Security+
CompTIA Security+ SY0-801 / All lessons / Domain 2.0: Threats, Vulnerabilities, and Attacks
2Domain 2.0: Threats, Vulnerabilities, and Attacks
Security+ topic 2.3

Threat Vectors and Sources

A threat vector is the path an attacker uses to get in. Common vectors include email, text messages (smishing), voice calls (vishing), QR codes that lead to fake sites (quishing), files and images, removable media, vulnerable or unsupported software, unsecured Wi-Fi and Bluetooth, open ports, default credentials, and the supply chain of vendors and service providers. Human vectors use social engineering: phishing, pretexting with a made-up story, impersonation, watering hole attacks on sites the victims visit, typosquatting on look-alike domains, and business email compromise, where an attacker uses a real or spoofed executive account to request payments.

Picture ityourcompanyEmailSMSQR codeUSB driveWi-FiPhone callSupply chain
Common threat vectors. Each one is a path into the organization, and together they make up the attack surface.

Threat Vectors and Sources vocabulary

  • Threat vector: The path or method an attacker uses to get into a system.
  • Quishing: Phishing that uses a QR code to send victims to a malicious site.
  • Business email compromise (BEC): An attack that uses a hijacked or spoofed business email account to trick staff into sending money or data.
  • Watering hole attack: Infecting a website that the target group is known to visit.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Posters in a parking garage invite drivers to scan a QR code to pay. The code opens a fake payment page that collects card numbers.

1. Which of the following attacks is this?

  1. (A) Vishing
  2. (B) Quishing
  3. (C) Typosquatting
  4. (D) Pretexting
Show answer

(B) Quishing Phishing through a QR code is quishing.

2. An accounts payable clerk receives an email from the CFO's real account asking for an urgent wire transfer to a new vendor. The CFO's account had been taken over. Which of the following best describes this attack?

  1. (A) Business email compromise
  2. (B) Smishing
  3. (C) A watering hole attack
  4. (D) Credential stuffing
Show answer

(A) Business email compromise Using a compromised executive email account to request payments is business email compromise.

3. Attackers infect a popular industry forum that engineers at the target company visit every day. Which of the following is this?

  1. (A) Typosquatting
  2. (B) A watering hole attack
  3. (C) Vishing
  4. (D) Shoulder surfing
Show answer

(B) A watering hole attack Compromising a site the targets are known to visit is a watering hole attack.

4. Which of the following would best reduce a company's attack surface?

  1. (A) Adding more public-facing services
  2. (B) Disabling unused ports and services
  3. (C) Allowing personal USB drives
  4. (D) Keeping default passwords on printers
Show answer

(B) Disabling unused ports and services Removing unneeded services removes paths attackers could use.

Open 2.3 in the interactive course