SY0-701 Network Attacks Explained (Objective 2.4)

Security+ objective 2.4 expects you to recognize five categories of network attack from a scenario, not just recite their names: on-path, DNS, DDoS, wireless, and Layer 2 attacks. That's a wide net, and it's easy to blur them together when you're cramming. But each one targets a different part of the stack. Attackers might go after the route your traffic takes, the name lookup before it, the availability of the server on the other end, the airwaves it travels over, or the local segment it starts on. Once you sort them by what they actually attack, the scenario questions get a lot easier to read.

This is objective 2.4 inside Domain 2 (Threats, Vulnerabilities, and Mitigations), the second-heaviest domain on the SY0-701 exam at 22%. Want to check where you stand on this material right now? Run through the free SY0-701 practice exam — no signup, results stay in your browser.

Independent study resource. Not affiliated with or endorsed by CompTIA. Exam codes, objectives, and weightings are set by CompTIA — always confirm current details on official exam pages before booking.

Where This Sits in the SY0-701 Exam

SY0-701 spreads its content across five domains, and Domain 2 — Threats, Vulnerabilities, and Mitigations — carries 22% of the exam, second only to Security Operations.

Domain	Weight	Key Topics
1. General Security Concepts	12%	Controls, cryptography basics, authentication types
2. Threats, Vulnerabilities & Mitigations	22%	Malware, social engineering, attack vectors, cryptographic attacks
3. Security Architecture	18%	Network security, cloud, infrastructure
4. Security Operations	28%	Incident response, digital forensics, identity
5. Security Program Management	20%	Governance, risk, compliance, data privacy

Domain weights are per CompTIA's official SY0-701 exam page. The exam runs up to 90 questions in 90 minutes with a passing score of 750 on a 100–900 scale.

Objective 2.4 also covers malware types and cryptographic attacks — we broke those down separately in our SY0-701 cryptographic attacks guide. This post sticks to the network side: attacks that ride on top of routing, name resolution, availability, and wireless protocols.

On-Path Attacks: Sitting Between Two Systems

An on-path attack — the current name for what used to be called man-in-the-middle — puts the attacker between two systems that think they're talking directly to each other. Every packet routes through the attacker first, who can read it, log it, or quietly modify it before forwarding it along.

The version that shows up most on exam scenarios is SSL stripping. A victim types a plain http:// URL. The on-path attacker intercepts that first unencrypted request before it upgrades to HTTPS, then proxies the rest of the session in the clear — and the victim's browser bar shows nothing obviously wrong. It works specifically because that very first request, before any redirect, was never encrypted to begin with — nothing about the visible padlock icon guarantees the connection stayed protected from the first byte.

On the exam, look for language like "traffic was routed through an unexpected device" or "credentials appeared in plaintext despite HTTPS being enabled." Both point to on-path, not a DNS or wireless attack specifically — even though on-path attacks are often set up using one of those two.

On-path attacks are cataloged as technique T1557, "Adversary-in-the-Middle," in the MITRE ATT&CK framework.

DNS Attacks: Poisoning the Lookup, Not the Destination

DNS attacks target the translation step between a domain name and the IP address behind it — poison that step and you don't need to touch the real server at all. DNS cache poisoning inserts a forged record into a resolver's cache so it hands out the attacker's IP address for a legitimate domain. Domain hijacking goes further upstream, taking control of the domain registration itself. URL redirection attacks abuse open redirects or compromised DNS records to send a user somewhere they didn't intend to go. Often, the address bar still looks close enough to the real thing to pass a quick glance.

The clearest exam-relevant case study here is the October 21, 2016 attack on Dyn, a major managed DNS provider. The Mirai botnet is malware that scans the internet for IoT devices still running default credentials and conscripts them into a botnet. It flooded Dyn's DNS infrastructure with a peak of roughly 1.2 terabits per second of traffic. Dyn wasn't hosting Twitter, Netflix, Spotify, Reddit, or GitHub — it was resolving their domain names. Take that resolution layer down and none of those sites' own servers ever needed to be touched for millions of users to lose access for hours. That's the exam-relevant lesson: DNS attacks don't have to breach the target at all; they just have to break the address book everyone relies on to find it.

Dyn DDoS attack details per Krebs on Security's October 2016 coverage. The Mirai IoT botnet's default-credential scanning behavior is documented in CISA/US-CERT Alert TA16-288A, "Heightened DDoS Threat Posed by Mirai and Other Botnets" (Oct 14, 2016). Peak traffic against Dyn's managed DNS infrastructure is reported at approximately 1.2 Tbps.

