A full 22% of your CompTIA Security+ (SY0-701) exam score is determined by Domain 2. Yet many candidates fail this section not because they don't know the threats, but because they can't correctly prioritize the response when multiple options seem right. They study a list of attacks, but the exam tests your judgment on mitigation.
The CompTIA Security+ Domain 2.0, "Threats, Vulnerabilities, and Mitigations," is 22% of the SY0-701 exam. It tests your ability to identify threat actors and attack vectors, analyze vulnerabilities using tools and scoring systems like CVSS, and select the most effective mitigation or control for a given scenario.
Key facts
- Exam Code
- SY0-701
- Domain Weight
- 22% of total exam score
- Official Body
- CompTIA
- Recommended Study
- 60-90 hours for the full exam
- Key Frameworks
- NIST SP 800-53 (Controls), 800-61 (Incident Handling), 800-37 (RMF)
- Average Salary
- $75,000-$125,000, varying by role, location, and experience (U.S. Bureau of Labor Statistics).
What Does Domain 2 Actually Test on the SY0-701 Exam?
Domain 2.0 tests your ability to think through the entire lifecycle of a security risk, from identifying a potential threat actor to implementing a specific, effective control. It's not about listing malware types. It's about connecting a specific threat to a specific weakness and then defending it logically.
The exam expects you to operate like a security analyst. You'll get a scenario: a strange log entry, a user's complaint, an alert from a monitoring tool. Your job is to diagnose the likely attack, identify the vulnerability being exploited, and choose the best course of action from a list of plausible options.
Studying for CompTIA Security+? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The Vulnerability Management Lifecycle
Success in this domain means understanding the formal process for handling vulnerabilities. The exam expects you to know these steps in order.
- Identification: Discovering vulnerabilities using scanners (like Nessus), penetration tests, or threat intelligence feeds.
- Assessment: Analyzing the discovered vulnerabilities to understand their risk and potential impact. This is where CVSS scores become critical.
- Prioritization: Deciding which vulnerabilities to fix first based on their CVSS score, asset criticality, and threat likelihood. You can't fix everything at once.
- Remediation: Applying patches, reconfiguring systems, or implementing other controls to fix the vulnerability.
- Verification: Scanning again to confirm the fix is effective and the vulnerability is gone.
This structured approach is a core concept tested in Domain 2.0.
Which Formulas and Frameworks Must I Know for Domain 2?
The exam requires you to quantify risk and understand the foundational frameworks that guide security decisions. You won't need a calculator, but you must know the formulas and what they represent.
Core Risk Calculation Formulas
These three concepts work together to put a dollar value on risk, which helps in prioritizing mitigations.
- Single Loss Expectancy (SLE): The total monetary loss for a single incident.
-
SLE = Asset Value (AV) × Exposure Factor (EF) - The
Exposure Factor (EF)is the percentage of the asset's value lost. - Annualized Rate of Occurrence (ARO): How many times the incident is expected to happen in one year.
- Annualized Loss Expectancy (ALE): The total expected monetary loss for that risk over one year.
-
ALE = SLE × ARO
- Calculate ARO:
1 incident ÷ 4 years = 0.25occurrences per year. - Calculate SLE:
$200,000 (AV) × 0.60 (EF) = $120,000. Each attack costs $120,000. - Calculate ALE:
$120,000 (SLE) × 0.25 (ARO) = $30,000.
The company can expect an annualized loss of $30,000 from this specific threat. This ALE figure justifies spending up to $30,000 per year on controls (like advanced endpoint protection and backups) to mitigate this risk.
Prioritizing with CVSS
The Common Vulnerability Scoring System (CVSS) provides a numerical score (0.0 to 10.0) representing the severity of a vulnerability. The exam expects you to know that a higher score indicates a more severe vulnerability, influencing its priority for patching. You don't need to calculate a score, but you need to know what it means and why it's used for prioritization.
Key Frameworks and Principles
- NIST Special Publications: Know the purpose of key documents.
- SP 800-53: A catalog of security and privacy controls.
- SP 800-61: The guide for computer security incident handling.
