Domain 2: Threats, Vulnerabilities, and Mitigations
Know your enemy. Know your weaknesses. Know what to do when both collide. The largest Domain-2 questions block on the exam — match actors to motivations, vectors to attacks, indicators to incidents, and mitigations to threats.
Six Ideas That Drive Every Domain 2 Question
Threats, vulnerabilities, and mitigations weave through 22% of the exam. Master these six and you can reason through almost any Domain 2 scenario.
Threat Actor Triangle
Motivation + Resources + Sophistication = who’s attacking you and why
Vector vs Attack
The vector is the pathway; the attack is what happens after
Zero-Day vs Unpatched CVE
Zero-day = vendor doesn’t know. Unpatched CVE = vendor fixed it, you didn’t apply it.
IoC Direction
Spray = wide (many accounts, one password). Brute = deep (one account, many guesses).
Allow List vs Blocklist
Antivirus says “block the known-bad.” Allow-listing says “only run the known-good.”
Defense-in-Depth
Segmentation + least privilege + monitoring + hardening — layers beat single controls.
Find Out Where to Start
5 questions across Domain 2 — see which objectives need the most work.
Focus on these objectives
You’ve got these
5 Objectives — Pick Your Path
Each lesson teaches through real scenarios — concept, textbook, hard choice, exam signal. Start anywhere or go in order. Completed lessons show a checkmark.
Nation-state, organized crime, hacktivist, insider, unskilled, shadow IT — with attributes (internal/external, resources, sophistication) and motivations (exfil, espionage, disruption, blackmail, financial, ideology, revenge, war).
Message (email/SMS/IM), image, file, voice, removable, vulnerable software, unsupported systems, unsecure networks, open ports, default creds, supply chain, human/social engineering (phishing, vishing, smishing, BEC, pretexting, watering hole, typosquatting, quishing).
Application (memory injection, buffer overflow, TOCTOU), OS, web (SQLi, XSS), hardware (firmware, EOL, legacy), virtualization (VM escape, resource reuse), cloud, supply chain, cryptographic, misconfiguration, mobile (sideloading, jailbreaking), zero-day.
Malware (ransomware, trojan, worm, spyware, virus, keylogger, logic bomb, rootkit), physical, network (DDoS, DNS, wireless, on-path), application (injection, replay, priv esc, forgery, traversal), crypto (downgrade, collision), password (spraying vs brute force), generic IoCs (impossible travel, missing logs).
Segmentation, ACL + permissions, allow list, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning — plus hardening (endpoint protection, host firewall, HIPS, disable ports/protocols, default password changes, remove unnecessary software).
Scenario-based drills and adaptive quizzes — Coming Soon
TJS Platform will have attribution drills, vector-to-attack matching, and AI-powered explanations for every Domain 2 objective.
Learn It, Test It, Lock It In
Each card has 3 layers. Click to advance: mnemonic → scenario challenge → answer + exam tip.
Custom malware with 2-year dwell time targeting an aerospace firm. Which actor?
Nation-state (APT). Custom tooling + long dwell + strategic target = APT signature. Organized crime rivals this in tooling but wants faster ROI, not multi-year espionage.
A deepfake voicemail from the CFO asks accounts payable to wire funds. Which vector?
Vishing. Voice call = vish. If the CFO was impersonated over email for wire fraud specifically, that would be BEC — but this scenario is voice, so vishing.
A Windows server is compromised via CVE-2024-XXXXX, which Microsoft patched 90 days ago. Is this a zero-day?
No. A patch exists — this is an unpatched known vulnerability, not a zero-day. The distinction matters because controls differ: zero-day needs behavioral / defense-in-depth; unpatched CVE needs patch management.
Fifteen hundred accounts each received one failed login attempt using “Spring2024!” in the same hour. Which attack?
Password spraying. One password across many accounts. Brute force would be many passwords against one account. Spraying evades single-account lockout thresholds, so the IoC pattern is wide and quiet.
NTP servers return 500-byte responses to 50-byte queries. Attacker spoofs victim’s IP as source. What is this called?
Both: amplified and reflected. The response is amplified (10x) AND reflected off NTP servers at the victim via IP spoofing. Exam questions usually focus on one property; read whether they emphasize “small request / huge response” (amplification) or “spoofed source IP” (reflection).
An auditor finds SMBv1 enabled on a patched Windows server. Is this a patching failure or a hardening failure?
Hardening. SMBv1 is not a bug — it’s a deprecated protocol that should be disabled. Leaving it enabled is a hardening/configuration failure, not a missing-patch failure.
The Direction Rule — Exam Strategy
On Domain 2 IoC questions, ask: which direction? Spraying is wide (many accounts). Brute is deep (many guesses). Amplification is volume (small in / big out). Reflection is source (spoofed IP). The exam tests whether you can identify the shape of the attack, not just name it.
Security+ Tests How You Solve Problems
Attribution Puzzle
The Ransomware Choice
The Allow-List Argument
Adaptive Domain 2 drills — Coming Soon
TJS Platform will track your weak areas and generate focused scenario drills. AI Study Buddy will explain why you got it wrong.
The Tempting Wrong Answer
Spraying vs Brute Force
Spraying = wide (one password, many accounts). Brute force = deep (many passwords, one account). Direction matters, not volume.
Vector vs Attack
Email is a vector. Phishing is an attack using that vector. The exam asks which vector — identify the channel, not the payload.
Zero-Day vs Unpatched CVE
If a patch exists, it’s not a zero-day — no matter how dangerous. Zero-day = vendor doesn’t know yet.
Allow List vs AV
AV = blocklist (known-bad). Allow list = default-deny (only known-good). Allow-listing catches unknown malware; AV doesn’t.
Segmentation vs Isolation
Segmentation = separated zones that still communicate via controlled paths. Isolation = no communication at all (air-gap).
Vishing vs Smishing vs BEC
Vishing = voice. Smishing = SMS. BEC = executive email impersonation for wire fraud specifically. Match channel + intent to label.
5 Practice Questions
Select an answer, then click Check. Full adaptive quiz engine with 200+ questions coming soon on TJS Platform.
“Readily available tools they didn’t build,” “limited knowledge,” and “thrill/reputation” motivation are the defining traits of an unskilled attacker / script kiddie. Hacktivists can also be unskilled but are ideologically driven.
A malicious QR code is quishing, a form of image-based phishing. Smishing uses SMS, vishing uses voice, watering hole compromises a site the target already visits.
Time-of-Check to Time-of-Use (TOCTOU) is a race condition: state changes between validation and action. The check was correct, but the state changed before the action ran. Injection and buffer overflow exploit input handling, not timing.
Two successful logins from geographically impossible locations within minutes = impossible travel, a generic IoC suggesting credential compromise. Spraying/brute-force produce failed logins, not successful geo-separated ones.
Signature-based AV can’t detect what it’s never seen. For zero-day, defense-in-depth with default-deny (allow-listing), lateral containment (segmentation), and behavioral detection (EDR) provides layered coverage. Perimeter-only and password-only controls don’t reach endpoint execution.
Continue Your Prep
Choose how you want to study. All paths lead to the same goal — passing the Security+ on exam day.
All 5 domains, 200+ adaptive questions, AI Study Buddy, timed exams, and certificate of completion.
Printable desk reference with key concepts, mnemonics, and quick-reference tables for all 5 domains.
Actor triangle, vector family, vulnerability classes, IoC directions, and mitigation mapping on one page.