Overview
Threats, Vulnerabilities, and Mitigations is 22% of the exam, the second-heaviest domain, and the one focused on understanding and countering attacks. It has five objectives. Threat actors and motivations covers the types of attackers, nation-state, organized crime, insider, hacktivist and others, and what drives them. Threat vectors and attack surfaces covers how attacks arrive, such as email, messaging, removable media, supply chain and social engineering. Vulnerabilities covers weaknesses across applications, operating systems, hardware, cloud, mobile and more. Indicators of malicious activity covers recognizing attacks from their signs, including malware, network, application and password attacks. Mitigation techniques covers how to secure the enterprise, such as segmentation, access control, hardening, patching, isolation and least privilege.
The exam rewards recognizing attacks from their descriptions, understanding where they come from, and knowing which mitigation counters each. This domain is the practical heart of threat knowledge.
How it's tested
Security+ questions in this domain describe an attacker, vector, vulnerability, indicator or mitigation need and ask which applies. Security+ questions are vendor-neutral and scenario-based, with some performance-based, so read the situation and choose the security concept, control or response it points to before answering.
-
Identify the threat
An attacker or attack is described, and you identify the threat actor, vector or attack type.
-
Recognize the indicator
Symptoms are described, and you identify the malicious activity from its indicators.
-
Match the mitigation
A threat is described, and you choose the mitigation technique that counters it.
A user receives an urgent email appearing to come from the CEO, asking them to buy gift cards immediately. This is social engineering: it manipulates the user through authority and urgency rather than a technical exploit, and targeting a specific person with a tailored message makes it spear phishing. Recognizing the human-targeted manipulation and the tailored, authority-based lure is the identification the exam expects, pointing to user awareness training as the mitigation.
Domains 5
Official domains from the CompTIA outline, in outline order.
2.1 Compare and contrast common threat actors and motivationsAttacker types and what drives them.
- What it means
- This covers common threat actors, nation-state, unskilled attacker, hacktivist, insider threat, organized crime and shadow IT, their attributes such as resources and sophistication, and motivations such as financial gain, espionage, disruption and revenge.
- What to understand
- Threat actors differ in capability, resources and intent: nation-states are highly resourced and motivated by espionage, organized crime by money, hacktivists by ideology, and insiders by access and sometimes revenge. Matching an attack's characteristics to the likely actor and motivation is the tested skill.
- How it shows up
- An attack's characteristics are described, and you must identify the threat actor and motivation.
- Common confusion
- Confusing threat actor types, such as a hacktivist with organized crime, or their motivations.
2.2 Explain common threat vectors and attack surfacesHow attacks arrive and where.
- What it means
- This covers threat vectors and attack surfaces: message-based vectors such as email and SMS, file-based, voice calls, removable media, vulnerable software, unsupported systems, open ports, default credentials, the supply chain, and human vectors including social engineering techniques such as phishing, pretexting and impersonation.
- What to understand
- A threat vector is the path an attack takes, and the attack surface is everything exposed to attack. Many attacks arrive through email and social engineering, which exploit people rather than technology. Understanding the vectors and recognizing social engineering techniques is central, since humans are a primary attack surface.
- How it shows up
- An attack's delivery is described, and you must identify the threat vector or social engineering technique.
- Common confusion
- Confusing social engineering techniques such as phishing, spear phishing, pretexting and impersonation.
2.3 Explain various types of vulnerabilitiesWeaknesses across applications, systems, cloud and more.
- What it means
- This covers vulnerability types: application vulnerabilities such as buffer overflow, race conditions and injection, operating system, web and cloud-specific vulnerabilities, supply chain, cryptographic, misconfiguration, mobile, zero-day and hardware vulnerabilities.
- What to understand
- Vulnerabilities are weaknesses that attacks exploit, spanning code flaws like injection and buffer overflows, misconfigurations, unpatched systems, and zero-days that are unknown and unpatched. Recognizing the vulnerability type from a description is the skill, since it determines the appropriate remediation.
- How it shows up
- A weakness is described, and you must identify the vulnerability type.
- Common confusion
- Confusing vulnerability types, such as a race condition with a buffer overflow, or a zero-day with a known vulnerability.
2.4 Analyze indicators of malicious activityRecognizing attacks from their signs.
- What it means
- This covers analyzing indicators of malicious activity across malware attacks (ransomware, trojans, worms, spyware and more), physical, network (DDoS, DNS, on-path), application (injection, replay, privilege escalation) and cryptographic and password attacks, by their indicators.
