Threat actors, attributes and motivations45 min of study
Threat vectors and attack surfaces55 min of study
Social engineering and human vectors50 min of study
Application vulnerabilities and attacksReading · 0%
OS, hardware, virtualization, cloud and mobile vulnerabilities1 h 5 min of study
Malware types and indicators of compromise

This unit is ≈23% of the Security+, across 8 lessons. Full syllabus

Lesson 4 of 8 · Domain 2: threats, vulnerabilities, and mitigations (V7 22%) / attacks (V8 24%)

Application vulnerabilities and attacks

3 quick checks≈3% of the testStretch: Stretch: harder material that separates the top grades

Reading is free. Sign in to tick off lessons, keep your place and track your mastery.

By the end you’ll be able to

Explain memory injection and buffer overflow vulnerabilities and their mitigations (input validation, bounds checking, memory protection)
Recognise SQL injection, command injection, cross-site scripting and request forgery (CSRF/SSRF) from log entries, URLs or code snippets
Explain race conditions (time-of-check/time-of-use), malicious updates, hardcoded secrets and unsafe exception handling (SY0-801)

Practice this skill

Adaptive questions on application vulnerabilities and attacks.

Practise this topic

0% read

1 h 10 min of study

Network, cryptographic and credential attacks1 h 10 min of study

AI and LLM threats and vulnerabilities (SY0-801)55 min of study

Identify directory traversal, replay and privilege escalation attacks from URL, log or session evidence

Select the secure coding practice or application control that prevents each vulnerability

This lesson hasn’t been written yet

Security+ lessons are written from the official syllabus the first time a learner opens them, then saved for everyone. Sign in and this one is written for you in a minute or two. It’s free.

PreviousSocial engineering and human vectors Next lessonOS, hardware, virtualization, cloud and mobile vulnerabilities