CompTIA Security+ Threats, Vulnerabilities, and Mitigations Syllabus

Threats, Vulnerabilities, and Mitigations syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Threats, Vulnerabilities, and Mitigations in CompTIA Security+, not a summary of it.

1. 1

   Threat Actors and Motivations

   3 topics

   • Threat Actor Types
     • Nation-state and advanced persistent threats
     • Unskilled attackers and hacktivists
     • Insider threats
     • Organized crime and shadow IT
   • Threat Actor Attributes
     • Internal vs external
     • Resources/funding and level of sophistication
   • Motivations
     • Data exfiltration and espionage
     • Financial gain and blackmail
     • Disruption, chaos, and ideology
2. 2

   Threat Vectors and Attack Surfaces

   4 topics

   • Message-Based Vectors
     • Email and SMS/instant messaging
     • Voice calls
   • Technical Vectors
     • Image-based and file-based
     • Removable devices and vulnerable software
     • Unsupported systems and open service ports
     • Default credentials
   • Supply Chain Vectors
     • Managed service providers (MSPs)
     • Vendors and suppliers
   • Human and Social Engineering Vectors
     • Phishing, vishing, and smishing
     • Pretexting and impersonation
     • Business email compromise
     • Watering hole and typosquatting
3. 3

   Vulnerability Types

   6 topics

   • Application Vulnerabilities
     • Memory injection and buffer overflow
     • Race conditions (TOC/TOU)
     • Malicious update
   • Web-Based Vulnerabilities
     • SQL injection (SQLi)
     • Cross-site scripting (XSS)
   • Operating System and Hardware Vulnerabilities
     • Firmware and end-of-life hardware
     • Legacy systems
   • Virtualization and Cloud Vulnerabilities
     • VM escape and resource reuse
     • Cloud-specific misconfiguration
   • Supply Chain and Cryptographic Vulnerabilities
     • Service provider and hardware/software providers
     • Misconfiguration and zero-day
   • Mobile Device Vulnerabilities
     • Side loading
     • Jailbreaking
4. 4

   Malicious Activity and Indicators

   5 topics

   • Malware Attacks
     • Ransomware and trojans
     • Worms and spyware
     • Rootkits, logic bombs, and keyloggers
     • Bloatware and viruses
   • Physical and Network Attacks
     • Brute force (physical) and RFID cloning
     • DDoS (amplified and reflected)
     • DNS attacks and wireless attacks
     • On-path and credential replay
   • Application Attacks
     • Injection and privilege escalation
     • Forgery and directory traversal
   • Cryptographic and Password Attacks
     • Downgrade, collision, and birthday attacks
     • Spraying and brute force
   • Indicators of Compromise
     • Account lockout and concurrent session usage
     • Impossible travel and resource consumption
     • Missing logs and out-of-cycle logging
5. 5

   Mitigation Techniques

   4 topics

   • Segmentation and Access Control
     • Network segmentation
     • Access control lists and permissions
   • Application Allow Listing and Isolation
     • Application allow/deny lists
     • Isolation and sandboxing
   • System Hardening Targets
     • Workstations, servers, and mobile devices
     • Switches, routers, and cloud infrastructure
     • Embedded systems, ICS/SCADA, IoT, RTOS
   • Hardening Techniques
     • Encryption and endpoint protection
     • Host-based firewall and HIPS
     • Disabling ports/protocols and changing default passwords
     • Removal of unnecessary software

Threats, Vulnerabilities, and Mitigations flashcards for CompTIA Security+

18 of 65 cards from the Threats, Vulnerabilities, and Mitigations deck — real questions with worked answers.

1. What are the main types of threat actors recognized in CompTIA Security+?

   Nation-state actors, unskilled attackers (script kiddies), hacktivists, insider threats, organized crime, and shadow IT.

2. What distinguishes a nation-state threat actor from other actors?

   They are highly resourced, well-funded, sophisticated, and often pursue Advanced Persistent Threats (APTs) for espionage, ideological, or strategic goals.

3. What is an Advanced Persistent Threat (APT)?

   A sophisticated, long-term attack (usually by nation-states) where an intruder gains and maintains undetected access to a network over an extended period.

4. What is a hacktivist and what motivates them?

   An attacker driven by ideological, political, social, or philosophical beliefs rather than financial gain, often using attacks to make a statement.

5. What is an unskilled attacker (script kiddie)?

   A low-skilled actor who uses existing tools, scripts, and exploits created by others without understanding the underlying technology.

6. What is shadow IT?

   Hardware, software, or cloud services used within an organization without explicit IT department approval, creating unmanaged security risks.

7. What are the key attributes used to classify threat actors?

   Internal vs. external, resources/funding level, and level of sophistication/capability.

8. Compare internal vs. external threat actors.

   Internal actors (insiders) have authorized access and knowledge of systems; external actors must breach perimeter defenses from outside the organization.

9. What are the primary motivations behind threat actor attacks?

   Data exfiltration, espionage, financial gain, blackmail, service disruption, ideology/philosophical beliefs, revenge, war, and ethical (hacktivism) reasons.

10. What motivation typically drives organized crime threat actors?

    Financial gain through activities like ransomware, fraud, data theft, and extortion.

11. What is a message-based threat vector?

    An attack delivered through email, SMS (smishing), or instant messaging, often carrying phishing links or malicious attachments.

12. What is a technical (technology-based) threat vector? Give examples.

    An attack exploiting technology itself, such as unsecured networks, open service ports, default credentials, or vulnerable software/firmware.

13. What is a supply chain attack vector?

    Compromising an organization by targeting its less-secure suppliers, vendors, managed service providers (MSPs), or hardware/software components.

14. Why are managed service providers (MSPs) attractive supply chain targets?

    Because compromising one MSP can give attackers access to many downstream client organizations that trust it.

15. What is social engineering?

    Manipulating people into divulging confidential information or performing actions that compromise security, exploiting human psychology rather than technical flaws.

16. What is phishing?

    A social engineering attack using fraudulent emails or messages that appear legitimate to trick victims into revealing data or clicking malicious links.

17. Differentiate spear phishing from whaling.

    Spear phishing targets specific individuals or groups with tailored messages; whaling specifically targets high-profile executives like CEOs or CFOs.

18. What is vishing and smishing?

    Vishing is voice/phone-based phishing; smishing is SMS/text-message-based phishing.

See more Threats, Vulnerabilities, and Mitigations flashcards →

Planning Threats, Vulnerabilities, and Mitigations for CompTIA Security+

Threats, Vulnerabilities, and Mitigations (CompTIA Security+) FAQ