Malware and indicators
Domain 2: Threats, Vulnerabilities & Mitigations · Not started
Main exam topics
Threat actors and motivations; attack surfaces; phishing and social engineering; malware; network and application attacks; software, hardware, cloud and supply-chain vulnerabilities; indicators of attack; patching, isolation, segmentation and access controls.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Malware families
Ransomware encrypts data and demands payment. A trojan disguises itself as legitimate software. A worm spreads by itself across networks without user action. Spyware and keyloggers collect information. A rootkit hides deep in the system to keep privileged access. A logic bomb waits for a condition, such as a date or a deleted user account, before executing.
Indicators of compromise
Watch for account lockouts, impossible travel logins, unusual outbound traffic, resource consumption spikes, missing logs, and blocked content. Concurrent sessions from distant locations suggest stolen credentials. Encrypted files with new extensions and ransom notes clearly indicate ransomware.
Mitigations
Use endpoint detection and response, application allow lists, least privilege, timely patching, and tested offline backups. Segmentation slows worms. When malware is found, isolate the host first to contain spread while preserving evidence.
Know the difference: Virus vs. worm
| Aspect | Virus | Worm |
|---|---|---|
| Spread | Needs user action or host file | Self-propagates |
| Speed | Slower | Can spread very fast |
| Key mitigation | Anti-malware, user caution | Patching, segmentation |
Saved