Threats, Attacks, and Social Engineering
This chapter surveys the adversaries and techniques that security professionals defend against. You will learn to distinguish threat actors by motivation and capability, recognize the major malware families, and identify social engineering and application attacks. Understanding how attacks work is the foundation for choosing the right defenses.
Threat Actors and Motivations
Every defense decision starts with a question: who might attack us, and why? SY0-701 expects you to classify threat actors along a few dimensions and match each to its typical behavior. The first dimension is where the actor sits: an internal threat originates inside the trust boundary, such as an employee or contractor, while an external threat comes from outside. The second is resources and funding, which range from a lone hobbyist to a government program with unlimited budget. The third is sophistication or capability, meaning the technical depth an actor can bring to bear. The fourth is intent and motivation, which is the goal driving the attack. Common motivations include financial gain, espionage, data exfiltration, service disruption, blackmail, revenge, ethical or philosophical belief, war, and chaos. Nation-state actors are the most capable and best funded; they pursue espionage and long-term access, are often labeled advanced persistent threats, and can develop or purchase zero-day exploits. Organized crime treats attacks as a business, chasing money through ransomware, fraud, and theft of card or identity data. Hacktivists act on ideology, defacing sites or leaking data to make a political point rather than to profit. Unskilled attackers, sometimes called script kiddies, run prebuilt tools they do not fully understand, yet they still cause real harm. Insider threats abuse authorized access and are dangerous because they already sit inside the perimeter and know where value lives; their actions may be malicious or simply negligent. Shadow IT, where staff deploy unsanctioned hardware, software, or cloud services, expands the attack surface outside the view of security teams. You should also understand threat vectors and attack surfaces: message-based vectors like email and SMS, image and file vectors, voice calls, removable media, vulnerable software, unsupported systems, open service ports, default credentials, and supply-chain paths through vendors and managed service providers. Matching an actor's motivation and resources to the likely vector lets defenders anticipate methods and prioritize the controls that matter most.
Malware Types
Malware is any software written to damage, disrupt, steal, or gain unauthorized control, and the exam wants you to identify each family by its behavior and by the indicators it leaves behind. Ransomware encrypts files and demands payment for the key; modern strains add double extortion by exfiltrating data first and threatening to publish it, which is why tested, offline, immutable backups are the strongest recovery control. A virus attaches to a host file and needs a user to execute it, while a worm self-replicates across the network with no user action, making outbreaks spread quickly; patching and segmentation slow worms. A Trojan disguises itself as legitimate software and does not self-replicate, relying on the victim to run it, and it often opens a backdoor. A remote access Trojan gives an attacker interactive control of the host. Spyware secretly monitors activity, and a keylogger specifically captures keystrokes to steal credentials; multifactor authentication limits the value of stolen passwords. A rootkit hides at a low level, such as the kernel or boot process, to conceal itself and preserve privileged access, so secure boot and measured boot help detect it. A logic bomb waits for a trigger, like a date or an event, before executing its payload. A botnet is a network of compromised machines, or bots, controlled through command-and-control infrastructure and used for distributed denial-of-service, spam, or crypto mining. Fileless malware lives in memory and abuses legitimate tools such as PowerShell to evade file-scanning antivirus. Understanding indicators of compromise is essential: unusual account lockouts, concurrent session use, blocked or impossible-travel logins, resource-intensive processes, unexpected outbound traffic, missing or altered logs, published or leaked data, encrypted files with ransom notes, and changes to registry or scheduled tasks. Because a worm, a Trojan, and ransomware spread and act differently, the correct remediation differs too, from isolating and reimaging an infected host to rotating credentials, restoring from clean backups, and closing the vector that allowed the initial infection.
Social Engineering
Social engineering attacks the human rather than the machine, manipulating people into breaking normal security procedures. The exam frames these attacks around psychological principles of influence: authority, where the attacker poses as someone powerful; intimidation, which uses threats; consensus or social proof, which claims others already complied; scarcity and urgency, which pressure fast action; familiarity and likability, which build rapport; and trust, which the attacker cultivates or borrows. Phishing is fraudulent email that harvests credentials or delivers malware; spear phishing narrows the target to a specific person or group, and whaling aims at executives. Vishing uses voice calls and smishing uses text messages to achieve the same ends. Pretexting invents a believable backstory, such as posing as IT support or a new vendor, to justify a request. Business email compromise impersonates an executive or partner to trick staff into wiring funds or sharing data, exploiting authority and urgency, and it frequently bypasses technical filters because the message contains no malware. Other named techniques include baiting, which leaves tempting infected media like USB drives; tailgating and piggybacking, which follow an authorized person through a controlled door; shoulder surfing, which observes screens or keypads; dumpster diving, which recovers sensitive material from trash; and watering-hole attacks, which compromise a site the target group is known to visit. Impersonation and identity fraud underpin many of these. A misinformation or disinformation campaign spreads false narratives to manipulate opinion or behavior, and brand impersonation clones a trusted company's look. Typosquatting registers look-alike domains to catch mistyped URLs and deliver phishing pages or malware. Pharming redirects legitimate traffic to a malicious site by poisoning DNS or host files. Because these attacks exploit judgment rather than code, the primary defenses are human and procedural: recurring security awareness training, simulated phishing campaigns, clear reporting channels, and out-of-band verification for sensitive requests such as fund transfers or password resets. Technical controls like email authentication with SPF, DKIM, and DMARC, plus multifactor authentication, reduce the payoff when a lure succeeds, but they never replace an alert, trained workforce.
Application and Network Attacks
A large share of real breaches exploit flaws in software or protocols, so SY0-701 tests the mechanics of the common technical attacks and their fixes. Injection attacks abuse input that a program passes into an interpreter: SQL injection manipulates database queries to read or alter data, and command injection runs operating-system commands; the defense is input validation plus parameterized queries and least-privilege database accounts. Cross-site scripting injects script that executes in another user's browser, enabling session theft; output encoding, input validation, and a content security policy stop it. Cross-site request forgery tricks an authenticated browser into submitting an unwanted action, countered with anti-CSRF tokens. A buffer overflow writes past an allocated memory boundary to corrupt data or run code, mitigated by safe coding and memory protections. A race condition, including time-of-check to time-of-use flaws, exploits timing between a check and its use. Replay attacks capture and resend valid traffic or tokens, defeated by nonces, timestamps, and session expiration. On-path attacks, formerly called man-in-the-middle, intercept or alter traffic between two parties; strong encryption and certificate validation mitigate them. Denial-of-service floods a target to exhaust resources, and distributed versions harness botnets, so rate limiting, upstream scrubbing, and anti-DDoS services help. DNS attacks include cache poisoning and domain hijacking, while ARP poisoning redirects local traffic. Password attacks include brute force, dictionary, and password spraying, plus offline cracking with rainbow tables against unsalted hashes; salting, strong length-based policies, account lockout, and multifactor authentication defend against them. Wireless and radio-frequency attacks include rogue access points, evil twins, deauthentication, and Bluetooth exploits. You should also recognize vulnerability sources that enable these attacks: memory injection and malicious updates in the supply chain, misconfigurations, unpatched and legacy end-of-life systems, insecure default settings, open ports, weak or reused credentials, and zero-day flaws for which no patch yet exists. Reading an attack scenario, identifying the exploited weakness, and selecting the specific mitigation is exactly the reasoning the performance-based questions reward.
Last updated: September 2026
练习一直免费。完整的 CompTIA Security+ (SY0-701) 学习指南是知识本身,从头到尾讲清楚 —— 可下载的 PDF + EPUB,永久归你。