Domain 2, "Threats, Vulnerabilities, and Mitigations," makes up 22% of your total CompTIA Security+ exam score. Yet many candidates who fail make the same critical error: they spend weeks on flashcards memorizing malware types but freeze on the performance-based questions. The exam doesn't just ask you to define a rootkit; it asks you to identify its behavior in a log file and select the best mitigation from a list of plausible options. This guide teaches you how to make those judgment calls correctly.
The CompTIA Security+ "Threats, Vulnerabilities, and Mitigations" domain is the second of five sections on the SY0-701 exam, accounting for 22% of the total score. It tests your ability to analyze attack vectors, identify system vulnerabilities, recognize threat actor behaviors, and apply the most effective mitigation techniques in scenario-based questions.
Key facts
- Exam Section
- Domain 2.0 of 5
- Exam Code
- SY0-701
- Domain Weight
- 22%
- Key Topics
- Social engineering, malware, threat intelligence, application attacks, and vulnerability management
- Tested Skills
- Analysis, identification, and application of security controls
- Passing Score (Overall Exam)
- 750 on a scale of 100-900
CompTIA reports that the global pass rate for its exams, including Security+, is typically around 65-75%, highlighting the need for focused preparation on high-weight domains like this one.
How Is Domain 2 Tested on the Exam?
Questions from this domain are integrated throughout the exam, not presented as a separate block. You will encounter them in both traditional multiple-choice questions (MCQs) and the more complex performance-based questions (PBQs). The SY0-701 exam contains a maximum of 90 questions within a 90-minute time limit.
Studying for CompTIA Security+? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
MCQs in this domain often present a short scenario, testing your ability to quickly identify the attack, vulnerability, or correct control.
PBQs are where this domain gets challenging. You might be asked to:
- Drag and drop the correct mitigation technique to counter a list of specific threats.
- Analyze a network diagram and identify all the systems with a specific vulnerability.
- Review a short security log and identify the type of malware based on its behavior.
Success here depends on practice. At VoraPrep, our 1:1 exam simulators are calibrated to replicate the exact feel and logic of these complex PBQs, so you've built the muscle memory before exam day.
What Are the Key Topics in Domain 2?
The SY0-701 blueprint for Domain 2.0 is your roadmap. While you should cover everything, focus your energy on the concepts that appear most frequently and in the most complex scenarios.
Social Engineering Attacks
This is a huge area. You need to know the principles (authority, scarcity, consensus) and the specific attack types. Be ready to differentiate between them in a scenario.| Attack Type | Description | Key Differentiator |
|---|---|---|
| Phishing | A broad, impersonal campaign sent to many users. | Mass-email, generic greeting ("Dear Customer"). |
| Spear Phishing | A targeted attack on a specific individual or group. | Uses personal information (name, job title) to build trust. |
| Whaling | Spear phishing aimed specifically at senior executives. | Targets C-level executives (CEO, CFO). |
| Vishing | Voice phishing, conducted over the phone. | Uses VoIP or phone calls to trick the victim. |
Malware Types and Behaviors
Go beyond definitions. Understand the behavior of each type. A virus requires a host file. A worm self-propagates across a network. A Trojan masquerades as legitimate software. Ransomware encrypts files and demands payment. A rootkit hides its presence by modifying core system processes or APIs to evade detection, often maintaining persistent, privileged access.Application and Network Attacks
You need a solid grasp of common attacks. The exam expects you to know more than just the basics.- Application Attacks: SQL injection (SQLi), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), XML External Entity (XXE), Deserialization attacks, and various API attacks.
- Network Attacks: Denial-of-Service (DoS), Man-in-the-Middle (MITM), ARP poisoning, DNS poisoning, Pass the Hash, Replay attacks, and wireless attacks like Evil Twin or Rogue APs.
- Cryptographic Attacks: Downgrade attacks, Birthday attacks, Collision attacks, and Replay attacks are all fair game.
Threat Actors and Intelligence
Know the difference between an Advanced Persistent Threat (APT), a script kiddie, and a hacktivist. Understand their motivations (financial, political, notoriety) and capabilities. You must also differentiate sources of threat intelligence.Vulnerability Assessment and Management
Identifying threats is only half the battle. You must also know the process for finding weaknesses.- Vulnerability Scanning: Understand the difference between a non-credentialed scan (which sees the system as an external attacker would) and a credentialed scan (which logs in to see missing patches and misconfigurations).
- Penetration Testing: Know the different types: black-box (no prior knowledge), white-box (full knowledge of the environment), and gray-box (some knowledge).
- Other Techniques: Be familiar with security audits, code reviews, and fuzzing (providing invalid or random data to an application to find flaws).
Quantitative Risk Assessment
This is a smaller but critical topic where candidates often lose easy points. You must know how to calculate risk financially.Step 1: Calculate the Single Loss Expectancy (SLE)
The SLE is the financial loss from a single incident.- Formula: SLE = Asset Value (AV) × Exposure Factor (EF)
- Calculation: SLE = $200,000 × 0.25 = $50,000
Step 2: Calculate the Annualized Rate of Occurrence (ARO)
The ARO is how many times the incident is expected to happen per year.- Calculation: If it happens once every four years, the ARO is 1 ÷ 4 = 0.25
Step 3: Calculate the Annualized Loss Expectancy (ALE)
The ALE is the total expected financial loss over one year.- Formula: ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)
- Calculation: ALE = $50,000 × 0.25 = $12,500
The company should expect an average annual loss of $12,500 from this specific threat. This number helps them decide whether a security control that costs $10,000 per year is a worthwhile investment. The exam will test this exact logic.
