Network and Wireless Attacks

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Network and Wireless Attacks

Key Takeaways Explain This Topic AI

Network attacks fail a trust assumption: traffic redirection, name resolution, address identity, availability, or a wireless trust boundary.

On-path (man-in-the-middle) attacks intercept or alter traffic between parties; spoofing forges a trusted IP, MAC, or identity.

DoS and DDoS exhaust a resource - bandwidth (volumetric), state tables (protocol), or application logic - and mitigation must sit at or before the exhausted point.

Wireless attacks include evil twin, rogue AP, deauthentication, jamming, and WPS abuse; WPA3 and 802.1X harden access.

Mitigations include segmentation, DNSSEC, dynamic ARP inspection, DHCP snooping, port security, secure protocols, and upstream DDoS scrubbing.

Last updated: June 2026

Ask What Trust Failed

Network-attack questions are really asking which trust assumption broke. Did the attacker redirect traffic, impersonate a system, flood a service, weaken wireless access, or trick name resolution ? Identify that first, then the mitigation usually follows.

Attack What happens Typical clue Mitigation

On-path (MITM) Attacker intercepts traffic between parties Certificate warning, altered traffic TLS validation, VPN, secure switching

ARP poisoning Attacker maps their MAC to another's IP Gateway MAC changes; local LAN only Dynamic ARP inspection, static entries for critical hosts

DNS poisoning Name resolves to a malicious address Correct URL, wrong destination IP DNSSEC, trusted resolvers, cache flushing

IP / MAC spoofing Attacker forges an address identity Traffic from impossible or duplicate address ACLs, DHCP snooping, port security

DoS / DDoS Service exhausted or unreachable Traffic flood, resource saturation Rate limiting, CDN/scrubbing, autoscaling

• Replay Captured valid data is resent Duplicate valid request or token Nonces, timestamps, session protection
• SSL stripping HTTPS downgraded to HTTP Sensitive site loads over HTTP HSTS, secure cookies, awareness

VLAN hopping Attacker reaches another VLAN Unexpected cross-VLAN traffic Disable trunking on access ports, harden native VLAN

Wireless Attack Map

A key distinction the exam loves: a rogue access point is unauthorized infrastructure plugged into your network, while an evil twin impersonates a known SSID to lure clients - same name, attacker's hardware.

• Wireless attack Description Defense
• Evil twin Fake AP broadcasts a legitimate SSID 802.1X with certificates, user verification
• Rogue AP Unauthorized AP attached to the LAN Wireless scanning, NAC, switch port control
• Deauthentication Forged frames knock clients off Wi-Fi WPA3 / 802.11w management-frame protection
• Jamming RF interference disrupts the band Spectrum analysis, channel planning, physical response
• Bluejacking Unsolicited Bluetooth messages Disable discovery, awareness
• Bluesnarfing Unauthorized Bluetooth data theft Patch devices, disable unused Bluetooth
• WPS PIN attack Weak 8-digit WPS PIN brute-forced Disable WPS entirely

Note that WPA3 adds SAE (Simultaneous Authentication of Equals) to resist the offline dictionary attacks that WPA2's 4-way handshake allowed, and mandates management-frame protection that blunts deauthentication.

Worked Example: Name Resolution

A user types the correct banking URL but lands on a convincing fake. The certificate is invalid, and the DNS cache shows the bank's domain resolving to an unfamiliar IP. That points to DNS poisoning or local hosts-file tampering, not a password attack. The right response: flush the poisoned entry, verify resolver integrity, check the endpoint for compromise, and enforce DNSSEC or a trusted/encrypted resolver.

Worked Example: DDoS Triage

Mitigation depends entirely on where the resource is exhausted. A local firewall cannot help if the circuit is saturated before traffic ever reaches it.

• Symptom Likely DDoS layer Response
• Upstream link saturated Volumetric (Layer 3/4) Provider scrubbing or CDN absorption
• Firewall state table full Protocol / state exhaustion SYN cookies, rate limits, upstream filtering
• Web CPU spikes from expensive searches Application (Layer 7) WAF rules, caching, request rate limits
• Common Traps

Trap Better exam reasoning

"Use encryption" for every network attack Encryption aids confidentiality/integrity but does nothing against flooding or jamming

Confuse rogue AP and evil twin Rogue AP is unauthorized infrastructure; evil twin impersonates a known SSID

Treat jamming as an authentication failure Jamming is RF interference, needing spectrum or physical investigation

• Place DDoS mitigation behind the bottleneck Filtering must occur at or before the exhausted resource
• Layer-2 and Routing Trust Failures

Many SY0-701 network questions live at Layer 2, where there is little built-in trust. An attacker on the local segment can forge ARP replies, exhaust the DHCP pool, or flood the switch CAM table. Knowing the matching switch hardening control is exactly what the exam rewards.

• Local attack Effect Switch/control mitigation
• MAC flooding CAM table overflows; switch fails open and floods all ports Port security, limit MACs per port
• ARP poisoning Redirects traffic by forging IP-to-MAC mappings Dynamic ARP inspection (DAI)
• DHCP starvation Exhausts the address pool, denying clients DHCP snooping, rate limiting
• Rogue DHCP server Hands clients a malicious gateway/DNS DHCP snooping trusted ports

VLAN hopping (double-tag/switch-spoof) Crosses VLAN boundaries Disable DTP, set access ports, change native VLAN

DNS-based attacks also deserve precision: DNS poisoning corrupts a resolver's cache so a correct name returns a malicious IP, while domain hijacking and typosquatting trick the user before resolution even matters. DNSSEC signs records so a resolver can validate authenticity, and encrypted transports (DoH/DoT) protect the query in transit but do not by themselves prove record integrity.

Quick Drill

(1) Cafe users join "CorpWiFi" and type credentials into a captive portal - evil twin. (2) The default-gateway IP suddenly maps to a new MAC on the LAN - ARP poisoning. (3) A public API gets millions of valid-looking search requests per minute - application-layer DDoS. (4) Correct hostnames resolve to attacker addresses - DNS poisoning or resolver compromise. (5) The switch suddenly floods all frames to every port after a burst of unknown MACs - MAC flooding; enable port security.