Common Attack Types: Phishing, MITM, DDoS (Security+)

SY0-701 tests attacks as indicators. It shows you a signal and asks for the mitigation from a closed list of eleven. This page gives you every attack family in Domain 2 in one sentence, the indicator it leaves behind, and the exact objective 2.5 answer the exam accepts.

A finance clerk signs in from Toronto at 09:14 and from Manila at 09:25. Both sessions are live, no malware has fired, and CompTIA calls that signal impossible travel. The four answer options that follow are all real security controls, and only one is on the list CompTIA publishes. Domain 2, titled exactly Threats, Vulnerabilities, and Mitigations, is 22% of the exam, the second largest domain, and nearly all of it is that drill.

Most of these attacks never make the news. They reach you as indicators: a resource consumption alert, an account lockout, a log that stops writing.

Every attack family in one sentence

• Phishing is a fraudulent message impersonating a trusted sender to harvest credentials, money or a click.
• An on-path attack, previously called man-in-the-middle, is an attacker sitting between two parties that believe they are talking directly, reading or altering traffic in transit.
• A DDoS attack is a denial of service driven from many sources at once, so the target exhausts bandwidth, connection state or CPU before the attacker runs out of hosts.
• Injection is any attack that smuggles attacker input into an interpreter, so text the application meant as data gets executed as a command.
• Privilege escalation is a user or process obtaining rights it was never assigned.
• Malware is software written to run against the interests of the system owner, whether it steals, encrypts, watches or opens the door for the next stage.
• Ransomware is malware that encrypts data and sells the key back, usually after copying the data first.
• A logic bomb is malicious code that lies dormant until a condition fires: a date, a deleted record, a missing payroll entry.

How CompTIA organises this domain

Five objectives, in a deliberate order:

• 2.1 Threat actors and motivations. Six actors only, nation-state through shadow IT.
• 2.2 Threat vectors and attack surfaces. How the attack gets in.
• 2.3 Types of vulnerabilities. The weakness itself. SQL injection and cross-site scripting live here, under Web-based.
• 2.4 Indicators of malicious activity. The attacks and the traces they leave.
• 2.5 Mitigation techniques. A closed list of eleven.

The load bearing point: 2.3 holds vulnerabilities, 2.4 holds attacks, which is why SQLi and generic "Injection" sit in different objectives. Once that clicks, Domain 2 becomes matching: indicator from 2.4, technique from 2.5.

Objective 2.4 names exactly nine indicators, and stems come from them:

• Account lockout
• Concurrent session usage
• Blocked content
• Impossible travel
• Resource consumption
• Resource inaccessibility
• Out-of-cycle logging
• Published/documented
• Missing logs

The eleven mitigations are just as closed: segmentation, access control, application allow list, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, hardening techniques. DNSSEC, web application firewalls, certificate pinning and rate limiting are real defences absent from that list. A WAF is on the exam, under firewall types in 4.5, just not among the eleven, which is what makes all four good distractors.

Phishing and social engineering: ten vectors, not thirty

Four get confused. Vishing is a voice call, smishing is SMS: the channel decides the term. Pretexting is the invented backstory that makes either believable, business email compromise wears a trusted business identity to move money. Brand impersonation copies the look, typosquatting the misspelled domain.

The BEC signal is structural: a Reply-To that differs from the From address, a lookalike domain, urgency on an out of band payment change.

The named controls sit in Domain 4: objective 4.5 lists DMARC, DKIM, SPF and a secure email gateway. CISA names FIDO/WebAuthn the only widely available phishing-resistant authentication, since app codes, SMS and push can all be bypassed.

example.com.         IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"
_dmarc.example.com.  IN TXT "v=DMARC1; p=reject; adkim=s; aspf=s; pct=100; rua=mailto:dmarc@example.com"

RFC 7208 caps SPF at ten DNS lookup terms and -all is the hard fail. The exam idea underneath DMARC is alignment: it passes only when SPF or DKIM passes and that identifier aligns with the From domain. So p=reject ends exact domain spoofing and does nothing about lookalikes.

