Domain 2: Threats and Vulnerabilities — Study Guide
Domain 2 is one of the larger domains by weight. It's the "what can go wrong" domain — attacks, vulnerabilities, and how to spot them.
> Domain weightings are set by CompTIA and change with each exam version — confirm the current objectives at comptia.org.
Attack Types You Must Know
Malware: viruses, worms, trojans, ransomware, spyware, rootkits, keyloggers, fileless malware
Social engineering: phishing, spear phishing, whaling, vishing, smishing, pretexting, watering hole
Network attacks: man-in-the-middle, DNS poisoning, ARP spoofing, DDoS, replay attacks
Application attacks: SQL injection, XSS, CSRF, buffer overflow, directory traversal, API attacks
Cryptographic attacks: birthday attack, downgrade attack, collision
Vulnerability Categories
- Software vulnerabilities (unpatched systems, zero-days)
- Configuration vulnerabilities (default credentials, open ports, excessive permissions)
- Architectural vulnerabilities (single points of failure, lack of segmentation)
- Human vulnerabilities (lack of training, poor password hygiene)
Indicators of Compromise (IoCs)
Know how to recognise:
- Unusual outbound network traffic
- Unexpected privilege escalation
- Geographic anomalies in login locations
- Unusual DNS requests
- Modified system files or registry entries
Study Tips
This domain requires memorisation — there are many attack types and you need to distinguish between them. Make flashcards with attack name on one side and description + example on the other. Practice questions are essential here because the exam tests your ability to identify an attack from a scenario, not just define it.