Objective 2.2: Explain common threat vectors and attack surfaces

Cert: CompTIA Security+ (SY0-701) Domain: 2.0 Threats, Vulnerabilities, and Mitigations Weight: ~22% of SY0-701 (Domain 2 total) Depth: Explain. Be able to name and describe every vector category, give a real example, and recommend one control that would have closed it.

What this objective tests

You should be able to name the message-based vectors (email, SMS, instant message), image-based and file-based vectors, voice-call vectors, removable media, vulnerable software (client-based vs agentless), unsupported systems and applications, unsecure networks (wireless, wired, Bluetooth), open service ports, default credentials, supply-chain vectors (managed service providers, vendors, suppliers), and the full roster of human-vector and social-engineering techniques: phishing, vishing, smishing, misinformation and disinformation, impersonation, business email compromise (BEC), pretexting, watering hole, brand impersonation, and typosquatting. You should also be able to read a short breach summary and map it to the right vector. This is one of the highest-yield objectives on the exam.

Key facts

Threat vector vs attack surface

A threat vector is the path the attacker takes to reach a system. An attack surface is everything an attacker can touch. Vector is the road. Surface is the city. The two terms travel together but mean different things on the exam. A vector cannot exist without a surface to land on.

The wider the attack surface, the more vectors are possible. Cloud migrations, remote work, third-party integrations, and SaaS sprawl all expand attack surface. Hardening means shrinking surface and closing vectors at the same time.

Message-based vectors

Message-based vectors deliver the attack through email, SMS, or instant message (IM). Most modern breaches start here.

Email is still the top vector by volume. SMS is rising fast because people trust their phones. IM phishing is newer but works on the same playbook: an attacker abuses the trust that comes with being inside the chat platform.

Image-based and file-based vectors

Both hide the payload inside content the user is likely to open without thinking.

• Image-based. Malware or scripts hidden inside image files. Steganography buries a payload inside the pixels of a PNG or JPG. Malicious EXIF metadata can also smuggle short scripts. Image vectors are less common than file vectors but harder to spot.
• File-based. Malware delivered in a document, archive, or installer. Common carriers: PDF with embedded JavaScript, Office documents with macros, ZIP, RAR, ISO, MSI, LNK. Common payloads: macros that fetch a second-stage loader, password stealers, ransomware droppers. Attackers pick the file type the recipient is least likely to question.

Defense for both: sandboxing, EDR (Endpoint Detection and Response) file scanning, macro restrictions in Office policy, attachment filtering at the mail gateway.

Voice-call vector (vishing)

Vishing is phishing over a voice call. The attacker calls pretending to be IT support, the bank's fraud team, an HVAC vendor, a regulator, or a manager. They often arrive armed with information from social media, LinkedIn, or a previous breach to sound credible.

The textbook attack pattern: caller claims to be from Microsoft support, says the user's machine has a virus, walks them through installing remote-access tooling. Less obvious patterns are more dangerous, such as a vendor "tech" calling the receptionist to ask for the IP address of the server-room temperature sensor or a fake fraud-team rep asking the user to read back the code they just received by SMS (which is actually their own MFA code).

Defense: written callback policy, never give credentials or MFA codes over an inbound call, verify any urgent vendor or executive request through a known channel.

Removable media

Removable media covers USB drives, SD cards, optical disks, and external hard drives. The textbook attack is the parking-lot drop: an attacker drops a USB drive labeled "payroll" or "Q3 bonuses" where employees will find it. Someone picks it up, plugs it in, and the autorun, the rubber ducky payload, or a malicious file delivers the attack.

A 2016 University of Illinois study dropped 297 USB drives around campus. Forty-eight percent were plugged in. The study is the canonical academic reference for why this attack still works.

Defense: disable autorun, restrict USB ports via group policy or endpoint configuration, EDR scanning of removable media on mount, training that includes "what to do if you find an unmarked USB drive at work."

Vulnerable software: client-based vs agentless

Almost every software product on the planet has known vulnerabilities at some point. CVE (Common Vulnerabilities and Exposures) identifiers track them. The objective splits vulnerable software into two flavors based on where the agent lives.