- SP 800-37: The Risk Management Framework (RMF).
- CIA Triad: The foundation of information security. Every control protects one of these.
- Confidentiality: Preventing unauthorized disclosure.
- Integrity: Ensuring data is not altered or destroyed.
- Availability: Ensuring timely and reliable access to data.
- Defense-in-Depth: Using multiple, layered security controls. The idea is that if one layer fails, another will stop the attack.
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What Is the Best Way to Match Mitigations to Attacks?
For the SY0-701 exam, you must quickly and accurately map a described attack to its most effective countermeasure. Start by classifying the threat, then recall the primary controls for that category. Try VoraPrep's adaptive practice questions to drill this skill.
| Attack Type | Primary Vulnerability Exploited | Key Mitigation Strategies |
|---|---|---|
| Phishing/Spear Phishing | Human trust; lack of awareness | User training, email filters, spam gateways, Multi-Factor Authentication (MFA) |
| Ransomware | Unpatched software; weak macro security | Patch management, application whitelisting, immutable backups, user least privilege |
| SQL Injection | Improper server-side input validation | Input validation, prepared statements (parameterized queries), Web Application Firewall (WAF) |
| DDoS | Network bandwidth; resource exhaustion | DDoS mitigation services, rate limiting, traffic scrubbing, load balancing |
| Cross-Site Scripting (XSS) | Improper output encoding on a website | Output encoding, Content Security Policy (CSP), input validation |
| Insider Threat | Excessive privileged access; lack of monitoring | Least privilege, separation of duties, mandatory vacations, User Behavior Analytics (UBA) |
What Common Traps Cause Candidates to Fail Domain 2?
The examiner knows the common ways candidates misapply concepts. They build questions specifically to catch these errors.
- Confusing Detection with Prevention: An Intrusion Detection System (IDS) detects a port scan. An Access Control List (ACL) on a firewall prevents it. If the question asks how to stop an attack, a detection-only control is the wrong answer.
- Overlooking Foundational Controls: Before choosing a fancy technical tool, look for a simpler, more fundamental answer. Often, "implementing least privilege" or "enforcing patch management" is the correct choice over a more complex solution.
- Ignoring Contextual Keywords: The question's wording is critical. "Initial response" demands a containment action. "Long-term strategy" points toward policy or training. "Most cost-effective" requires you to weigh the solution's price against the risk (ALE).
Are There Mnemonics for Domain 2 Concepts?
Mnemonics are excellent for recalling lists and categories under pressure.
- Social Engineering Principles (Cialdini):
- Scarcity
- Consensus (Social Proof)
- Authority
- Liking
- Urgency
- Reciprocity
- Mnemonic: "SCALUR" helps you remember these key influence tactics.
- Malware Categories (Grouped by Action):
- Virus (Attaches to a file)
- Worm (Self-propagates across networks)
- Trojan (Disguises as legitimate software)
- Mnemonic: Think "VWT" like a car model to group these classic types.
- Vulnerability Management Lifecycle:
- Identify
- Assess
- Prioritize
- Remediate
- Verify
- Mnemonic: "I Am Pretty Ready to Verify."
How Should I Use This Cheat Sheet to Study?
This guide is a force multiplier for your primary study plan, not a replacement for it.
- Before a Study Session: Read the Key Takeaways to prime your mind for the topics in Domain 2.
- During Lessons: When you're in VoraPrep's interactive lessons, use this sheet to connect concepts. When a lesson mentions a threat, find its mitigation in the table here. This builds the mental links the exam tests.
- After Practice Questions: This is the most important step. After a quiz in VoraPrep's adaptive practice bank, review every question you got wrong. Use the "Common Traps" section to diagnose why you chose the wrong answer. Our detailed rationales explain the logic, helping you think like the examiner.
- Weekly Drills: Turn the formulas, mnemonics, and lifecycle steps into spaced-repetition flashcards. A few minutes of active recall each day is far more effective than hours of passive re-reading.
- Final Mock Exam Review: Before taking a full, timed exam simulator, use this sheet for a final 15-minute review to lock in the most critical facts and formulas.