like the exam writer.

Study methods that work well

1. Compare similar attacks side by side, such as phishing versus spear phishing.
2. Practice with log snippets so you learn to spot evidence.
3. Use scenario questions instead of only definitions.
4. Review controls with each attack so mitigation becomes automatic.
5. Time yourself to get used to exam pressure.

A practical way to build recall is to ask: What would I see first? What would I check next? What would I do to contain it? That three-step approach mirrors what exam questions actually ask, and it mirrors how security work happens in real life.

For workforce context, the U.S. Bureau of Labor Statistics computer and information technology outlook shows continued demand for security-related roles, which is one more reason to learn this material deeply rather than superficially. The knowledge transfers directly into analyst, admin, and support work.

What Should You Do Next to Get Better at This Domain?

Start by reviewing one attack category at a time and forcing yourself to connect four things: what it is, what it looks like, what weakness it exploits, and what control reduces it. That habit will improve both exam performance and operational judgment.

Then work through mixed scenario questions. Do not stop at naming the attack. Ask which asset is affected, which log clue matters most, and which control would be the best next move. That is the level of thinking Security+ is testing.

If you want a structured path through the material, the CompTIA Security+ Certification Course (SY0-701) from ITU Online IT Training is built to reinforce exactly these recognition skills. It is most effective when you use it to practice scenario reading, control selection, and attack analysis together.

Threats, attacks, and vulnerabilities are the foundation for the rest of Security+. Learn them well, and the rest of the exam gets easier. Learn them as relationships, and the material starts to make sense under pressure.

CompTIA® and Security+™ are trademarks of CompTIA, Inc.