SY0-701 · Objective 2.2 · Threats, Vulnerabilities, and Mitigations
2.2 Threat vectors and attack surfaces explained
The official objective: “Explain common threat vectors and attack surfaces.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 2.2 covers
A threat vector is the route an attack takes to reach its target. The attack surface is the total of all those routes for a given organisation. Objective 2.2 lists the vectors you are expected to recognise, and a large part of it is social engineering.
Message-based vectors include email, SMS and instant messaging. Image-based and file-based vectors hide something malicious in a picture, document or QR code. Voice calls are a vector on their own. Removable devices such as a USB stick left in a car park are a classic way to cross an air gap or tempt a curious employee. Vulnerable software is a vector whether it needs an installed client or is reached through a browser, and unsupported systems and applications are especially exposed because no fixes are coming.
Network vectors include unsecured wireless, unsecured wired ports that anyone can plug into, and Bluetooth. Open service ports widen the attack surface for every exposed service. Default credentials on new devices are one of the simplest vectors and one of the most common.
The supply chain is a vector through the people and products you trust: managed service providers, vendors and suppliers. If an attacker compromises a provider's remote management tool or a software update, every customer becomes reachable at once. Dependency confusion, where a public package with the same name as a private one is pulled into a build, is a modern example.
Human vectors make up the rest. Phishing uses email; vishing uses voice; smishing uses text messages. Misinformation is false information spread without intent to deceive, and disinformation is false information spread on purpose. Impersonation pretends to be someone trusted. Business email compromise uses a real or convincingly faked business email account to redirect payments. Pretexting builds a believable story, such as an auditor needing account details for reconciliation. A watering-hole attack compromises a site the target group visits. Brand impersonation copies a company's identity, and typosquatting registers misspelled domains to catch mistakes.
The useful way to study this objective is to ask, for each scenario, how did the attack reach the victim? The answer is the vector. Reducing the attack surface means closing those routes: disabling unused ports and services, changing default passwords, controlling removable media and training people.
What candidates mix up
- Phishing, vishing and smishing differ only by channel: email, voice and SMS.
- Pretexting versus impersonation: impersonation is pretending to be someone; pretexting is the invented story that makes the request believable. Many attacks use both.
- Watering hole versus typosquatting: a watering hole compromises a real site the victim already visits; typosquatting waits for the victim to mistype a domain.
- Misinformation is false but not deliberate; disinformation is deliberately false.
Practice questions for 2.2
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A caller claims to be from the company's auditing firm, cites a real ongoing audit and asks an accountant for a list of vendor bank accounts "for reconciliation". Which technique is the caller using?
- APretexting
- BShoulder surfing
- CTailgating
- DTyposquatting
Show answer and explanation
Answer: A) Pretexting
- APretexting builds a believable invented scenario to persuade the target to share information.
- BShoulder surfing is watching someone enter information.
- CTailgating means following someone through a secured door.
- DTyposquatting uses misspelled domain names.
Question 2
An employee finds a USB drive labeled "Layoffs 2026" in the lobby and plugs it into a work computer, which installs malware. Which threat vector was used?
- ARemovable media (baiting)
- BVishing
- CAn evil twin
- DTyposquatting
Show answer and explanation
Answer: A) Removable media (baiting)
- AThe attacker relied on curiosity to get a malicious removable device connected to an internal system.
- BVishing uses phone calls, not physical media.
- CAn evil twin is a rogue Wi-Fi access point.
- DTyposquatting uses misspelled domain names.
Question 3
Attackers compromise a niche industry news site that employees of a target company are known to read, planting a browser exploit that runs only for visitors from the target's IP ranges. Which attack is this?
- AA watering-hole attack
- BA brute-force attack
- CA SQL injection attack
- DA denial-of-service attack
Show answer and explanation
Answer: A) A watering-hole attack
- AThe attacker poisons a third-party site the intended victims habitually visit, waiting for them to come to it — often with targeting so unrelated visitors don't trigger the exploit.
- BNo credential guessing is involved.
- CThe compromise is of a third-party site to serve exploits, not manipulation of the target's database queries.
- DThe goal is stealthy compromise of visitors, not disrupting availability.
Other Threats, Vulnerabilities, and Mitigations objectives
Also: the Threats, Vulnerabilities, and Mitigations domain page (22% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.