On-path, and why the exam stopped saying MITM

From 2.5: segmentation and encryption. On a Cisco access layer:

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# ip arp inspection vlan 10
Switch(config)# ip arp inspection validate src-mac dst-mac ip
Switch(config)# interface GigabitEthernet1/0/24
Switch(config-if)# description uplink to DHCP server and gateway
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# ip arp inspection trust
Switch(config-if)# interface range GigabitEthernet1/0/1-23
Switch(config-if-range)# ip arp inspection limit rate 30 burst interval 2

Defaults matter more than commands. Dynamic ARP Inspection is off on all VLANs, every interface starts untrusted at 15 packets per second with a one second burst, and no validation runs until ip arp inspection validate is set. The rate limit is the number worth deciding: a DHCP heavy access port trips 15 per second and err-disables itself, so 30 over two seconds buys headroom. DAI reads the DHCP snooping binding database, so snooping goes on first and static hosts need an ARP ACL.

DDoS: the exam names exactly two types

Amplification factors published by CISA in alert AA14-017A:

GitHub is the canonical case: unavailable from 17:21 to 17:26 UTC on 28 February 2018 at 1.35 Tbps over memcached. The reflectors in exam stems sit on UDP 53, 123 and 389, all in our ports and protocols reference; memcached on 11211 holds the record but rarely appears as an answer option.

The TCP SYN flood, RFC 4987, is state exhaustion rather than bandwidth: spoofed SYNs fill the backlog with half open entries awaiting an ACK that never comes, and on Linux tcp_synack_retries defaults to 5, a 63 second hold.

The indicators are resource consumption and resource inaccessibility, plus inbound UDP from port 53 or 123 to hosts that never queried. From 2.5 the exam wants monitoring and segmentation; in production, patch or decommission the reflector (ntpd 4.2.7p26 and later disable monlist by default, CVE-2013-5211) and run BCP 38 ingress filtering.

Malware: nine names in 2.4, and the mitigation that is not on the list

• Virus needs a host file and a user to run it. Worm needs neither and spreads itself across the network.
• Trojan is the delivery lie: something the user wanted, carrying something they did not.
• Ransomware encrypts and extorts. Spyware and keylogger stay quiet and exfiltrate instead.
• Bloatware is unwanted preinstalled software, on the exam as an attack surface rather than an attack.
• Rootkit hides the other eight by tampering with the operating system itself.
• Logic bomb leaves nothing to find until its trigger fires.

The indicators follow from the behaviour. Ransomware surfaces as resource inaccessibility once files will not open, and as resource consumption in the window before that while it is still encrypting. Rootkits and log wipers produce missing logs. A logic bomb and a live rootkit both show up as out-of-cycle logging, activity at an hour when that account has no business being awake.

From the eleven: patching and configuration enforcement close the way in, an application allow list stops an unapproved binary running at all, least privilege and segmentation cap the blast radius, isolation and decommissioning are what you do to the host during and after the incident.

Injection and privilege escalation

The OWASP SQL Injection Prevention Cheat Sheet ranks the defences: parameterized queries first, properly constructed stored procedures second, allow-list validation third, escaping last and strongly discouraged. Least privilege on the database account is the one that is also among the eleven.

String query = "SELECT account_balance FROM user_data WHERE user_name = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, custname);

The Windows Security log names the attack for you. On a failed logon, Event 4625, the field to read is Sub Status, not Status:

Event ID:        4625
Account Name:    jsmith
Failure Reason:  Unknown user name or bad password.
Status:          0xC000006D
Sub Status:      0xC000006A

0xC000006A is a bad password, so a run of these against one account is brute force. 0xC0000064 in that same field is a bad username, so a run of those across many accounts is enumeration or password spraying. Status reads 0xC000006D either way, which is why the Status line alone tells you nothing. Event 4740 is the lockout that follows, and a domain administrator arriving as logon Type 5 Service is not how administrators log in.