DDoS and DoS: Attacking Availability, Not Confidentiality

A denial-of-service attack doesn't try to read or steal anything — it just tries to make a target too busy to serve legitimate requests. A distributed denial-of-service (DDoS) attack does the same thing from many sources at once, which is what makes it so much harder to filter out with a simple IP block. The Dyn attack above is a DDoS case study as much as a DNS one — the two categories collide there. That's exactly why CompTIA scenario questions sometimes make you decide which term better describes what's being asked.

Two DDoS patterns are worth knowing by name. Volumetric attacks simply try to saturate bandwidth with raw traffic volume. Amplification attacks send a small spoofed request to a third-party server and let that server's much larger response flood the real victim. That turns a small amount of attacker traffic into a disproportionately large flood aimed somewhere else entirely.

The clearest amplification case study is the February 28, 2018 attack on GitHub. It peaked at 1.35 Tbps and 126.9 million packets per second — at the time the largest DDoS attack ever recorded, surpassing the Dyn attack's peak. Attackers didn't need a botnet at all. They abused misconfigured Memcached servers exposed on the open internet. A spoofed request just a few bytes long, sent with GitHub's IP address forged as the sender, could trigger a response up to 51,000 times larger. GitHub's own incident report says the site was fully unreachable for about 5 minutes, then intermittently degraded for another 4 minutes — a 9-minute window total — before its DDoS mitigation provider fully absorbed the flood. That's the pattern to remember for amplification specifically: the attacker's real bandwidth barely matters when a misconfigured third-party service does the multiplying for them.

GitHub Memcached DDoS attack details per GitHub's official February 28th DDoS Incident Report, reporting a peak of 1.35 Tbps / 126.9 Mpps via Memcached reflection/amplification.

Wireless Attacks: Evil Twins, Rogue APs, and Handshake Replay

Wireless attacks exploit the fact that Wi-Fi signals travel through open air, not a cable you can physically secure. A rogue access point is any unauthorized AP connected to a network — sometimes planted maliciously, sometimes just an employee's personal hotspot nobody approved. An evil twin is a specific, more deliberate version: an AP broadcasting the same SSID as a legitimate network, hoping a device or user connects to the impostor instead. Every evil twin is a rogue AP; not every rogue AP is an evil twin — that distinction is a favorite exam trap.

Deauthentication attacks forcibly disconnect a client from a legitimate AP — often to push it toward an evil twin or to capture a fresh handshake. RF jamming floods the wireless spectrum with noise to deny service outright, the wireless equivalent of a DoS attack.

The best-documented wireless replay attack is KRACK (Key Reinstallation Attack), disclosed in October 2017 by researchers Mathy Vanhoef and Frank Piessens of KU Leuven. WPA2's four-way handshake is supposed to install a fresh encryption key exactly once per session. KRACK works by manipulating retransmissions of one message in that handshake so the client reinstalls a key it's already used. Once a key gets reinstalled, its associated nonce can reset too — letting an attacker replay, decrypt, or in some configurations forge packets. It doesn't crack the Wi-Fi password; it abuses the handshake's own retry logic. The disclosure was tracked under multiple CVEs, including CVE-2017-13077 through CVE-2017-13081, and affected effectively every major OS running WPA2 at the time.

KRACK details per the official KRACK Attacks research disclosure (Vanhoef & Piessens, KU Leuven, October 2017) and NIST's National Vulnerability Database entry for CVE-2017-13077.

Layer 2 Attacks: Trouble on the Local Segment

These attacks don't need internet access at all — just a foothold on the same local network segment as the victim. ARP poisoning (also called ARP spoofing) sends forged ARP replies that map the attacker's MAC address to a legitimate IP address, like the default gateway. That silently reroutes local traffic through the attacker's machine — it's one of the most common ways an on-path attack actually gets set up on a LAN. MAC flooding overwhelms a switch's MAC address table with fake entries until it runs out of room. The switch then falls back to broadcasting every frame to every port, turning a switched network back into something closer to an old hub — much easier to sniff. MAC cloning copies a legitimate device's MAC address to bypass MAC-filtering controls that assume an address uniquely identifies a device.

ARP poisoning is documented as sub-technique T1557.002, "ARP Cache Poisoning," under MITRE ATT&CK's Adversary-in-the-Middle technique. Because ARP is stateless and unauthenticated, a device has no built-in way to verify a reply actually came from who it claims to.