- What to understand
- Each attack leaves recognizable indicators: ransomware encrypts files and demands payment, a DDoS floods a service, an on-path attack intercepts traffic, and a brute-force password attack shows many failed logins. Recognizing the attack from its indicators is a heavily tested, practical skill.
- How it shows up
- Indicators or symptoms are described, and you must identify the attack.
- Common confusion
- Confusing similar attacks by their indicators, such as a worm with a virus, or a DDoS with an on-path attack.
2.5 Explain the purpose of mitigation techniques used to secure the enterpriseSegmentation, access control, hardening, patching and more.
- What it means
- This covers mitigation techniques: segmentation, access control, application allow lists, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, and hardening techniques such as disabling ports and services and host-based security.
- What to understand
- Mitigations reduce risk by closing or containing weaknesses: segmentation and isolation limit spread, patching fixes known flaws, least privilege and access control limit what can be done, and hardening reduces the attack surface. Matching the right mitigation to a given threat or vulnerability is the key skill.
- How it shows up
- A threat or weakness is described, and you must choose the mitigation technique.
- Common confusion
- Confusing mitigations such as segmentation with isolation, or choosing a mitigation that does not address the specific threat.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Threat actor types
Nation-state, crime, hacktivist, insider, unskilled.
- Remember
- Differ in resources and intent.
- Tested as
- Threat questions.
- Trap
- Confusing the actor types.
-
Motivations
Financial, espionage, ideology, disruption, revenge.
- Remember
- Match motivation to actor.
- Tested as
- Threat questions.
- Trap
- Mismatching motivation and actor.
-
Threat vectors
Email, media, supply chain, human.
- Remember
- The path an attack takes.
- Tested as
- Vector questions.
- Trap
- Confusing vector with vulnerability.
-
Social engineering
Phishing, spear phishing, pretexting, impersonation.
- Remember
- Exploits people, not technology.
- Tested as
- Social engineering questions.
- Trap
- Confusing the techniques.
-
Vulnerability types
Injection, buffer overflow, misconfiguration, zero-day.
- Remember
- Weaknesses attacks exploit.
- Tested as
- Vulnerability questions.
- Trap
- Confusing the types.
-
Zero-day
An unknown, unpatched vulnerability.
- Remember
- No patch exists yet.
- Tested as
- Vulnerability questions.
- Trap
- Confusing with a known flaw.
-
Malware types
Ransomware, trojan, worm, spyware, and more.
- Remember
- Recognize by behavior.
- Tested as
- Indicator questions.
- Trap
- Confusing malware types.
-
Network attacks
DDoS, DNS, on-path attacks.
- Remember
- Recognize by indicators.
- Tested as
- Indicator questions.
- Trap
- Confusing the attacks.
-
Password attacks
Brute force, spraying, and more.
- Remember
- Many failed logins indicate them.
- Tested as
- Indicator questions.
- Trap
- Confusing the attack methods.
-
Mitigation techniques
Segmentation, least privilege, patching, hardening.
- Remember
- Match mitigation to the threat.
- Tested as
- Mitigation questions.
- Trap
- Choosing an ill-fitting mitigation.
-
Hardening
Reducing the attack surface.
- Remember
- Disable ports, services; apply host security.
- Tested as
- Mitigation questions.
- Trap
- Leaving unneeded services enabled.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Threat actor types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Nation-state | Highly resourced, espionage | Advanced, persistent | Confusing with a hacktivist |
| Organized crime | Financially motivated | Profit-driven attacks | Confusing with nation-state |
| Insider threat | Trusted access misused | From within | Overlooking the insider |
Phishing vs. spear phishing vs. pretexting
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Phishing | Broad deceptive messages | Mass, untargeted | Confusing with spear phishing |
| Spear phishing | Targeted at a person | Tailored lure | Confusing with phishing |
| Pretexting | Invented scenario to gain trust | Story-based manipulation | Confusing with impersonation |
Zero-day vs. known vulnerability
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Zero-day | Unknown and unpatched | No fix available yet | Confusing with a known flaw |
| Known vulnerability | Documented, often patchable | Patch or mitigation exists | Treating as unknowable |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Phishing is spear phishing
- What candidates pick
- Call a tailored attack on a specific executive generic phishing.
- Why it looks right
- Both are phishing.
- Why it's wrong
- Spear phishing is targeted at a specific person with a tailored lure; generic phishing is mass and untargeted.
Clue to watch for The attack targets a specific individual with personalized detail.
