CompTIA Security+ SY0-701

1.0 General Security Concepts (12%)

• 1.1 Security Controls

  • Types: Technical, Preventive, Managerial, Deterrent, Operational, Detective, Physical, Corrective, Compensating, Directive

• 1.2 Fundamental Security Concepts

  • CIA Triad: Confidentiality, Integrity, Availability

  • Non-repudiation

  • Authentication, Authorization, and Accounting (AAA)

  • Zero Trust Architecture

  • Deception and Disruption Technology (e.g., honeypots, honeynets, honeytokens)

• 1.3 Change Management

  • Business processes impacting security operations

  • Technical implications

  • Documentation: Allow lists/deny lists, updating diagrams, policies/procedures, version control

  • Approval process, ownership, stakeholders, impact analysis, backout plan, maintenance window, standard operating procedure

• 1.4 Cryptographic Solutions

  • Public Key Infrastructure (PKI): Public key, private key, key escrow

  • Encryption: Full-disk, partition, file, volume, database, record, transport/communication

  • Algorithms: Asymmetric, symmetric, key exchange, hashing

  • Tools: Trusted Platform Module (TPM), Hardware Security Module (HSM), Secure Enclave

  • Documentation: Certificate revocation lists (CRLs), Online Certificate Status Protocol (OCSP), certificate signing request (CSR) generation, certificate authorities

2.0 Threats, Vulnerabilities, and Mitigations (22%)

• 2.1 Threat Actors and Motivations

  • Types: Nation-state, unskilled attacker, hacktivist, insider threat, organized crime, shadow IT

  • Motivations: Data exfiltration, espionage, financial gain

• 2.2 Threat Vectors and Attack Surfaces

  • Message-based, unsecure networks, social engineering, file-based, voice call, supply chain, vulnerable software vectors

• 2.3 Vulnerabilities

  • Application: Memory injection, buffer overflow, race conditions (TOC/TOU), malicious update

  • Operating System (OS)-based

  • Web-based: SQL injection (SQLi), Cross-Site Scripting (XSS)

  • Hardware: Firmware, end-of-life, legacy

  • Mobile Device, Virtualization, Cloud-specific, Supply Chain

• 2.4 Malicious Activity

  • Malware: Viruses, worms, ransomware, trojans

  • Password attacks: Brute force, dictionary, rainbow tables

  • Application attacks: SQLi, XSS

  • Physical attacks: Tailgating, shoulder surfing

  • Network attacks: Man-in-the-middle (MitM), denial-of-service (DoS), distributed DoS (DDoS)

  • Cryptographic attacks: Replay, birthday, brute force

• 2.5 Mitigation Techniques

  • Segmentation, access control, configuration enforcement, hardening, isolation, patching

3.0 Security Architecture (18%)

• 3.1 Architecture Models

  • On-premises, cloud, virtualization, Internet of Things (IoT), Industrial Control Systems (ICS), Infrastructure as Code (IaC)

• 3.2 Enterprise Infrastructure

  • Control selection, secure communication/access

• 3.3 Data Protection

  • Data types: Structured, unstructured

  • Methods: Encryption, tokenization, masking

  • General considerations: Data classification, labeling, handling procedures

  • Classifications: Public, internal, confidential, restricted

• 3.4 Security Controls

  • Snapshots, recovery, replication, journaling

  • Power: Generators, Uninterruptible Power Supply (UPS)

4.0 Security Operations (28%)

• 4.1 Security Techniques

  • Secure baselines: Establish, deploy, maintain

  • Hardening targets: Mobile devices, workstations, switches

  • Disposal/decommissioning: Sanitization, destruction, certification, data retention

• 4.2 Security Alerting and Monitoring

  • Monitoring computing resources: Systems, applications, infrastructure

  • Activities: Log aggregation, alerting, scanning, reporting, archiving

  • Alert response and remediation/validation: Quarantine, industry/organizational impact, risk tolerance

• 4.3 Vulnerability Response and Remediation

  • Patching, insurance, segmentation, compensating controls, exceptions and exemptions

  • Validation of remediation: Rescanning, audit, verification

  • Reporting

• 4.4 Identity and Access Management

  • Open Authorization (OAuth), Security Assertions Markup Language (SAML)

  • Interoperability, attestation

  • Access controls: Mandatory, discretionary, role-based, rule-based, attribute-based, time-of-day restrictions, least privilege

  • Multifactor authentication: Biometrics, hard/soft authentication tokens, security keys

  • Password concepts: Length, complexity, reuse, expiration, age, password managers, passwordless

  • Privileged access management tools: Just-in-time permissions, password vaulting, ephemeral credentials

• 4.5 Automation and Orchestration

  • Use cases: User provisioning, resource provisioning, guard rails, security groups, ticket creation, escalation, enabling/disabling services and access, continuous integration and testing, integrations and APIs

  • Benefits: Efficiency/time saving, enforcing baselines, standard infrastructure configurations, scaling in a secure manner, employee retention, reaction time, workforce multiplier

  • Other considerations: Complexity, cost, single point of failure, technical debt, ongoing supportability

• 4.6 Incident Response

  • Process: Preparation, detection, analysis, containment, eradication, recovery, lessons learned

  • Training, testing: Tabletop exercise, simulation

  • Root cause analysis, threat hunting, digital forensics

  • Legal hold, chain of custody, acquisition, reporting, preservation, e-discovery

• 4.7 Data Sources for Investigation

  • Log data: Firewall logs, application logs, endpoint logs, OS-specific security logs, IPS/IDS logs, network logs, metadata

  • Data sources: Vulnerability scans, automated reports, dashboards, packet captures

5.0 Security Program Management and Oversight (20%)

• 5.1 Security Governance

  • Guidelines, policies: Acceptable use policy (AUP), information security policies, business continuity, disaster recovery, incident response, software development lifecycle (SDLC), change management

  • Standards: Password, access control, physical security, encryption

  • Procedures: Change management

  • Business impact analysis: Recovery time objective (RTO), recovery point objective (RPO), mean time to repair (MTTR), mean time between failures (MTBF)

• 5.2 Third-Party Risk Management

  • