What is the single biggest risk to a company's network? It is not always a hacker in a hoodie — it can be an employee clicking the wrong link or a weak password. This chapter breaks down the most common security threats and vulnerabilities you need to know for the FC0-U71 exam, using everyday examples so you can recognise them in any scenario.
Jump to a section
A simple way to picture Network Security Fundamentals
A business installs a security system because a locked door is not enough to stop a break-in.
That security system has multiple layers: motion sensors detect movement inside the building after hours, a siren scares off intruders, and a camera records everything so the police can catch the thief later. The business also trains its night shift staff to check IDs at the entrance, to never prop open the back door, and to report anyone who looks out of place.
In network security, the locked door is your firewall. The motion sensors are intrusion detection systems (IDS) that watch for suspicious traffic. The siren is an intrusion prevention system (IPS) that actively blocks threats. The cameras are logs and auditing tools that record who did what and when. The night shift staff represent your security policies and user training. Just as a thief might trick an employee into opening the door by pretending to be a delivery driver, a cyber attacker uses social engineering to trick users into giving up passwords or clicking malicious links. A strong security setup does not rely on any one layer. It uses a defence-in-depth strategy, layering physical controls, technical controls, and administrative policies so that if one layer fails, another stops the threat.
Network security is the practice of protecting a computer network and the data that travels across it from unauthorised access, misuse, or destruction. Think of your home Wi-Fi: you set a password so your neighbours cannot use it, you check your bank statements for fraud, and you teach your kids not to open emails from strangers. Network security for a business is the same idea, just on a much larger scale and with more tools.
The foundation of network security is the CIA Triad. Confidentiality means only authorised people can see sensitive data. Integrity means the data has not been tampered with. Availability means the network and data are accessible when needed. These three goals guide every security decision.
Now, let's look at the specific threats and vulnerabilities the FC0-U71 exam covers.
Malware is short for malicious software. It is any programme designed to damage a computer or network. Types include:
Virus: attaches itself to a legitimate file and spreads when that file is shared.
Worm: self-replicates across a network without needing a host file.
Trojan: disguises itself as a useful programme but contains hidden harmful code.
Ransomware: encrypts your files and demands payment for the decryption key.
Spyware: secretly monitors your activity and steals information like passwords.
Malware usually gets in through email attachments, infected downloads, or malicious websites. Once inside, it can steal data, slow down systems, or lock files.
Phishing is a social engineering attack where the attacker sends a fake message that looks like it comes from a trusted source. The goal is to trick the victim into clicking a link, opening an attachment, or revealing sensitive information like a password. Spear phishing is a targeted version aimed at a specific person or organisation. Whaling targets senior executives. Vishing uses phone calls instead of email. Smishing uses SMS text messages.
Social engineering is the art of manipulating people into breaking normal security procedures. Attackers pretend to be IT support, a delivery driver, or a new employee. They use urgency, fear, or trust to get what they want. Common techniques include pretexting (creating a fake scenario), baiting (leaving an infected USB drive where someone will find it), and tailgaiting (following an authorised person into a restricted area without their consent).
Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks aim to make a service unavailable by overwhelming it with traffic. A DoS comes from one source; a DDoS comes from many. These attacks flood a server so it cannot respond to legitimate users.
Man-in-the-Middle (MitM) attacks happen when an attacker secretly intercepts communication between two parties. For example, on an unsecured public Wi-Fi network, an attacker could position themselves between your laptop and your bank's website, reading everything you send. Encryption, like HTTPS, is designed to prevent this.
Zero-day attacks exploit vulnerabilities that the software vendor does not yet know about. Because no patch exists, these attacks are very dangerous.
Insider threats come from people inside the organisation. They can be malicious (a disgruntled employee stealing data) or accidental (an employee sending an email to the wrong person).
Weak or default passwords are a huge vulnerability. Many devices come with a default username and password like "admin" and "password". Attackers scan the internet for these devices and take control. Password spraying is an attack where the attacker tries a few common passwords against many accounts, hoping to get lucky.
Unpatched software means a known security hole exists in the software but has not been fixed. Vendors release patches to close these holes, but if an organisation delays applying them, attackers will exploit the vulnerability.
To defend against these threats, organisations use multiple layers of defence. Firewalls block unauthorised traffic. Antivirus software scans for known malware. Intrusion Detection Systems (IDS) alert on suspicious patterns, while Intrusion Prevention Systems (IPS) actively block them. Virtual Private Networks (VPNs) encrypt traffic between a device and the network. Strong password policies and Multi-Factor Authentication (MFA) make it harder for attackers to log in. Regular backups protect against ransomware and data loss. And security awareness training teaches employees to spot phishing and social engineering attempts.
Identify the threat or vulnerability
Recognise the type of issue you are facing. For the exam, this means reading a scenario and identifying whether it describes phishing, malware, social engineering, a DoS attack, or another threat. Ask: what is the attacker trying to do?
Assess the risk and impact
Determine how serious the threat is. Could it shut down the business? Steal customer data? Lock files? This step helps prioritise which vulnerabilities to fix first. A default password on a critical server is a higher risk than an unused user account.
Choose the appropriate control or defence
Based on the threat, select the right security control. For phishing, the best control is training. For malware, use antivirus and keep software patched. For unauthorised access, use strong passwords and MFA. Each threat has a corresponding defence.
Implement the defence
Put the chosen control into action. This might mean configuring a firewall rule, installing antivirus software, enforcing a password policy, or running a training session. Document what you did so you can audit it later.
Monitor and review
Security is never 'set and forget'. Continuously monitor logs, review incidents, and update defences as new threats appear. Run phishing simulations, check for unused accounts, and apply patches on a regular schedule.
Respond and recover
If a breach happens, contain it immediately — disconnect affected systems. Then investigate what went wrong, remove the threat, restore from clean backups, and learn from the incident to prevent a repeat. This is the recovery phase.
A mid-sized accounting firm, 'Ledger & Co.', handles sensitive financial data for dozens of small businesses. Their network has 50 employees, a central server, and a cloud-based email system. The IT administrator, Priya, is responsible for network security.
One Monday morning, Priya gets an email flagged as urgent. It appears to come from 'IT Support' and says her email password is about to expire. It asks her to click a link and enter her current password to 'confirm her account'. Priya notices the sender's email address is 'it-support@ledger-co-secure.com' instead of the company's actual domain 'ledger-co.com'. She recognises this is a phishing attempt. She reports it to the security team and deletes it.
Later that week, an employee named Tom calls Priya in a panic. Tom says he clicked a link in an email that looked like it was from his bank, and now his computer is acting strangely — it is slow, and strange pop-up ads keep appearing. Priya immediately disconnects Tom's computer from the network to stop any malware from spreading. She runs a virus scan and finds spyware installed. She removes the spyware and restores the computer from a recent clean backup.
Priya also conducts a quarterly security audit. She checks:
All software is up to date with the latest patches.
No accounts use default or weak passwords.
The firewall rules are correctly configured to block all unnecessary ports.
Employee access permissions are updated — a junior accountant who left last month no longer has access to the financial database.
During the audit, she discovers that the Wi-Fi router in the break room is still using the factory default password. Anyone within range could log onto the company network. She immediately changes the password and enables WPA3 encryption.
Priya also runs a simulated phishing campaign. She sends a fake phishing email to all employees and tracks who clicks. Several employees click the link. She then schedules a mandatory security awareness training session to teach them how to identify red flags, such as mismatched URLs, urgent language, and requests for personal information.
Monthly, Priya reviews the firewall and IDS logs. She sees a pattern of failed login attempts from an unfamiliar IP address. This is a brute-force attack — someone is trying to guess passwords. She adds that IP address to a block list and enables an automatic lockout policy: after five incorrect attempts, the account is locked for 30 minutes.
This scenario shows how an IT professional actively monitors, reacts, and trains to prevent security incidents. Security is not a one-time setup; it is an ongoing process of patching, monitoring, and educating.
The FC0-U71 exam objective 5.1 asks you to 'identify common security threats and vulnerabilities'. This means you need to recognise the name and definition of each threat, and understand how it works at a basic level. You will not be asked to configure a firewall, but you might be asked to choose which threat is being described in a scenario.