-
Zero-day has a patch
- What candidates pick
- Recommend patching to fix a zero-day vulnerability immediately.
- Why it looks right
- Patching fixes vulnerabilities.
- Why it's wrong
- A zero-day is unknown to the vendor with no patch yet; other mitigations such as isolation are needed until a patch exists.
Clue to watch for The vulnerability is newly discovered with no available fix.
-
Worm needs a host
- What candidates pick
- Describe a self-propagating worm as needing a host file like a virus.
- Why it looks right
- Both are malware.
- Why it's wrong
- A worm self-propagates across networks without a host; a virus attaches to a file and needs execution.
Clue to watch for The malware spreads on its own without user action.
-
Mitigation ignores the threat
- What candidates pick
- Apply encryption to stop a denial-of-service attack.
- Why it looks right
- Encryption is a security control.
- Why it's wrong
- The mitigation must match the threat; a DDoS is countered by filtering, rate limiting and capacity, not encryption.
Clue to watch for The chosen mitigation does not address the described attack.
-
Insider is external
- What candidates pick
- Classify misuse of trusted internal access as an external attack.
- Why it looks right
- It is still an attack.
- Why it's wrong
- An insider threat comes from someone with legitimate access; the mitigations differ from external threats.
Clue to watch for The actor already has authorized access.
Answer framework
For any Domain 2 scenario, use these steps to find the answer Security+ expects.
- Identify whether the need is a threat actor, a vector or attack surface, a vulnerability, an indicator, or a mitigation.
- For actors, match capability, resources and motivation to the actor type, keeping nation-state, crime, hacktivist and insider distinct.
- For vectors and social engineering, identify the delivery path and the specific technique, such as spear phishing or pretexting.
- For vulnerabilities and attacks, recognize the type from its description or indicators, distinguishing zero-days and similar malware or network attacks.
- For mitigation, choose the technique that directly counters the threat, such as segmentation, least privilege, patching or hardening. Where two options seem to fit, pick the one that most precisely matches the scenario's requirement.
Practice question
Want more like this? The Security+ practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This is the second-heaviest domain and the practical core of threat knowledge, so invest substantial time. Start with threat actors and motivations, keeping the types distinct, then learn the threat vectors and especially social engineering techniques, since humans are a primary attack surface and these are heavily tested.
Learn the vulnerability types and the malware, network and password attacks by their indicators, because much of this domain is recognizing an attack from its description. Drill distinguishing similar items: phishing versus spear phishing, worm versus virus, DDoS versus on-path. Then master mitigation techniques and practice matching the right one to each threat, since choosing an ill-fitting mitigation is a common trap.
Because recognition is central, scenario-based practice questions are the most effective study here. Because Security+ rewards applied understanding across a broad field, use scenario practice questions and relate each concept to a real situation rather than only memorizing lists, and review missed practice questions by domain to find weak spots. Afterwards, move to Domain 3, Security Architecture.
FAQ
How much of Security+ is Domain 2?
Threats, Vulnerabilities, and Mitigations is 22% of the exam, the second-heaviest domain, focused on recognizing and countering attacks.
What is the difference between phishing and spear phishing?
Phishing sends broad, untargeted deceptive messages to many people. Spear phishing targets a specific individual with a tailored, personalized lure, often referencing real details to seem credible.
What is a zero-day vulnerability?
A vulnerability unknown to the vendor for which no patch yet exists, so it cannot be fixed by patching. Until a patch is available, other mitigations such as isolation or monitoring are used.
What is the difference between a worm and a virus?
A worm self-propagates across networks without needing a host file or user action. A virus attaches to a file or program and requires execution to spread.
How do I choose the right mitigation?
Match the mitigation directly to the threat. For example, segmentation and isolation limit spread, patching fixes known flaws, least privilege limits what an account can do, and hardening reduces the attack surface. A mitigation that does not address the specific threat is wrong.
Why is social engineering so important on this exam?
Because humans are a primary attack surface and many real attacks arrive through social engineering such as phishing. The exam heavily tests recognizing these techniques and the awareness training that mitigates them.
How does Domain 2 connect to the rest of the exam?
The threats and mitigations here are what the architecture of Domain 3 is designed against, what Security Operations in Domain 4 detects and responds to, and what the risk management of Domain 5 governs.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered threat actors, vectors, vulnerabilities, indicators and mitigations. Test whether you can recognize an attack and choose the right countermeasure under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Security+ AI tutor Get any concept explained your way