SY0-701 Domain 2

Nation-state

Government-sponsored attackers conducting cyber espionage, sabotage, or warfare.

Unskilled attacker

Uses pre-made tools and scripts with little technical expertise.

Hacktivist

Politically or socially motivated hacker aiming to disrupt or expose.

Insider threat

Employees or contractors misusing access for personal or external gain.

Organized crime

Well-funded cybercriminal groups targeting financial gain through fraud or extortion.

Shadow IT

Unauthorized use of IT systems, apps, or services, leading to security risks.

Internal/external

Internal actors have system access, while external actors attack from outside.

Resources/funding

Well-funded actors (e.g., nation-states) conduct more sophisticated attacks.

Level of sophistication/capability

Highly skilled actors execute complex, stealthy, and targeted attacks.

Data exfiltration

Theft of sensitive information for unauthorized use.

Espionage

Theft of sensitive data for intelligence, corporate secrets, or political advantage.

Service disruption

Interrupting or degrading services to cause harm.

Blackmail

Using stolen or compromised data to extort victims.

Financial gain

Cybercriminals seeking profit through fraud, ransomware, or data theft.

Philosophical/political beliefs

Motivated by ideological causes to disrupt or expose entities.

Ethical

Conducting security testing within legal and ethical boundaries.

Revenge

Former employees or insiders causing damage due to grievances.

Disruption/chaos

Attacks aiming to cripple systems, businesses, or governments.

War

Cyberattacks used as a tool in geopolitical conflicts.

Email

Used for phishing, spam, and malicious attachments to deceive users.

Short Message Service (SMS)

Smishing attacks attempt to trick users via text messages.

Instant messaging (IM)

Attackers exploit chat apps for phishing and malware distribution.

Image-based

Malicious images contain hidden code or exploits.

File-based

Malicious files, such as PDFs or executables, spread malware.

Voice call

Social engineering attacks like vishing impersonate legitimate entities.

Removable device

USB drives and external storage spread malware or steal data.

Vulnerable software

Applications with security flaws exploited by attackers.

Client-based vs. agentless

Client-based requires software installation, while agentless relies on browser-based execution.

Unsupported systems and applications

Older systems lack security updates, making them vulnerable.

Unsecure networks

Open Wi-Fi, weak encryption, and exposed wired connections allow attackers access.

Wireless

Poorly secured wireless networks are easy targets for interception.

Wired

Physical access to network cables can enable unauthorized access.

Bluetooth

Exploited for unauthorized pairing and data theft.

Open service ports

Exposed ports allow attackers to exploit running services.

Default credentials

Unchanged manufacturer passwords create easy entry points.

Supply chain

Compromised vendors, suppliers, or MSPs introduce risks.

Managed service providers (MSPs)

Attackers exploit third-party IT providers to gain access.

Vendors

Hardware and software suppliers can be targeted for backdoor exploits.

Suppliers

Attackers compromise supply chains to distribute infected products.

Phishing

Deceptive emails trick users into revealing sensitive data.

Vishing

Phone-based phishing to extract information.

Smishing

SMS phishing using fraudulent messages.

Misinformation/disinformation

Spreading false information to manipulate public opinion.

Impersonation

Attackers pose as trusted entities to gain access.

Business email compromise

Fraudulent emails impersonating executives to request money transfers.

Pretexting

Social engineering tactic where attackers fabricate scenarios to obtain information.

Watering hole

Compromising websites frequently visited by a target group.

Brand impersonation

Fake websites or messages mimicking trusted brands.

Typosquatting

Registering misspelled domain names to trick users.

Memory injection

Injecting malicious code into memory to evade detection.

Buffer overflow

Excess data overwrites memory, leading to system crashes or control hijacking.

Race conditions

Exploiting the timing of operations to manipulate outcomes.

Time-of-check (TOC)

Attacker changes data between validation and use.

Time-of-use (TOU)

Exploiting the delay between validation and execution.

Malicious update

Fake or tampered software updates install malware.

Operating system (OS)-based

Exploiting OS vulnerabilities for unauthorized access.

Structured Query Language injection (SQLi)

Injecting malicious SQL queries to manipulate databases.

Cross-site scripting (XSS)

Injecting scripts into web pages to steal data or hijack sessions.

Firmware

Exploiting vulnerabilities in embedded system software.

End-of-life

Unsupported hardware and software that no longer receive updates.

Legacy

Older systems with outdated security mechanisms.

Virtual machine (VM) escape

Breaking out of a virtual machine to gain control over the host system.

Resource reuse

Exploiting residual data from previous sessions.

Cloud-specific

Cloud misconfigurations and API vulnerabilities pose security risks.

Service provider

Attackers target cloud or IT service providers.

Hardware provider

Hardware vulnerabilities exploited for backdoor access.

Software provider

Software supply chain attacks insert malicious code into legitimate applications.

Cryptographic

Exploiting weaknesses in encryption algorithms.

Misconfiguration

Incorrect security settings expose systems to attacks.

Mobile device

Threats targeting smartphones and tablets.

Side loading

Installing apps from unverified sources, increasing malware risk.

Jailbreaking

Removing security restrictions on a device to install unauthorized apps.

Zero-day

Newly discovered security flaws with no available patches.

Ransomware

Encrypts files and demands payment for decryption.

Trojan

Malware disguised as legitimate software to create backdoors.

Worm

Self-replicating malware that spreads without user action.

Spyware

Secretly collects user data and activities.

Bloatware

Unnecessary pre-installed software that can introduce vulnerabilities.

Virus

Malicious code that spreads by attaching to files.

Keylogger

Records keystrokes to steal sensitive data.

Logic bomb

Dormant malicious code activated under specific conditions.

Rootkit

Malware that hides its presence by modifying system files.

Brute force

Repeatedly guessing passwords or encryption keys.

Radio frequency identification (RFID) cloning

Copying RFID credentials for unauthorized access.

Environmental

Attacks leveraging physical conditions like temperature or humidity changes.

Distributed denial-of-service (DDoS)

Overwhelms a target with excessive traffic.

Amplified

Uses reflection techniques to magnify attack traffic.

Reflected

Spoofs the victim’s IP to redirect attack traffic.

Domain Name System (DNS) attacks

Manipulating DNS records to redirect users.

On-path

Intercepting communication between two parties.

Credential replay

Capturing and reusing valid credentials for unauthorized access.

Malicious code

Any code designed to harm, steal, or disrupt.

Injection

Exploiting input vulnerabilities to insert malicious commands.

Replay

Capturing and reusing transmitted data.

Privilege escalation

Gaining unauthorized higher-level system access.

Forgery

Creating fake authentication credentials or transactions.

Directory traversal

Accessing restricted directories by manipulating file paths.

Downgrade

Forcing a system to use weaker security settings.

Collision

Exploiting hash function collisions to break encryption.

Birthday

Exploiting probability to find hash function collisions.