Vulnerabilities, IoCs, and Mitigations: Domain 2 as a Decision Tree

Domain 2 — Threats, Vulnerabilities, and Mitigations — rewards candidates who can run through three questions in one breath: what broke, what the attacker did next, and which control actually closes the gap. Memorizing CVE headlines will not carry you through scenario questions. What carries you is a repeatable mental model: name the vulnerability class first, read the IoC signals the stem drops, then match a mitigation to the failure mode — not to whatever sounds most expensive.

Web and application vulnerabilities — the trust boundary story

The web vulnerability taxonomy feels like a list worth memorizing in isolation. It is actually a story about where a developer forgot to enforce a trust boundary. OWASP has catalogued these patterns for decades; Security+ borrows the same logic.

Start with SQL injection. A web form accepts user input. The developer builds a query by concatenating that input directly into a SQL string. The attacker types a fragment that closes the legitimate query and opens a new one — database records pour out, get modified, or get deleted. The primary mitigation is parameterized queries, backed by least-privilege database accounts and input validation. A WAF is a compensating layer, not the fix. When an exam stem says "disable error messages" as the primary SQLi remedy, that is a distractor — error suppression reduces information leakage but does not remove the injection flaw.

Cross-site scripting (XSS) lives one trust boundary higher. The attacker's input gets stored or reflected and later executes in another user's browser context. The fix is output encoding — treat user-supplied content as text to display, not markup to render — backed by Content Security Policy headers.

CSRF exploits an authenticated session: the victim's browser sends an attacker-crafted request automatically, riding an existing cookie. CSRF tokens and SameSite cookie attributes break the exploit. SSRF lets an attacker point the server's outbound fetcher at internal resources — the AWS instance metadata endpoint being the canonical cloud example — so restrict server-side outbound requests to known-safe destinations and deny access to internal IP ranges. Directory traversal reaches files outside the intended directory through unsanitized path input; path canonicalization and strict allowlisting close it.

OS, firmware, and the supply chain underneath

End-of-life operating systems create surface that patches will never close. A hospital imaging workstation running Windows Server 2012 R2 because the vendor has not recertified a newer OS represents a legacy OS vulnerability where the vendor relationship constrains your options. The strong answer on the exam combines segmentation onto an isolated VLAN, virtual patching via IPS signatures, strict access controls, and a documented vendor remediation timeline — not "patch tonight" when the stem explicitly forbids it.

Supply chain attacks sit a layer below all of that. SolarWinds and poisoned npm packages both represent a trust failure in the provisioning path, not phishing — the attacker compromises the supplier before the target touches anything malicious. IoCs in a compromised CI pipeline scenario include unexpected outbound connections from build agents and DNS queries to newly registered domains. Mitigations point toward dependency pinning, software composition analysis, signature and hash verification at install time, staged deployment rings, and rollback images ready to deploy. Labeling every third-party compromise "phishing" is the exam trap; phishing is a delivery mechanism, supply chain is a different failure class.

Cloud misconfigurations — the quiet giant

Cloud misconfiguration is so prevalent that CompTIA treats it as a recurring theme, not an edge case. The attacker does not need a zero-day when the S3 bucket has public ACLs or the security group allows SSH from the entire internet.

When a stem says "backup files world-readable in object storage," the vulnerability class is misconfiguration, not a novel exploit. Remove public access and add CSPM to catch the next drift before a researcher finds it.

DoS, DDoS, and the three shapes of flood

Denial-of-service stems require you to distinguish what is being exhausted. A volumetric attack — UDP flood, DNS amplification, NTP reflection — saturates bandwidth; the target's pipe fills with garbage before a packet reaches the application. A protocol attack such as a SYN flood exhausts connection-state tables in firewalls and load balancers — the infrastructure runs out of session slots, not bandwidth. An application-layer attack — HTTP flood, Slowloris — overwhelms compute threads with requests that look legitimate to network gear. Mitigations shift accordingly: CDN and upstream scrubbing for volumetric; SYN cookies and rate limiting for protocol; WAF rules and request throttling for application-layer.

Wireless threats in narrative — evil twin and deauth

The wireless threat stack on Security+ concentrates on two attack shapes worth knowing as a story, not as vocabulary to recite.

An evil twin access point mimics a legitimate SSID — same name, higher signal power, sometimes a cloned BSSID — and devices configured for auto-connect join it without prompting. The attacker becomes the on-path intermediary. Detection lives in RF monitoring and a WIDS. Prevention lives in certificate-based 802.1X authentication: the client validates the AP's identity against a known certificate before committing credentials, making an evil twin impersonation visible as a certificate mismatch rather than an invisible join.