Common exam question types: - Scenario-based: 'An employee receives an email that appears to be from their CEO asking for a money transfer. What type of attack is this?' (Answer: whaling or social engineering). - Definition matching: 'Which term describes software that secretly monitors user activity?' (Answer: spyware). - Best practice: 'What is the best defence against phishing attacks?' (Answer: security awareness training). - Contrasting concepts: 'What is the difference between a virus and a worm?' (Answer: a worm does not need a host file to spread).
Concepts they love to test: - The difference between a DoS and a DDoS (one source vs. many). - The difference between a virus, worm, and Trojan. - Phishing vs. spear phishing vs. whaling (general vs. targeted vs. high-value target). - Social engineering techniques: tailgaiting, pretexting, baiting. - Insider threats (knowing they can be malicious or accidental). - The importance of patching and strong passwords. - Ransomware as a specific type of malware.
Traps they set: - They might describe a man-in-the-middle attack but call it 'eavesdropping' — the official term is man-in-the-middle. - They might describe a denial of service attack but mention it coming from a single computer — that is DoS, not DDoS. - They might describe social engineering as 'manipulating people' and ask you to pick the correct term: social engineering. - They might list 'firewall' as a defence against malware, but a firewall is a network filter; antivirus or antimalware is the correct defence against malware. - They might describe a zero-day attack but not use the term 'zero-day' — the clue is 'the vendor does not know about the vulnerability'.
Key definitions to memorise: - Malware: malicious software (umbrella term). - Ransomware: encrypts data for ransom. - Phishing: fraudulent communication to steal info. - Social engineering: manipulating people to break security. - DoS/DDoS: overwhelming a system to make it unavailable. - MitM: intercepting communications. - Zero-day: unknown vulnerability. - Insider threat: risk from within the organisation.
What to watch out for: - Questions that mix up 'confidentiality', 'integrity', and 'availability' from the CIA triad. You may not be directly tested on the triad in this objective, but understanding it helps you reason through scenario questions. - Questions that test 'least privilege' — only giving users the minimum access needed. This is a key vulnerability if not applied. - Questions that ask about physical security as part of network security — like tailgaiting or unlocked server rooms.
The CIA Triad — Confidentiality, Integrity, Availability — is the foundation of all network security decisions.
Phishing is the most common way attackers gain initial access, and security awareness training is the best defence against it.
A firewall controls incoming and outgoing traffic but cannot stop malware from entering through email, downloads, or social engineering.
Ransomware encrypts files and demands payment; the only reliable protection is having offline backups that cannot be encrypted by the attacker.
Multi-factor authentication (MFA) significantly reduces the risk of account takeover, even if a password is stolen.
Insider threats can be malicious (a disgruntled employee) or accidental (an employee sending data to the wrong person), and both are serious risks.
Zero-day attacks exploit vulnerabilities unknown to the vendor, so keeping software patched is critical but not a complete defence.
A Distributed Denial of Service (DDoS) attack uses many compromised systems to overwhelm a target, making a service unavailable.
These come up on the exam all the time. Here's how to tell them apart.
Phishing
Sent to many people in bulk, like a mass spam email.
Uses generic language, e.g. 'Dear Customer'.
Usually less convincing and easier to spot.
Often tries to steal passwords or spread malware broadly.
Spear Phishing
Targets a specific individual or organisation.
Uses personalised details like the recipient's real name or job title.
More convincing because it appears to come from a known contact or service.
Often aimed at a specific high-value goal, like financial fraud or data theft.
Virus
Requires a host file (e.g., an attachment) to attach itself to.
Spreads when the infected file is opened and then shared.
Often relies on human action, like emailing the infected file.
Can corrupt or modify files on the infected system.
Worm
Does not need a host file; it is a standalone programme.
Spreads automatically across a network using security vulnerabilities.
Replicates without any human action after the initial activation.
Primarily consumes network bandwidth and system resources.
DoS Attack
Originates from a single source (one computer or one IP address).
Easier to stop by blocking that one source.
Often easier to trace back to the attacker.
Less common on the modern internet because it is simple to defend against.
DDoS Attack
Originates from many sources (thousands of compromised devices).