The indicator to mitigation drill

Bold entries are 2.4's exact wording and can appear as answer options. The rest are real world tells: a stem describes them, it does not offer them. CompTIA never ties an indicator to a named attack, so this mapping is a study aid, not a published one.

Read the last line of the stem first: "BEST" means several answers are true and one fits the indicator. Between two real mitigations, 2.5 wording wins.

What this is worth on exam day

SY0-701 is still 90 minutes, at most 90 questions, 750 to pass; the certification overview has the logistics. It retires in English on 11 June 2027, and Security+ V8, exam SY0-801, launches on or around November 17, 2026, so SY0-701 versus SY0-801 covers what changes before you book.

Module 1 of our Security+ SY0-701 bootcamp walks these five objectives over 30 hours of live instructor led class with hands on cyber labs, at $699 CAD, and the SY0-701 study guide sets the order to study them in.

Sources and last verified

Every number above comes from a primary source. Check them yourself:

• Amplification factors: CISA alert AA14-017A, UDP based amplification attacks.
• RFCs on the IETF datatracker: 826 for ARP cache behaviour, 5452 for resolver hardening, 7208 for the SPF lookup limit, 4987 for SYN floods, and BCP 38 for ingress filtering.
• Injection defence ranking: the OWASP SQL Injection Prevention Cheat Sheet.
• The 1.35 Tbps memcached event: GitHub's engineering write up of the 28 February 2018 outage.
• monlist disabled by default in ntpd 4.2.7p26: CVE-2013-5211 in the NVD.
• Phishing-resistant authentication: CISA, Implementing Phishing-Resistant MFA.
• Objective numbering, the nine indicators and the eleven mitigations: the CompTIA SY0-701 exam objectives.

Content last verified 22 September 2026 against the published SY0-701 objectives.

Frequently Asked Questions

Is MITM still on the Security+ exam?

The concept is, the term is not. SY0-601 wrote it as "On-path attack (previously known as man-in-the-middle attack)" and SY0-701 removed the parenthetical. The objectives say only "On-path", and MITM appears nowhere in the SY0-701 document, acronym list included. Expect the answer option to read "on-path attack".

Which DDoS types does SY0-701 actually name?

Exactly two: amplified and reflected, the only sub-bullets under "Distributed denial-of-service (DDoS)" in objective 2.4. The industry split into volumetric, protocol and application layer is not this exam's vocabulary.

What is the difference between a reflected and an amplified DDoS attack?

Reflection is about direction, amplification is about size. In a reflected attack the attacker spoofs the victim's IP, so an innocent server sends its reply to the victim. In an amplified attack the reply is far larger than the request: CISA measures NTP monlist at 556.9 times and memcached up to 51,000 times.

Is ransomware on the Security+ SY0-701 exam?

Yes. Ransomware is named under Malware attacks in objective 2.4, alongside trojan, worm, spyware, bloatware, virus, keylogger, logic bomb and rootkit. Domain 2 tests it as an indicator plus a mitigation rather than as a case study: the indicator is resource inaccessibility, and the mitigation must come from the eleven in 2.5, which means application allow list, patching, isolation or least privilege. Backups are the production answer and are not on that list.

Is SQL injection in Security+ Domain 2?

Yes, but not where most people look. SQL injection and cross-site scripting sit in objective 2.3, under Web-based, while objective 2.4 lists only the generic "Injection". The split matters: 2.3 asks what the weakness is, 2.4 asks what the traffic looked like.

What mitigation does Security+ expect for phishing?

It depends which objective the question comes from. Inside Domain 2 the answer comes from the closed list of eleven in 2.5: access control, least privilege and monitoring. The named technologies sit in Domain 4 objective 4.5, SPF, DKIM, DMARC and a secure email gateway. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication.