Threat actors and motivations
Domain 2: Threats, Vulnerabilities & Mitigations · Not started
Main exam topics
Threat actors and motivations; attack surfaces; phishing and social engineering; malware; network and application attacks; software, hardware, cloud and supply-chain vulnerabilities; indicators of attack; patching, isolation, segmentation and access controls.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Common actors
Nation-state actors are well funded and patient, often pursuing espionage or disruption through advanced persistent threats. Organized crime is driven by money, using ransomware and fraud. Hacktivists pursue political or social causes, often through defacement or leaks. Unskilled attackers use existing tools with little understanding. Insider threats already have legitimate access, which makes them hard to detect. Shadow IT is staff using unapproved services, creating risk without malicious intent.
Attributes to compare
Questions often contrast actors by internal versus external position, level of resources and funding, and sophistication. A long, quiet intrusion against a defense contractor suggests a nation-state. A loud website defacement with a political message suggests a hacktivist. A sudden encryption demand for cryptocurrency suggests organized crime.
Motivations
Typical motivations include financial gain, espionage, revenge, disruption, ideology, and blackmail. Matching motivation to actor is one of the fastest ways to eliminate distractors.
Saved