Very difficult to stop because traffic comes from everywhere.
Harder to trace because the attacker controls many botnet devices.
Very common because attackers can rent botnets cheaply.
Ransomware
Encrypts files and demands payment for the decryption key.
The goal is to extort money from the victim.
Often uses a countdown timer to increase pressure.
Recovery typically requires restoring from a backup or paying the ransom.
Spyware
Secretly monitors user activity, like keystrokes or browsing habits.
The goal is to steal sensitive information (passwords, credit card numbers).
Often runs silently in the background without the user knowing.
Recovery involves removing the spyware and changing all compromised passwords.
Confidentiality
Ensures only authorised people can access data.
Example: encrypting a file so only the intended recipient can read it.
Breach example: an attacker steals a database of customer passwords.
Related controls: encryption, access controls, MFA.
Integrity
Ensures data has not been altered or tampered with.
Example: using a checksum to verify a file has not been modified.
Breach example: an attacker modifies a bank transaction amount before it is processed.
Related controls: hashing, digital signatures, checksums.
Mistake
A firewall alone is enough to protect a network from all threats.
Correct
A firewall is only one layer of defence. It blocks unauthorised traffic but does not stop malware from entering via email, phishing, or infected USB drives. You need multiple layers: antivirus, IDS/IPS, patching, training, and strong passwords.
People often oversimplify security, believing a single product is a silver bullet. In reality, attackers use many paths, and no single tool blocks every avenue.
Mistake
If I do not click any links or open attachments, I cannot get a virus.
Correct
Some malware, like drive-by downloads, can infect your computer just by visiting a compromised website. Also, worm malware can spread across a network without any user action, exploiting unpatched vulnerabilities.
Users are taught to avoid clicking suspicious links, so they think that is the only risk. They do not realise that simply browsing a site or having an outdated browser can lead to infection.
Mistake
Strong passwords make multi-factor authentication (MFA) unnecessary.
Correct
Even the strongest password can be stolen through phishing, keyloggers, or a data breach. MFA adds a second layer — like a code from your phone — so a stolen password alone is not enough for an attacker to log in.
People believe if they follow one rule perfectly, they are safe. They underestimate how many ways a password can be compromised.
Mistake
Only large organisations are targets of cyber attacks.
Correct
Small and medium-sized businesses are often targeted because they have weaker defences. Attackers also use automated tools to scan the entire internet for vulnerabilities, so any device connected to the internet is a potential target.
This misconception comes from high-profile news stories about big corporations. Beginners assume attackers only go after rich targets, not realising that automated attacks do not discriminate.
Mistake
A strong password and an antivirus programme means my data is completely safe from ransomware.
Correct
Ransomware can still get through if you click a malicious link, open an infected attachment, or if a vulnerability in your software is not patched. Antivirus is not foolproof against new or custom ransomware. Regular backups stored offline are the best defence.
People think 'antivirus' covers everything, but it specifically targets known malware signatures. Ransomware variants are constantly changing, and new ones may slip past detection until the antivirus vendor updates its definitions.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A virus needs a host file (like a document or programme) to attach itself to and spreads when that file is shared. A worm is a standalone programme that replicates itself across a network without needing any host file.
No. Even a strong password can be stolen through phishing, keylogging, or a data breach. Multi-factor authentication (MFA) adds a second layer of security, making it much harder for an attacker to log in.
A zero-day attack exploits a vulnerability in software that the vendor does not yet know about. Because there is no patch available, the attack is especially dangerous and difficult to defend against.
Public Wi-Fi is not secure on its own. An attacker on the same network could intercept your traffic. Always use a VPN to encrypt your connection, or use your mobile data for sensitive transactions.
Disconnect from the internet immediately to stop any malware from communicating with the attacker. Then run a full antivirus scan, change your passwords from a different device, and report the incident to your IT department or security team.
A Denial of Service (DoS) attack comes from a single source, like one computer. A Distributed Denial of Service (DDoS) attack comes from many sources at once, making it much harder to stop.
You've finished Network Security Fundamentals. Continue through the FC0-U71 study guide to build a complete picture of the exam.
Done with this chapter?