CompTIA Security+ SY0-701: Threat Actors and Attack Techniques

Threats, Vulnerabilities, and Mitigations account for 22% of the current Security+ SY0-701 blueprint. CompTIA expects candidates to compare threat actors and motivations, identify attack vectors and surfaces, recognize vulnerabilities, analyze indicators of malicious activity, and understand mitigation techniques. The SY0-701 exam therefore tests whether you can connect who is attacking, why they are doing it, how they gain access, what evidence the attack leaves, and which control reduces the risk.

The most useful preparation habit is to stop treating every malicious event as “a hacker attack.” A nation-state, organized crime group, insider, hacktivist, unskilled attacker, or unmanaged shadow-IT actor can have very different resources and motivations. Those differences change the likely techniques, persistence, targets, and defensive priorities.

Profile the actor before guessing the technique

Threat-actor questions often provide clues about funding, sophistication, access, or motive. Nation-state activity may be associated with espionage, disruption, or strategic advantage and can involve significant resources. Organized crime commonly seeks financial gain through theft, fraud, extortion, or ransomware. Hacktivists may be driven by political or philosophical goals. Insiders already have some level of legitimate access, which changes the attack surface.

An unskilled attacker may rely heavily on public tools and opportunistic targets, but that does not mean the impact is harmless. Shadow IT can also create risk without malicious intent because unsanctioned systems bypass normal security review, logging, and configuration standards.

On the exam, motive can be more diagnostic than the technology. A sophisticated operation stealing research for strategic advantage points to a different actor profile than an extortion campaign encrypting systems for payment.

Separate attack vectors from the payload

The attack vector is the path used to reach the target. SY0-701 includes message-based vectors such as email, SMS and instant messaging; voice calls; files and images; removable devices; vulnerable software; unsupported systems; open ports; default credentials; unsecure networks; supply-chain relationships; and human-focused social engineering.

A phishing email is a vector. The attachment may deliver malware, steal credentials, or direct the user to a fraudulent site. The malicious outcome is not the vector itself. This distinction helps when a question asks which control reduces initial access versus which control detects execution after access occurs.

The detailed social-engineering attack patterns are worth understanding because phishing, smishing, vishing, pretexting, impersonation, brand abuse, and business email compromise all manipulate trust in different communication channels.

Read the attack surface from the environment

Attack surface is the set of reachable opportunities an attacker can use. Internet-facing services, exposed management ports, unsupported applications, default credentials, mobile devices, wireless networks, third-party integrations, and user workflows can all expand it. Reducing attack surface is often more effective than trying to detect every possible exploit after exposure.

The environment determines which surfaces matter. A cloud application may be vulnerable because of misconfiguration and excessive permissions. A branch office may expose wireless and remote-access surfaces. A supply-chain dependency can introduce risk even when the organization’s own systems are well patched.

When the exam asks for the best mitigation, identify the surface first. Disabling an unnecessary service can be more direct than adding a monitoring rule for attacks against that service.

Recognize social engineering as a process

Social engineering succeeds by manipulating people into performing an action that bypasses or weakens technical controls. Attackers may create urgency, impersonate authority, exploit curiosity, or build trust over time. Email phishing is only one example. Smishing uses SMS, vishing uses voice, pretexting builds a believable story, and business email compromise targets organizational payment or communication processes.

Security awareness helps, but it should be combined with technical and procedural controls. Multi-factor authentication, payment verification procedures, email security, least privilege, and anomaly detection can limit the damage when a user makes a mistake.

A broader discussion of common enterprise security threats is useful because social engineering frequently appears alongside malware, credential theft, and exposed services rather than as a standalone event.

Map malware and network attacks to observable indicators

SY0-701 includes ransomware, trojans, worms, spyware, viruses, keyloggers, logic bombs, rootkits, DDoS, DNS attacks, wireless attacks, on-path attacks, credential replay, injection, privilege escalation, directory traversal, cryptographic attacks, and password attacks. The exam does not require you to become a malware reverse engineer, but it does expect you to recognize characteristic behavior and evidence.

Indicators can include unusual resource consumption, account lockouts, impossible travel, concurrent sessions, missing logs, out-of-cycle logging, blocked content, inaccessible resources, or suspicious network behavior. One indicator rarely proves the entire attack, so good analysis correlates evidence with context.