A deauthentication attack abuses an unprotected 802.11 management frame to forcibly disconnect clients from a legitimate AP, then offers an evil twin at higher power so the deauthed clients reconnect to the wrong network. The architectural answer is Management Frame Protection (802.11w), which authenticates those frames so spoofed ones are discarded. Pairing deauth with MFP as the mitigation demonstrates mechanism understanding, not just vocabulary.

Malware as functional taxonomy

Malware questions on SY0-701 are functional — know what each type does and what IoC points at it, not variant names.

Password attacks have their own sub-taxonomy. Password spraying fires one common password across thousands of accounts — it stays below per-account lockout thresholds and produces a horizontal pattern of many accounts with one failure each. Credential stuffing replays breach-list pairs against new targets, counting on password reuse. Brute force hammers one account repeatedly. Spraying looks like horizontal spread; stuffing looks like known-bad credentials from unusual geographies; brute force shows vertical depth on a single account.

IoCs as operational signals — reading what the stem drops

An indicator of compromise is evidence an intrusion may have occurred — and Security+ tests whether you can read operational signals, not whether you can recite file hash formats.

On the identity and access side, a spike in account lockouts scattered across many users from a single source IP is a classic spraying signature. Impossible travel — the same account authenticating from London and São Paulo forty minutes apart — is a high-fidelity signal of a replayed session or token. New service accounts created outside business hours with administrative rights were not created by a legitimate joiner workflow; that is a persistence mechanism taking root.

On the network side, DNS beaconing — regular short queries to young or algorithmically generated domains at fixed intervals — is command-and-control traffic trying to blend into background noise. SMB traffic at 2 AM pushing data toward endpoints that do not normally receive it points toward lateral movement or staged exfiltration. CPU and bandwidth spikes on servers that should be idle overnight suggest cryptomining or an involuntary DDoS participant.

Logging anomalies deserve their own recognition. Out-of-cycle log deletions — an admin cleaning logs at 11 PM on a Friday after an incident — are not routine housekeeping. A SIEM going unexpectedly quiet because a log forwarder was disabled is itself an IoC. The absence of expected audit entries when peer systems still log normally is a cover-up signal. When an exam stem asks what to investigate first, the strong answer values correlated signals over any single data point: one failed login is noise, a spray pattern across fifty accounts followed by one successful authentication in accounting is an incident.

Worked example: Finance users report slow file shares on Monday morning. Monitoring shows elevated SMB traffic overnight, hundreds of files renamed with a new extension, and a service account calling vssadmin delete shadows. Those three signals together are ransomware — not a failing SAN. Weak: restart the file server and open a performance ticket. Strong: isolate affected hosts, identify blast radius through SIEM, invoke the IR plan, and begin restoring from the last clean offline backup.

Mitigations mapped to failure modes

Every mitigation should answer one question: what property of the system failed? Encrypting data at rest does not prevent a SQLi query running with read rights. A strong password policy alone does not stop credential stuffing against users who reused a breached password elsewhere.

Patch management nuance worth knowing: a CVSS score of 7.2 on a server that is not internet-facing and runs the vulnerable service only on an isolated internal segment ranks below a CVSS 6.8 on an internet-facing host running the same service with no compensating control. Asset exposure and business criticality drive priority, not raw score.

Scenario drills — Weak and Strong named out loud

Web app exposes other users' orders. A customer portal returns another user's order history when the order_id parameter is changed in the URL. The vulnerability class is insecure direct object reference — an authorization failure at the application layer. Weak: add a WAF rule to block numeric enumeration. Strong: enforce server-side authorization on every request verifying that the requesting session owns the resource, log enumeration patterns, and use WAF rate limiting as a supplement — not a substitute.

Vendor update triggers C2 traffic. Multiple firms install the same vendor patch on Tuesday. By Wednesday, identical beaconing appears from those hosts across unrelated organizations. Weak: re-run antivirus. Strong: verify the update hash against the vendor-published manifest, isolate affected hosts, block the C2 destination, coordinate with the vendor and sector ISAC, and roll back to the pre-update image.

Evil twin appears on the corporate floor. A rogue AP broadcasts the same SSID at higher power; employee laptops auto-connect. Weak: ask IT to monitor the wireless logs. Strong: deploy 802.1X certificate-based authentication so clients validate the AP identity, enable a WIDS to alert on rogue BSSIDs, and enforce Management Frame Protection to prevent deauthentication-assisted takeover.

Exam traps summary

Closing

Domain 2 stops feeling like a catalog of horrors when you train the three-part reflex: name the vulnerability class, read the IoC signals the stem plants, then match a mitigation to the failure mode. Whether the scenario describes a misconfigured bucket, a poisoned dependency, or ransomware on Monday morning, the mental arc is the same — name it, read the signals, fix the right thing.

Companion reading: the Security Controls, CIA, and AAA post for the grammar of control categories and types. The Security Architecture post covers how segmentation and Zero Trust shrink blast radius when a vulnerability is exploited before the patch arrives.