Network Attacks: Side-by-Side Comparison

Attack category	What it targets	Real-world example	Primary mitigation
On-path	Traffic between two endpoints	SSL stripping downgrading HTTPS to plaintext HTTP	HSTS, certificate pinning, encrypted DNS
DNS	Name resolution	Dyn DDoS via Mirai botnet (Oct 2016)	DNSSEC, resolver hardening, registrar locking
DDoS / DoS	Availability	GitHub Memcached amplification — 1.35 Tbps peak (Feb 2018)	Rate limiting, anycast/CDN distribution, scrubbing services
Wireless	Wi-Fi association and handshake	KRACK — WPA2 four-way handshake replay (2017)	Patched WPA2/WPA3 clients, WIDS for rogue AP/evil twin detection
Layer 2	Local network segment	ARP poisoning enabling on-path interception	Dynamic ARP inspection, port security, 802.1X

Notice the throughline: almost every mitigation in that table comes down to the same idea. Verify identity at the layer where the attack happens, instead of trusting that a device, domain, or access point is who it claims to be. That's the pattern objective 2.4 keeps testing across all five categories, not five unrelated vocabulary lists.

How This Shows Up in Exam Scenarios

CompTIA rarely names the attack directly. Expect something like: a user reports their browser suddenly shows http:// instead of https:// mid-session on a site that normally forces encryption — that's on-path, specifically SSL stripping. A help desk ticket says an employee's laptop connected to a network with the office SSID while sitting in the parking lot, and now their credentials are compromised — that's an evil twin. A network admin notices every device on a switch suddenly receiving broadcast traffic meant for other ports — that's MAC flooding. A major site becomes unreachable, but pinging its IP directly still works — that's a strong hint the DNS layer, not the server itself, is what got hit.

Ask yourself, while you study: could you tell an evil twin apart from a rogue AP, or ARP poisoning apart from DNS poisoning, from one sentence of scenario context? If not, go back to what each one actually targets — that's the detail these questions hinge on, not the vocabulary. Ready to check? Run a set of Domain 2 scenario questions on our free SY0-701 practice exam and see how objective 2.4 questions are actually phrased.

FAQ

What's the difference between an on-path attack and a DNS attack?

An on-path attack intercepts traffic that's already flowing between two systems. A DNS attack works earlier — it poisons the lookup that decides where that traffic gets sent in the first place. They're often chained together: a DNS attack can redirect a victim toward a server the attacker controls, which then runs an on-path attack on whatever comes through.

Is a rogue access point the same thing as an evil twin?

No. A rogue AP is any unauthorized access point on a network — it doesn't have to impersonate anything. An evil twin is a rogue AP that specifically broadcasts a legitimate network's SSID to trick users into connecting. Every evil twin is a rogue AP, but most rogue APs (like an employee's personal hotspot) aren't evil twins.

How did KRACK actually break WPA2 if it didn't crack the password?

It exploited a flaw in the WPA2 four-way handshake's retransmission handling, tricking a client into reinstalling an already-used encryption key. Reinstalling that key reset an associated nonce, which let an attacker replay, decrypt, or in some setups forge packets — all without ever knowing the actual Wi-Fi password.

Why did the 2016 Dyn attack take down sites that Dyn didn't even host?

Because Dyn provided DNS resolution, not hosting, for those sites. Once its DNS infrastructure was overwhelmed, browsers couldn't translate domain names like twitter.com into the IP addresses of Twitter's actual servers — the servers stayed up the whole time, but nothing could find them.

Are ARP poisoning and DNS poisoning the same attack at different scales?

They're related in effect — both redirect traffic to an attacker — but they operate at different layers. ARP poisoning only works on the local network segment, since ARP itself is a Layer 2, non-routable protocol. DNS poisoning can affect anyone using a compromised resolver, regardless of what network they're physically on.

Practice What You Just Learned

Reading through five network attack categories is one thing — recognizing which one a scenario is describing, under exam time pressure, is the actual skill objective 2.4 tests. Our free SY0-701 practice exam covers all five domains with a full explanation for every question, including why the wrong answers are wrong. No account, no credit card, and your results never leave your browser.

Already have your own SY0-701 question bank? Upload your VCE or PDF to our free simulator and run through it instantly. If you haven't locked in a study schedule yet, our guide to studying with a free practice test covers how to turn a diagnostic score into an actual study plan.

Related reading

• SY0-701 Cryptographic Attacks Explained (Objective 2.4)
• TLS 1.3 vs TLS 1.2: What Changed (Security+ Explained)
• More certification study guides