DNS attacks are a good example. If clients resolve a trusted name to a malicious destination, the symptom is different from a simple service outage. Understanding DNS spoofing and poisoning helps connect the attack technique to the misleading name-resolution evidence.

Use an attack lifecycle to organize evidence

Real attacks unfold over stages such as reconnaissance, initial access, execution, persistence, privilege escalation, lateral movement, and impact, although frameworks use different terminology. Thinking in stages helps explain why controls at multiple points are valuable. An email gateway may reduce initial delivery, endpoint protection may block execution, segmentation can restrict lateral movement, and backups can reduce ransomware impact.

The cyber-attack lifecycle concept is useful as an organizing model, but the exam question still controls the answer. If the scenario is asking about the actor’s motivation, do not answer with a lifecycle stage. If it asks for a mitigation, select the control that directly breaks the described path.

Layered defense works because no single point of prevention is perfect. The objective is to reduce opportunities, detect activity quickly, contain spread, and recover safely.

Distinguish threat, vulnerability, exploit, and indicator

A threat is something capable of causing harm. A vulnerability is a weakness that could be exploited. An exploit is a method or code that takes advantage of a weakness. An indicator is evidence suggesting malicious activity has occurred or is occurring. These terms are related but not interchangeable.

For example, an exposed unpatched service may contain a vulnerability. An attacker may use an exploit to gain access. Unusual processes and outbound connections may be indicators. The threat actor is the person or group behind the activity. Each layer can lead to a different control.

Security+ questions become much easier when you identify which layer the prompt is describing before evaluating the answer choices.

Practice scenario triage

For every practice scenario, write four short notes: likely actor, likely motivation, initial vector, and observed indicators. Then name one mitigation that reduces the described risk without inventing a new requirement. This trains you to reason from evidence rather than matching one keyword to one technology.

The exam does not reward dramatic answers. A simple control such as disabling default credentials, patching unsupported software, filtering malicious messages, or enforcing least privilege can be better than deploying an elaborate platform if it directly addresses the weakness.

Threat-actor questions test judgment. Learn the motivations and common techniques, but spend most of your practice explaining why the evidence supports one interpretation more strongly than another.

Supply-chain risk can hide the original attacker

A supply-chain compromise reaches an organization through a trusted relationship such as a software vendor, service provider, hardware supplier, or managed service provider. That changes the defensive problem because the initial connection or update may appear legitimate. The organization still needs vendor assessment, software validation, least privilege, segmentation, and monitoring around third-party access.

Shadow IT creates a related visibility problem. Employees may adopt cloud services, scripts, browser extensions, or devices that never pass through normal review. The user may be trying to work faster rather than cause harm, but unapproved systems can create unmanaged credentials, data exposure, and unsupported attack surfaces that defenders do not know to monitor.

In scenario questions, watch for trust relationships. If the incident began after a vendor update, partner connection, or unmanaged service was introduced, the relevant vector may be supply chain or shadow IT rather than ordinary phishing. The actor can still be an external criminal or nation-state group, but the path into the environment is the clue the question is testing.

Actor capability changes the defensive priority

Two attackers can use the same phishing technique while presenting very different risk. An opportunistic criminal may move quickly toward credential theft or ransomware, whereas a well-resourced espionage actor may invest in stealth, long-term persistence, and custom tooling. The initial vector alone does not reveal the full threat model.

That is why actor attributes such as funding, sophistication, internal versus external position, and objective belong in the blueprint. Defenders use those clues to decide how much persistence to expect, which assets are likely targets, and how aggressively to hunt for activity beyond the first observed indicator. On the exam, use those attributes when the scenario asks which actor is most likely, but do not invent capability that the prompt does not provide.

Threat intelligence can improve this reasoning by connecting observed indicators with known actor behavior, but intelligence should support the evidence in the scenario rather than replace it. Attribution is difficult, so Security+ questions usually provide the clues needed for the intended actor classification.

When choosing a response, separate what the attacker can do from what the attacker appears to want. A low-skill actor with stolen credentials may still cause severe damage, while a sophisticated actor may deliberately keep activity quiet. Prioritization should therefore combine capability, intent, access, and the value of the targeted asset instead of treating one label as a complete risk assessment.