Home / Flashcard library / Careers & certifications / CompTIA Security+ (SY0-801) / Threats, Vulnerabilities & Attacks

Careers & certifications

CompTIA Security+ (SY0-801) — Threats, Vulnerabilities & Attacks flashcards

10 of 80 cards free to study here · 5 topics · the whole deck is built into Willys

SY0-801 domain 2 as scenario questions: threat intelligence, CVSS and actors, threat vectors from messages to signals, vulnerabilities and attack surfaces, indicators of malware, physical, network, application, credential and social engineering attacks, and threats to and from AI.

Get the app All CompTIA Security+ (SY0-801) decks

Learn deck · part of CompTIA Security+ (SY0-801) · written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list
  1. A SOC wants indicators from three places: a paid vendor feed, public blogs and repositories, and peers in its own industry. What is each source called?
    Commercial (proprietary) feed, open-source intelligence (OSINT), and an ISAC.

    A threat feed delivers indicators such as bad IPs, domains and hashes in a steady stream; an Information Sharing and Analysis Center pools intelligence among organizations in one sector.

    Watch out: raw feed data only becomes intelligence once it is vetted and given context.
    Threats & Threat Actors
  2. Two threats are assessed: one is almost certain but would cause minor disruption; the other is rare but would halt production for weeks. Which two factors is the analyst weighing to rank them?
    Likelihood and impact.

    Risk from a threat is judged by how probable the event is and how much harm it would do if it happened, so a rare but severe threat can outrank a frequent, trivial one.
    Threats & Threat Actors
  3. An intruder gets in through a phishing email, then a VPN flaw, then a stolen badge, and adapts each time defenders react, staying for over a year. What kind of threat is this?
    An advanced persistent threat (APT).

    An APT combines high skill, ample resources and multiple vectors to keep a long-term foothold, usually to exfiltrate data steadily, and it changes tactics when it is detected.
    Threat Vectors
  4. An attacker posing as the help desk messages staff in the company's chat platform and asks them to approve a sign-in prompt. Why is this vector so effective?
    It arrives through a trusted collaboration tool: staff trust internal chat, and email filtering usually does not cover it.

    This is a message-based vector, and SMS, RCS and instant messaging carry the same risk. Verify unexpected requests through a known channel and never approve a sign-in you did not start.
    Threat Vectors
  5. What separates an unpatched system from an unsupported one?
    An unpatched system has a fix waiting; an unsupported one will never get another fix.

    Unpatched is solved by applying updates. Unsupported or obsolete products past end-of-life need isolation and compensating controls until they are replaced.
    Attack Surfaces
  6. An old lab PC was never enrolled in endpoint management, so it receives no updates and sends no logs. Which kind of vulnerability is it?
    An unmanaged system.

    Nobody patches, monitors or inventories it, so its flaws go unseen. An accurate asset inventory and network access control that blocks unenrolled devices help.
    Attack Surfaces
  7. What separates a worm, a virus and a Trojan?
    A worm spreads by itself; a virus needs a user to run its host file; a Trojan poses as useful software.

    Worms exploit flaws on reachable systems with no user action. A Trojan does not copy itself at all; a remote access Trojan hands the attacker control.
    Indicators & Attacks
  8. All of a user's files now carry an odd extension and a note demands cryptocurrency. What is the malware, and what is the best recovery path?
    Ransomware; restore from offline, tested backups.

    Backups the malware cannot reach let you recover without paying, and paying guarantees neither working decryption nor that stolen data stays private.
    Indicators & Attacks
  9. An attacker slips images carrying a small sticker pattern into a model's training set, labeled as an authorized class. Later, anything wearing the sticker is accepted. What attack is this?
    Data poisoning that plants a backdoor.

    The model behaves normally until it sees the trigger, which makes the backdoor hard to find in testing. Vet training data sources and track their provenance.
    AI Threats
  10. A team downloads a pretrained model from a public hub whose weights were quietly altered to misbehave on certain inputs. How does this differ from data poisoning?
    It is model manipulation: the model itself was tampered with, not its training data.

    NIST calls this model poisoning; altered weights or a doctored fine-tune can carry hidden behavior. Get models from trusted sources and check their integrity with signatures or hashes.
    AI Threats

Unlock the whole deck

You are studying a free 10-card sample. All 80 cards of CompTIA Security+ (SY0-801) — Threats, Vulnerabilities & Attacks, the other 7 CompTIA Security+ (SY0-801) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More CompTIA Security+ (SY0-801) decks

General Security ConceptsSecurity ArchitectureControls & MonitoringIdentity, Automation & ResponseProgram Management & OversightCloze: AcronymsPractice Questions

← All CompTIA Security+ (SY0-801) decks, with the study guide and topic outline.

About these cards

Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.

Checked against:

  • Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
  • Checked against the OWASP Cheat Sheet Series and OWASP community attack pages (CC BY-SA 4.0; reference only; no text copied).
  • Checked against the OWASP Top 10 for LLM Applications 2025 (CC BY-SA 4.0; reference only; no text copied).
  • Checked against NIST AI 100-2 E2025 (adversarial machine learning taxonomy) and NIST AI 100-1 (AI RMF 1.0) (public domain; reference only).
  • Checked against NIST SP 800-150, SP 800-30 Rev. 1 and SP 800-63B-4 (public domain; reference only) for threat intelligence, risk factors and authentication defenses.
  • Checked against MITRE ATT&CK Enterprise and Mobile techniques and tactics (reference only; no text copied).
  • Checked against FIRST CVSS v4.0 and EPSS, the CVE Program, MITRE CWE and the NIST NVD (reference only; no text copied).
  • Checked against CISA advisories and guidance: the KEV catalog, #StopRansomware Guide, living off the land and OT mitigation guidance, ED 19-01 and insider threat definitions (reference only).
  • Checked against IETF RFC 8446, RFC 8996 and RFC 4033 (reference only).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.