Main exam topics
Threat actors and motivations; attack surfaces; phishing and social engineering; malware; network and application attacks; software, hardware, cloud and supply-chain vulnerabilities; indicators of attack; patching, isolation, segmentation and access controls.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Scenario summary
A suspicious support call uses urgency and impersonation to pressure an employee. Recognize social engineering in the scenario. Protect authentication information, report the request, and verify the caller through an approved contact rather than a number supplied by the caller.
Security+ practice scenario · Full concepts below
A threat is a potential cause of harm; a vulnerability is a weakness; risk considers likelihood and impact. Assess attacker motive, resources, and access before choosing appropriate defenses.
Key terms & acronyms
- Phishing
- Deceptive messages designed to steal information or trigger unsafe actions.
- Password spraying
- Trying a small set of passwords against many accounts.
- SQL injection
- Untrusted input is interpreted as database commands.
- Ransomware
- Malware that denies access, often by encrypting files and demanding payment.
Concepts at a glance
| Concept | Purpose | Example |
|---|---|---|
| Threat | Potential cause of harm | An attacker targeting a server |
| Vulnerability | A weakness | An unpatched internet-facing service |
| Risk | Likelihood and impact | Potential disruption or data loss |
| Mitigation | Reduce risk | Patch, isolate, or restrict access |
In the workplace
A support caller asks for an employee’s MFA code. The employee refuses, contacts support using a known number, and reports the message. For an exposed vulnerable server, the team restricts access until a patch is ready.
Common mistakes & scenario tips
Severity is not the only priority. Active exploitation, internet exposure and business impact matter. Parameterized queries prevent injection; changing DNS or increasing password length does not repair the input-handling flaw.