CompTIA Security+ Domain 2: Threats, Vulnerabilities & Mitigations — Free Practice Questions

About this domain

Domain 2 of the CompTIA Security+ SY0-701 exam, Threats, Vulnerabilities & Mitigations, carries 22% of your score, making it the second-heaviest domain on the test. It asks you to think like both attacker and defender: who is coming after the organization, how they get in, what weaknesses they exploit, and what you do about it. Expect scenario questions that hand you a behavior and ask you to name it, then pick the right countermeasure.

The objectives start with threat actors and their motivations, from a hacktivist defacing a public website with political slogans to nation-states, organized crime, and insiders. You then map threat vectors and attack surfaces, such as an unlabeled USB drive found in a parking lot, phishing email, or an exposed cloud service. Vulnerability coverage spans application flaws like race conditions and time-of-check/time-of-use bugs, virtualization weaknesses such as VM escape, and misconfigurations.

The back half is detection and defense. You analyze indicators of malicious activity, including malware families, command-and-control traffic, domain generation algorithms, and password attacks like spraying. Then you apply mitigation techniques: segmentation, least privilege, patching, and access controls that limit lateral movement. Work the practice set below to build the pattern recognition this domain rewards.

What Domain 2 covers

Compare common threat actors and their motivations (hacktivism, financial, espionage, insider)
Explain threat vectors and attack surfaces (removable media, messaging, supply chain)
Explain types of vulnerabilities, including application, virtualization, and race conditions
Analyze indicators of malicious activity across network, application, and host
Identify malware types and command-and-control behavior such as DGA traffic
Recognize password attacks like spraying and brute force
Apply mitigation techniques: segmentation, least privilege, and limiting lateral movement

Domain 2 quick glossary

The terms that show up most on Domain 2 questions — one line each.

Threat actorA person or group that carries out an attack, defined by attributes like resources, sophistication, and motivation.

HacktivismAttacks driven by political or social causes rather than profit, often involving defacement or data leaks.

Threat vectorThe path or method an attacker uses to reach a target, such as a malicious USB drive or phishing email.

Attack surfaceThe total set of points where an attacker could attempt to enter or extract data from a system.

Race condition (TOCTOU)A flaw where a resource's state changes between the time it is checked and the time it is used.

VM escapeA virtualization vulnerability that lets code break out of a guest VM to reach the hypervisor or host.

Command and control (C2)The channel malware uses to receive instructions, sometimes hidden via domain generation algorithms.

Password sprayingTrying one or few common passwords across many accounts to avoid lockout thresholds.

Lateral movementAn attacker pivoting from one compromised host to others, countered by segmentation and least privilege.

Keep going

Practice the other domains, or go deeper with the full study materials.

Domain 1: General Security Concepts12% · CIA triad, controls, crypto Domain 3: Security Architecture18% · architecture models, data protection Domain 4: Security Operations28% · incident response, monitoring, IAM Domain 5: Security Program Management & Oversight20% · governance, risk, compliance All Security++ practice testsFull sets · timed mocks