SY0-801 threats, vulnerabilities and attacks explained
Threats, Vulnerabilities, and Attacks is worth 24% of SY0-801, the second-largest domain. It has six objectives (2.1 to 2.6) and mostly asks you to recognise something from a short scenario: who the attacker is, how they arrived, what weakness they used, and what evidence shows it. The newest objective, 2.6, covers threats linked to artificial intelligence.
2.1 and 2.2 Threats, vulnerabilities and actors
Know threat feeds, likelihood and impact, intelligence sources and the threat life cycle. For vulnerabilities, learn CVSS (a severity score used to prioritise) and CVE (an identifier for a specific known flaw). They are often confused.
Threat actors in the objectives are organised crime, terrorist, unskilled attacker, hacktivist, insider, accidental/unintentional, competitor and state-sponsored. Motivations include financial gain, influence, intellectual property, notoriety, espionage, fear/chaos, extortion, curiosity, revenge, ideology and politics. Compare actors by internal or external position, resources and sophistication.
2.3 Vectors and 2.4 attack surfaces
Vectors are the routes in: message-based (email, SMS, RCS, collaboration tools), image-based (QR codes), file-based (macros, RTF, PDF), browser-based (extensions), network-based, endpoint-based, supply chain, removable media, human-based (impersonation, watering hole), IoT, OT, physical and signal-based (Bluetooth, RF, NFC).
Attack-surface items include unsupported, unpatched, obsolete and unmanaged systems; race conditions (time-of-check and time-of-use); hardcoded secrets; unsafe exception handling; stale credentials; rogue devices; shadow IT; large language models; identity providers; and misconfiguration such as public repositories and public object storage.
2.5 Indicators of malicious activity
| Group | Examples |
|---|---|
| Malware | Ransomware, trojan, worm, spyware, rootkit, keylogger, logic bomb, fileless malware |
| Physical | Tailgating, shoulder surfing, skimming |
| Network | DDoS, protocol downgrade, on-path, DNS cache poisoning |
| Social engineering | Smishing, vishing, phishing, whaling, spearphishing, quishing, deepfake |
| Application | Injection, buffer overflow, replay, directory traversal, privilege escalation |
| Credential | Password spraying, brute force, user enumeration, MFA bypass |
| Indicators | Impossible travel, concurrent sessions, account lockout, log manipulation, unusual resource use |
Password spraying tries one or two common passwords across many accounts to avoid lockout, whereas brute force hammers one account. This distinction is a reliable question.
2.6 AI threats
The objective lists model manipulation, poisoning, prompt injection, data loss, bias, explainability, hallucinations, jailbreaking, evasion, privacy, ethical considerations, session hijacking and code execution. Distinguish them by what is attacked: poisoning corrupts training data, prompt injection smuggles instructions into input, jailbreaking bypasses a model’s safety rules, evasion crafts input to avoid detection, and hallucination is a confident wrong output that needs no attacker. For a deeper specialism, see CompTIA SecAI+ CY0-001.
Example questions
Question 1. A support chatbot with access to customer records is asked to summarise a web page. Hidden text on the page tells it to reveal the last customer's details, and it does. Which threat is this?
- A. Model poisoning
- B. Prompt injection
- C. Hallucination
- D. Evasion
Show answer
Answer: B
Instructions hidden in content that the model processes are prompt injection. Poisoning corrupts training data, hallucination is a wrong output without an attacker, and evasion is crafting input to slip past a detector.
Want more questions like this? Full SY0-801 practice tests →
Question 2. A log shows one failed sign-in each for 400 different accounts, all using the password Summer2026!. Which attack is this?
- A. Brute force
- B. Replay
- C. Password spraying
- D. User enumeration
Show answer
Answer: C
Trying one common password against many accounts is password spraying, designed to stay below lockout thresholds. Brute force targets one account with many guesses, replay reuses captured data, and user enumeration discovers valid usernames.
Want more questions like this? Full SY0-801 practice tests →
Question 3. An employee with no ill intent uploads a confidential spreadsheet to a personal cloud account to work from home. How is this threat actor best classified?
- A. Unintentional insider
- B. Hacktivist
- C. State-sponsored actor
- D. Organized crime
Show answer
Answer: A
An insider who causes harm without malicious intent is an unintentional (accidental) insider. A hacktivist is ideologically motivated, a state-sponsored actor is backed by a government, and organized crime is financially motivated and external.
Want more questions like this? Full SY0-801 practice tests →
Revision tips
Build a two-column table of attack name and its single giveaway clue. For vectors, ask “how did it arrive?” before “what is it?”. Next, security architecture.