Vulnerability Types and Misconfiguration

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Vulnerability Types and Misconfiguration

Key Takeaways Explain This Topic AI

A vulnerability is a weakness that can be exploited; misconfiguration is the single most common source CompTIA tests, ahead of zero-days.

SY0-701 objective 2.3 names application, OS, web, hardware, virtualization, cloud, supply-chain, cryptographic, and misconfiguration vulnerability families by name.

Cloud and container weaknesses almost always trace to identity, network, storage, image, or logging configuration rather than novel exploits.

Supply-chain vulnerabilities include vulnerable dependencies, typosquatting, compromised updates, and weak hardware-provider controls.

On scenario questions, name the root-cause weakness first, then pick the control that closes that exact condition.

Last updated: June 2026

Why This Section Carries Weight

Domain 2 (Threats, Vulnerabilities, and Mitigations) is 22% of the SY0-701 exam, second only to Security Operations at 28%, and vulnerability concepts (objective 2.3) appear in scenario form across all five domains. The exam is a maximum of 90 questions in 90 minutes with a passing score of 750 on a 100-900 scale (roughly 83%), so you cannot afford to misread the question. CompTIA hides the answer in the root cause : do not just name the attack, name the weakness that made it possible.

A vulnerability is a weakness in an asset; a threat is the actor or event that could exploit it; risk is the probability and impact of that pairing. Misconfiguration is the most commonly tested vulnerability source because it is preventable, human-caused, and present in nearly every breach scenario CompTIA writes.

Vulnerability type Concrete example Why it matters Typical mitigation

Missing patch Internet-facing VPN has a known RCE CVE Public exploit code likely exists Patch, isolate, or apply vendor workaround

Default configuration Default admin/admin still enabled on a switch Trivial unauthorized access Change defaults, apply a hardening baseline

Open permissions Everyone group has write on a share Tampering and data exposure Least privilege, periodic access reviews

Insecure protocol Telnet or FTP used for admin access Credentials sent in cleartext SSH, SFTP, or a secure management plane

Weak/legacy cryptography TLS 1.0 or RC4 still enabled Decryption or downgrade attacks Disable weak protocols and ciphers

End-of-life (EOL) system Vendor no longer issues fixes Unpatched known flaws persist forever Upgrade, replace, segment, monitor

Unnecessary service Test service left running in production Extra attack surface Disable or restrict the service

Exposed management port RDP 3389 or SSH 22 reachable from the internet Direct credential-stuffing path VPN, bastion host, allow list, MFA

Misconfiguration Patterns CompTIA Loves

Most objective 2.3 questions reduce to one of these. Memorize the "better state" column because that is usually the correct answer choice.

• Area Common mistake Better state
• Identity Overly broad admin roles Least privilege, role reviews, just-in-time access
• Network Any-to-any firewall rules Narrow source, destination, port, and protocol
• Storage Public read on a sensitive object store Block-public-access plus explicit policies
• Logging Audit logs disabled or 1-day retention Central logging with protected, longer retention
• Endpoint All users are local administrators Standard users plus a privileged-elevation workflow
• Database Database listener exposed to the internet Private subnet, application-only access
• Container Runs as root with --privileged Non-root user, dropped Linux capabilities
• Cloud Long-lived static access keys Workload identity, short-lived credentials
• Cloud and Container Worked Example

A containerized web app is breached. Investigation finds three weaknesses at once: the image runs as root , it bundles a vulnerable package (an outdated logging library with a known CVE), and an environment variable holds a cloud access key . CompTIA will ask for the best or most immediate control.

• Finding Vulnerability category Best mitigation
• Vulnerable package Software/dependency vulnerability Rebuild from a patched base image
• Root container Configuration weakness Run as non-root, drop capabilities
• Access key in env var Secret exposure Rotate the key now, move to a secret manager or workload identity

Urgency drives the answer: an exposed key that may already be in attacker hands is rotated first , because exposure is active. Then you fix the build pipeline and secret-handling process so the condition does not recur. Picking only "patch the package" would leave the live credential usable.

Supply-Chain Weaknesses

Objective 2.3 explicitly lists supply chain (suppliers, vendors, managed service providers). Look for the clue word in the stem.

• Weakness Stem clue Mitigation
• Vulnerable dependency An SCA report flags a library CVE Update the dependency and re-test

Typosquatting package Package name almost matches a popular one ( reqeusts ) Trusted registries, package allow lists

• Compromised update A legitimate vendor channel delivers malware Vendor validation, code signing, monitoring
• Unpinned dependency Build pulls "latest" unreviewed package Pin versions, use lock files
• Unverified artifact Binary's origin cannot be confirmed Signature verification and hash checks
• Hardware/firmware trust Counterfeit or tampered component Trusted suppliers, attestation, firmware validation
• Common Traps

• Trap Better exam reasoning
• Treat a scan as remediation Scanning finds ; remediation changes the risky condition
• Patch a system with no vendor patch Use compensating controls while replacing or upgrading
• Encrypt data but leave public access on Encryption helps, but public exposure is still a config failure
• Disable logs for performance Logs are required for detection, investigation, accountability
• Name the attack, not the weakness The objective asks for the vulnerability, then the fix
• Quick Drill

Name the weakness, then the mitigation:

A router still uses the vendor default password: default configuration; change credentials, apply hardening baseline.

A payroll database accepts connections from any internet address: exposed service; restrict network reachability, require a controlled admin path.

A server runs an unsupported OS: legacy/EOL system; replace or isolate with monitoring until replacement.

A lock file is missing and builds pull unreviewed versions: supply-chain weakness; pin and review dependencies.

A storage bucket holding reports allows anonymous reads: misconfiguration; block public access and apply explicit policy.