A client-based vulnerability requires getting an update to every endpoint, which is slow but the agent has full local visibility. An agentless vulnerability is patched once on the server, which is fast, but agentless services tend to be exposed to a wider attack surface (often the public internet).

Unsupported systems and applications

An unsupported system or application is past its end-of-life (EOL) date. No patches are coming. Known CVEs stay open forever. Common examples on the exam and in the field: Windows 7 (EOL 2020), Windows Server 2008 R2 (EOL 2020), Windows Server 2012 R2 (EOL 2023), older versions of Adobe Flash, and any line-of-business application whose vendor no longer ships updates.

These systems are landmines. Cyber insurance underwriters now ask for evidence that EOL systems are being retired. Defense in the short term: isolate on a segregated VLAN, monitor heavily, restrict outbound access, plan a replacement.

Unsecure networks

Three subcategories on the exam: wireless, wired, and Bluetooth.

• Wireless. Open networks (no encryption), weak encryption (WEP, WPA without WPA2 or WPA3), captive portals with no encryption, rogue access points, evil-twin SSIDs. Public WiFi at conferences and hotels is the textbook unsecure-network scenario.
• Wired. Empty Ethernet jacks in public-facing areas (lobbies, conference rooms), missing 802.1X port authentication, VLAN hopping on switches with default trunking config.
• Bluetooth. Default discoverable mode, older protocol versions with known weaknesses (bluejacking, bluesnarfing, BlueBorne), paired devices left unattended in public spaces.

Defense: WPA3 on wireless with strong PSK or 802.1X, 802.1X on wired with MAC fallback only in tight cases, Bluetooth disabled when not in use, VPN on any untrusted network.

Open service ports

Every open port is a potential entry. Attackers run continuous port scans against the public IP space looking for management interfaces, file-sharing services, and remote-access protocols. The high-value targets:

Defense: firewall by default-deny, expose only what is needed, put management interfaces behind a VPN or zero-trust gateway, change default ports only as defense in depth (not a replacement for real controls), monitor for unusual external connections.

Default credentials

Default credentials are the factory username and password (admin/admin, root/root, the sticker on the bottom of the router). Default credentials are one of the highest-yield vectors attackers scan for, and they are the easiest single class of attack to prevent.

The Mirai botnet (2016) built itself almost entirely on default credentials. It scanned the internet for IoT devices reachable on Telnet or SSH, tried roughly 60 hard-coded factory credential pairs, and built a botnet of hundreds of thousands of cameras, DVRs, and routers. It launched some of the largest DDoS attacks ever recorded.

Defense: provisioning checklist that requires changing every default, configuration management to enforce it, periodic audit, vendor selection that favors devices with no default credentials at all.

Supply chain

A supply-chain attack reaches the target through someone the target already trusts. The objective lists three channels: managed service providers (MSPs), vendors, and suppliers.

Supply-chain attacks are devastating because the trusted-vendor traffic is already allowed through the firewall and tagged as low risk by the SIEM (Security Information and Event Management) rules. Defense: vendor security questionnaires, contractual security requirements, least-privilege access for vendor accounts, monitor third-party connections like first-party connections, demand evidence of patching and incident response capability.

Human vectors and social engineering

Every technical control eventually loses to a human who clicks the wrong thing. The objective lists a long roster of human vectors:

• Phishing. Mass email designed to trick the reader into clicking, replying, or running an attachment. The base case for most human-vector attacks.
• Vishing. Phishing over a voice call. Covered above under voice-call vector.
• Smishing. Phishing over SMS. Covered above under message-based vector.
• Misinformation. Wrong information shared without intent to deceive. Damage by accident.
• Disinformation. Wrong information shared intentionally to deceive. Damage on purpose. The difference is intent.
• Impersonation. Pretending to be someone with authority (CEO, IT, auditor, regulator) to get information or access.
• Business Email Compromise (BEC). An attacker poses as an executive or vendor and asks for a wire transfer, an invoice change, or a sensitive document. The FBI Internet Crime Complaint Center (IC3) reports BEC as one of the highest-dollar-loss crimes year over year, often exceeding ransomware in total losses.
• Pretexting. Inventing a believable backstory to extract information or access. Usually combined with impersonation. The "I am calling from the vendor's billing team to confirm the wire routing change" line is pretexting wrapped around impersonation.
• Watering hole. Compromising a website the target group already trusts and visits. The attacker waits for the target to land on the infected page, then delivers the payload through a browser exploit or a drive-by download.
• Brand impersonation. Mimicking a known brand (logo, color, copy, layout) in a message or website to win trust. Often combines with typosquatting on the URL.
• Typosquatting. Registering a misspelled lookalike domain (revteck.com instead of revtek.com, microsoftsupport.com, netfllx-billing.com). The typo domain hosts the brand-impersonation page that uses pretexting to collect credentials.