For a deeper dive into these topics, our Security+ cheat sheet for Domain 2 is an essential resource.
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What's the Most Effective Way to Study for Domain 2?
A passive approach will not work for this domain. Watching video lectures and re-reading a textbook is insufficient for the judgment-based questions you'll face. You need an active, targeted study plan.
Here is a proven weekly schedule for a working professional:
- Monday (Learn): Dedicate 60-90 minutes to one major topic using VoraPrep's interactive lessons. For example, focus on "Malware Types." Our lessons are step-by-step guides with built-in comprehension checks to ensure you're actively learning.
- Tuesday (Practice): Spend 45 minutes on a targeted quiz of 25-30 practice questions on Monday's topic. VoraPrep's adaptive engine will automatically surface questions related to malware. For every question, read the detailed explanation for the right and wrong answers.
- Wednesday (Reinforce): Use VoraPrep's FSRS spaced-repetition flashcards for 20-30 minutes. Focus on the key terms and concepts from the week's topic. This system schedules cards based on your memory patterns, improving long-term retention.
- Thursday (Repeat): Pick the next topic from the blueprint, for example, "Social Engineering Attacks," and repeat the process from Monday.
- Friday (Synthesize): Take a 50-question mixed quiz covering all topics from the week. This forces your brain to switch contexts, just like on the real exam. Review your weak areas flagged by the performance analytics.
- Weekend (Review & Simulate): Spend one hour reviewing your weakest areas from the week. If you're struggling to differentiate attack types, ask Vory, your 24/7 personal tutor, for more examples or a simpler explanation.
This active-recall-based method is more effective than passive video lectures. You can see the VoraPrep method in action with this free sampler of Security+ practice questions.
What Common Mistakes Cause Candidates to Fail This Domain?
The difference between a 740 and a passing 750 often comes down to avoiding a few common errors.
- Mistake 1: Memorizing Lists Instead of Behaviors. Many candidates can list 10 types of viruses but can't explain what makes a polymorphic virus different from an armored virus in practice. The exam tests the "in practice" part. Instead of just memorizing "worm," think "self-propagating, no host needed, consumes network bandwidth."
- Mistake 2: Ignoring the "Mitigation" Part. This domain isn't just about identifying threats. It's about solving the problem. For every attack you learn, you must learn the primary mitigation. For SQL injection, it's input validation and parameterized queries. For phishing, it's user training and email filtering. Always ask, "How do I stop this?"
- Mistake 3: Confusing Related Concepts. The exam loves to test your precision. Do you know the difference between a threat, a vulnerability, and a risk?
- Vulnerability: A weakness (e.g., an unpatched server).
- Threat: An actor or event that can exploit the weakness (e.g., a hacker running a script).
- Risk: The likelihood of the threat exploiting the vulnerability and the resulting impact.
Candidates who use these terms interchangeably on exam day will lose points.
How Important Is Domain 2 to Your Passing Score?
At 22% of the exam, your performance in this domain is critical. You cannot pass the SY0-701 if you perform poorly on these topics. A strong performance here provides a significant buffer for tougher questions in other domains.
The passing score of 750 is not a percentage. It is a scaled score, and questions are weighted differently. This means mastering the heavily-weighted concepts in this domain has an outsized impact on your final result. Our analysis of student data shows that the nuances of application attacks and identifying threat actor TTPs (Tactics, Techniques, and Procedures) are common weak points. For a broader perspective on the exam's challenge, see our breakdown of Security+ exam difficulty.
What Are the Best Study Resources for Domain 2 in 2026?
Choosing the right study tool is the most important decision you'll make. Many candidates default to expensive, outdated video lecture bundles and find themselves disengaged and unprepared for the exam's scenario-based questions.
| Feature | VoraPrep Security+ Course | Traditional Video Courses |
|---|---|---|
| Learning Method | Interactive text lessons with active-recall checks | Passive video lectures (100+ hours) |
| Practice | 1,500+ adaptive questions with detailed rationales | Static question bank, often with shallow explanations |
| Simulation | 1:1 timed exam simulator with realistic PBQs | Basic quiz tools, limited PBQ practice |
| Support | Vory, your 24/7 personal tutor for any question | Email support with 24-48 hour response times |
| Study Plan | Personalized, dynamic calendar based on your exam date | Generic, fixed "watch these videos" schedule |
| Price | $25/month or $199/year | $1,500 - $3,500 |
VoraPrep is designed for busy professionals who need to study efficiently. Our complete 6-pillar course provides everything you need to pass, including textbook-grade interactive lessons, thousands of adaptive practice questions, FSRS flashcards, a personalized study planner, 1:1 exam simulations, and instant help from Vory, your 24/7 personal tutor.