Malware Types and Characteristics
Malware is just malicious software, but the behaviors vary a lot, and the exam wants you to read a scenario, classify what it is, and pick the defense that matches. Modern threats are often fileless and use legitimate built-in tools, which is exactly what defeats signature-based antivirus.
Exam tip. Signature antivirus misses fileless, living-off-the-land, and polymorphic malware. For all three, the answer is behavioral EDR plus detailed command-line and script logging.
Social Engineering Attack Types
Social engineering manipulates people rather than technology. The channel it arrives through is usually what names the attack, and underneath them all the attacker is pulling the same psychological levers: authority, urgency, fear, scarcity, and likability. Awareness training and verification are the core defenses.
Exam tip. Help-desk pretexting works by exploiting the exceptions people make for VIPs and for urgency, so the fix is identity verification with no exceptions. And never use contact details supplied by the suspicious message itself.
Network-Based Attacks
Network attacks go after the infrastructure and the protocols themselves. What you need is each attack, the telltale signs that give it away, and the mitigation that matches, because many of them map to one specific switch feature or protocol defense.
Exam tip. Because a DDoS is distributed, blocking single IPs will not work. The answer is upstream scrubbing, a CDN or anycast, and rate limiting, not one more firewall rule.
Application Security Attacks (OWASP focus)
Application attacks exploit the way software handles input, sessions, and authorization. The same lesson comes back every time: never trust what the client sends, enforce authorization on the server side, and fix the root cause in the code. A WAF is only defense in depth.
Exam tip. A WAF is defense in depth and never the sole fix. For injection, the root-cause answer is parameterized queries and validation. For IDOR, it is per-object authorization checks.
Password Attacks and Credential Theft
Password attacks run from online guessing, to cracking hashes offline, to simply reusing material stolen somewhere else. Match the defense to the attack: MFA for reuse, lockout for online guessing, and salted slow KDFs for offline cracking.
Exam tip. MFA protects the login but not the session, so a stolen session token bypasses it. Salting is what defeats rainbow tables, and slow memory-hard KDFs are what defeat GPU cracking.
Supply Chain and Third-Party Attacks
Supply chain attacks are attractive because compromising one trusted supplier cascades into many downstream victims at once. The defenses are about provenance and transparency: know what is inside your software with an SBOM, scan it, and secure the pipeline that builds it.
Exam tip. A build-system compromise defeats source review, because the malicious change enters after the review and before signing. Reproducible builds and verifying artifacts against the source are what catch it.
Wireless Attacks
Wireless attacks go after the radio layer and Wi-Fi authentication. You need to recognize each attack and know the structural fix that actually closes it, especially WPA3-SAE against offline cracking and validating the RADIUS server certificate on enterprise Wi-Fi.
Exam tip. Hiding the SSID and filtering MAC addresses are weak obscurity controls, and attackers bypass both. When the scenario is handshake capture, the structural fix is WPA3-SAE.
Threat Intelligence and Threat Actors
Threat actors differ in resources, sophistication, intent, and how persistent they are. Threat intelligence describes them in two ways: indicators of compromise, which an adversary can change cheaply, and TTPs, which cost real effort to change. That is why detection built on behavior lasts longer than detection built on indicators.
Exam tip. On the pyramid of pain, hashes and IP addresses are trivial for an attacker to rotate, while TTPs impose the most cost on them. That is why behavior-based detection beats chasing indicators that go stale.
Vulnerability Scanning vs Penetration Testing
Vulnerability scanning is automated, broad, and cheap, but it never proves that anything is actually exploitable. Penetration testing is manual and deep, and it demonstrates real attack paths and the business risk behind them. Know which one a scenario is asking for, and know the concepts that support each.
Exam tip. The scariest scanner outcome is a false negative, a real flaw reported as absent. Broad, frequent coverage with no exploitation is scanning; a demonstrated chain of attacks is penetration testing.
CVSS Scoring and CVE
A CVE is the unique identifier for a specific vulnerability, and CVSS is the 0 to 10 score for how severe it is. Severity is not the same as priority, though. To decide what you patch first you combine the CVSS score with how exploitable the flaw actually is and what it means in your own environment.
Exam tip. CVSS gives you severity, not the whole picture. Prioritize by combining it with exploitability and threat intel on active exploitation. Network vector, no privileges, and no user interaction together means urgent.