Most modern attacks chain two or three of these together. A smishing text leads to a brand-impersonation page hosted on a typosquatted domain that uses pretexting to collect credentials. The vector chain is the attack.

Common gotchas

• Mixing up the message-based labels. Phishing is email by default. Vishing is voice. Smishing is SMS. Drill this until it is reflex.
• Treating default credentials as the same as weak credentials. Default credentials are factory values (admin/admin). Weak credentials are user-chosen but easy to guess (Password1, Summer2026). The exam asks both. They are not the same answer.
• Confusing misinformation and disinformation. The difference is intent, not impact. Both cause damage. Misinformation is honest mistakes. Disinformation is deliberate deception.
• Calling every social-engineering attack "phishing." Phishing is one technique. BEC, vishing, smishing, pretexting, impersonation, brand impersonation, watering hole, and typosquatting are all distinct. Some of them combine.
• Forgetting that supply chain includes MSPs. Many small organizations get hit through their MSP more often than through direct attack. The MSP is the vendor with the keys to the kingdom.
• Thinking image-based attacks are theoretical. They are not. PNGs with embedded JavaScript and EXIF-smuggled commands have shown up in real campaigns.
• Confusing client-based and agentless on the exam. Client-based means an installed agent on the endpoint, patched by pushing a new build. Agentless means no install on the endpoint, patched server-side. Both can be vulnerable.
• Calling watering hole "phishing." Watering hole is a compromised real site the target group already trusts. Phishing is an unsolicited message. The attacker did not push the message in a watering-hole attack. They waited for the target to arrive.

Real-world context

In a SOC (Security Operations Center) Tier 1 analyst seat, naming the vector is the first move on every ticket. A user clicks a link in their inbox and lands on a credential-harvesting page. The analyst notes "email phishing vector, message-based surface." A workstation EDR fires on a USB-mount event. The analyst notes "removable media vector, endpoint surface." A vendor IP starts touching internal systems at unusual hours. The analyst notes "potential supply chain vector, trusted-vendor channel."

Sample alert walkthrough. The SIEM fires "user signed in from a new device, MFA prompt approved at 02:14, password reset attempted at 02:18 from an IP in another country." The Tier 1 analyst pulls the email gateway log and finds a smishing text in the user's mailbox archive from earlier that day with a link to a brand-impersonation page. The page used a typosquatted domain that mimicked the company's identity provider. The user entered their password and approved the resulting MFA prompt thinking it was their own. Three vectors stacked: smishing, brand impersonation, typosquatting. The analyst writes the incident report, names all three, and recommends one control per vector (mobile-aware phishing simulation, look-alike domain monitoring, number-matching MFA).

The vector list also shows up in CISA advisories, MITRE ATT&CK Initial Access tactic (TA0001), FBI IC3 annual reports, and almost every cyber insurance application. Knowing the list cold is one of the cheapest ways to look like a serious analyst in an interview.

Sources

• CompTIA Security+ SY0-701 Exam Objectives, Section 2.2
• MITRE ATT&CK Initial Access tactic (TA0001) and its techniques
• NIST SP 800-115 Technical Guide to Information Security Testing and Assessment
• CISA Known Exploited Vulnerabilities (KEV) catalog
• FBI Internet Crime Complaint Center (IC3) annual Internet Crime Report
• University of Illinois USB drop study (2016) for removable-media context