Domain 2: Threats, Vulnerabilities & Mitigations

Why This Domain Matters

Domain 2 is the largest pure-study domain on the exam (22%) and the one a SOC analyst draws on every single shift: it's the taxonomy behind every endpoint alert, every phishing report, and every "why did this account lock out" ticket.

Where Domain 1 gives the vocabulary, Domain 2 gives the actual catalogue of things that go wrong — who does it (2.1), how they get in (2.2), what they exploit (2.3), what it looks like when it happens (2.4), and what to do about it (2.5).

Read it as one continuous story: actor → vector → vulnerability → indicator → mitigation.

Objective-by-Objective Breakdown

2.1 Threat Actors & Motivations

The exam separates who (actor type) from why (motivation) from attributes (how capable/resourced they are) — a stem can test any of the three independently.

2.2 Threat Vectors & Attack Surfaces

A vector is the specific path an attack travels; the attack surface is the sum of everywhere it could enter. The exam groups vectors into technical categories and a separate human/social-engineering category.

Human vectors / social engineering — the exam's favourite exploitable "vulnerability" is always the human:

• Phishing — broad, email-based deception to harvest credentials or deliver malware.
• Vishing — voice-call phishing.
• Smishing — SMS-based phishing.
• Misinformation/disinformation — false information spread (misinformation = spread without intent to deceive; disinformation = deliberately fabricated and spread to deceive — see Confusables).
• Impersonation — pretending to be a trusted person to manipulate a target.
• Business email compromise (BEC) — compromising or spoofing a business email account (often executive) to induce fraudulent transfers or data disclosure.
• Pretexting — inventing a fabricated scenario/identity to extract information (often the mechanism underneath impersonation or vishing).
• Watering hole — compromising a website the target population is known to visit, waiting for victims to come to the trap rather than pushing the attack out.
• Brand impersonation — mimicking a trusted brand's look/domain/communications.
• Typosquatting — registering a misspelled or lookalike domain to catch mistyped URLs.

2.3 Vulnerability Types

Vulnerabilities are grouped by where the weakness lives.

OS-based: unpatched or misconfigured operating systems exposing known flaws.

Web-based: SQL injection (unsanitised input alters a backend database query, can read/modify/delete data it shouldn't), cross-site scripting (XSS) (malicious script injected into a trusted web page, executed in the victim's browser context — see Confusables for the CSRF distinction).

Virtualization: VM escape (code in a guest VM breaks out to affect the host or other VMs — a hypervisor-boundary failure), resource reuse (data remnants from one VM/tenant improperly exposed to the next tenant reusing the same physical resource).

Supply chain: service provider, hardware provider, software provider — risk inherited from any third party in the delivery chain (distinct from 2.2's supply-chain vector: 2.3 is the vulnerability that exists because of that dependency).

Cryptographic: weak algorithms, poor key management, or implementation flaws that undermine confidentiality/integrity guarantees.

Misconfiguration: default settings, excessive permissions, or unhardened services left as-is — the most common and most preventable vulnerability class.

Mobile device: side loading (installing apps from outside the official app store, bypassing vetting), jailbreaking (removing OS-imposed restrictions, eliminating vendor security controls).

Zero-day: a vulnerability unknown to the vendor (no patch exists) — distinct from an unpatched known vulnerability, which just hasn't been remediated yet.

2.4 Indicators of Malicious Activity

This objective is a direct map to what actually populates your Defender for Endpoint alert queue.

Network attacks: DDoS — amplified (a small request to a third-party service generates a disproportionately large response directed at the victim, e.g.

DNS amplification) vs. reflected (the attacker spoofs the victim's source IP so replies are reflected onto the victim — amplification and reflection are usually combined, but the exam can test either property alone; see Confusables).

DNS attacks (poisoning, hijacking — corrupting or redirecting the name-to-address lookup so victims are sent to malicious infrastructure while typing the correct address). Wireless attacks (rogue APs, deauthentication).

On-path (attacker positions between two communicating parties to intercept/alter traffic — the modern term for "man-in-the-middle"). Credential replay (captured valid credentials/tokens reused to gain access without cracking them). Malicious code (generic execution of attacker-supplied code across any of the above).

Password attacks: spraying (one or a few common passwords tried across many accounts, staying under per-account lockout thresholds), brute force (many/all possible passwords tried against one account or hash — see Confusables).

2.5 Mitigation Techniques

Mitigations map roughly one-to-one against the vectors/vulnerabilities above, and several are literally your day job.

Segmentation — isolating networks/systems to limit lateral movement (VLANs on the network side; Conditional Access location/device-based scoping in your environment). Access control — ACLs (rule-based traffic/resource filtering) and permissions (least-privilege file/system rights).

Application allow list — only explicitly approved software may run, blocking everything else by default (stronger than a blocklist, which only blocks known-bad). Isolation — separating a compromised or high-risk system/segment from the rest of the environment.

Patching — applying vendor updates to close known vulnerabilities (the direct answer to unpatched OS/application vulnerabilities from 2.3). Encryption — protecting data confidentiality at rest/in transit (ties back to Domain 1's cryptographic solutions).

Monitoring — ongoing observation (log review, EDR/XDR alerting) to catch the indicators in 2.4. Least privilege — granting only the minimum access necessary — the direct mitigation for privilege escalation and insider-threat blast radius.

Configuration enforcement — ensuring systems stay compliant with a defined secure baseline (Intune compliance policies are configuration enforcement in production). Decommissioning — properly retiring end-of-life/legacy systems rather than leaving them running unsupported.

Acronym Table

Drills: 20 flashcards + 10 exam-realistic questions, at the end of this page.