Cybersecurity Threats, Vulnerabilities, and Attacks Syllabus

Threats, Vulnerabilities, and Attacks syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Threats, Vulnerabilities, and Attacks in Cybersecurity, not a summary of it.

1. 1

   Threat Actors and Landscape

   3 topics

   • Threat Actor Types
   • Threat Actor Motivations
   • Attack Surface and Threat Vectors
2. 2

   Malware

   5 topics

   • Viruses, Worms, and Trojans
   • Ransomware
   • Rootkits and Bootkits
   • Spyware, Keyloggers, and Adware
   • Fileless Malware and Logic Bombs
3. 3

   Social Engineering

   4 topics

   • Phishing, Spear Phishing, and Whaling
   • Pretexting and Baiting
   • Vishing and Smishing
   • Principles of Influence and Manipulation
4. 4

   Application Attacks

   4 topics

   • Injection Attacks
   • Cross-Site Scripting (XSS)
   • Cross-Site Request Forgery (CSRF)
   • Buffer Overflows and Memory Attacks
5. 5

   Vulnerability Management

   4 topics

   • Vulnerability Scanning
   • CVE, CVSS, and CWE
   • Patch Management
   • Zero-Day Vulnerabilities
6. 6

   OWASP Top 10

   5 topics

   • Broken Access Control
   • Cryptographic Failures
   • Injection
   • Insecure Design and Misconfiguration
   • Vulnerable and Outdated Components

Threats, Vulnerabilities, and Attacks flashcards for Cybersecurity

21 of 51 cards from the Threats, Vulnerabilities, and Attacks deck — real questions with worked answers.

1. What is a threat actor, and what distinguishes it from a threat?

   A threat actor (or malicious actor) is the entity — a person, group, or organization — that carries out or is responsible for an attack. A threat is the potential event or action itself; the threat actor is the source that enables or executes it.

2. List the major categories of threat actor types studied in cybersecurity.

   Nation-state/Advanced Persistent Threats (APTs), organized crime, hacktivists, insider threats, script kiddies, unskilled attackers, and shadow IT. They differ by resources, sophistication, and intent.

3. What is an Advanced Persistent Threat (APT) and who typically sponsors it?

   An APT is a highly sophisticated, well-funded, and persistent threat actor that maintains long-term unauthorized access to a network. APTs are typically nation-state sponsored, with high resources and stealth capabilities.

4. Define 'script kiddie' and 'unskilled attacker.'

   A script kiddie / unskilled attacker is a low-sophistication threat actor who uses pre-written tools, scripts, or exploits created by others without deep understanding of how they work. They have low resources and capability.

5. What is an insider threat, and why is it especially dangerous?

   An insider threat is a threat actor operating from within the organization (employee, contractor, partner) who abuses legitimate authorized access. It is dangerous because the actor already has trust, credentials, and knowledge of internal systems, bypassing perimeter defenses.

6. Distinguish hacktivists from organized crime groups by motivation.

   Hacktivists are motivated by ideology, political, or social causes and often seek publicity or disruption. Organized crime groups are motivated primarily by financial gain and operate for profit.

7. What is 'shadow IT' as a threat consideration?

   Shadow IT refers to hardware, software, or services used within an organization without explicit IT department approval or oversight, creating unmanaged and unsecured attack surfaces.

8. List the common motivations that drive threat actors.

   Financial gain, espionage (data exfiltration), ideological/political beliefs (hacktivism), revenge, disruption/chaos, war, blackmail, service disruption, and philosophical/ethical (e.g., ethical hacking) motives.

9. What are the two key attributes used to characterize a threat actor's capability?

   Resources/funding (the money, tools, and personnel available) and level of sophistication/capability (technical skill). For example, nation-states have high resources and high sophistication; script kiddies have low in both.

10. Define 'attack surface.'

    The attack surface is the total set of all points (the sum of all vulnerabilities, entry points, and exposures) where an unauthorized user could attempt to enter data into or extract data from an environment.

11. What is a threat vector (attack vector)?

    A threat vector is the specific method or pathway a threat actor uses to gain unauthorized access, such as email, removable media, wireless networks, unpatched software, social engineering, or supply chains.

12. Give examples of common threat vectors.

    Message-based (email/phishing, SMS), image/file-based, voice call, removable devices (USB), vulnerable software, unsupported systems, unsecured networks (open wireless/Bluetooth), open service ports, default credentials, and supply-chain vectors.

13. How does a virus differ from a worm in propagation?

    A virus requires a host file and user action (execution) to spread and attaches itself to legitimate programs. A worm is self-replicating and self-propagating, spreading across networks automatically without user interaction or a host file.

14. What is a Trojan horse in malware terms?

    A Trojan is malware disguised as legitimate or desirable software. It does not self-replicate; it relies on tricking the user into installing/running it, then delivers a hidden malicious payload (e.g., a backdoor).

15. What is a Remote Access Trojan (RAT)?

    A RAT is a type of Trojan that provides the attacker with remote administrative control over the infected system, enabling surveillance, data theft, and command execution as if physically present.

16. Define ransomware and describe its core mechanism.

    Ransomware is malware that encrypts (or blocks access to) the victim's data or systems and demands payment (usually cryptocurrency) for the decryption key. Modern variants often also exfiltrate data for 'double extortion.'

17. What is 'double extortion' in a ransomware attack?

    Double extortion combines encrypting the victim's data with exfiltrating (stealing) a copy first, then threatening to publicly leak the stolen data unless the ransom is paid — pressuring victims even if they have backups.

18. What is a rootkit and at what level does it typically operate?

    A rootkit is malware designed to gain and maintain privileged (root/administrator) access while hiding its presence. It often operates at the kernel level, intercepting system calls to conceal files, processes, and network connections from detection tools.

19. How does a bootkit differ from a standard rootkit?

    A bootkit is a rootkit variant that infects the boot process — the Master Boot Record (MBR), boot sector, or UEFI/BIOS firmware — so it loads before the operating system, making it extremely persistent and hard to remove.

20. What is spyware?

    Spyware is malware that covertly gathers information about a user or system (browsing habits, credentials, activity) and transmits it to a third party without the user's consent.

21. What does a keylogger do?

    A keylogger records (logs) the keystrokes a user types — capturing passwords, messages, and other sensitive input — and can be software-based or a physical hardware device inserted between keyboard and computer.

See more Threats, Vulnerabilities, and Attacks flashcards →

Planning Threats, Vulnerabilities, and Attacks for Cybersecurity

Threats, Vulnerabilities, and Attacks (Cybersecurity) FAQ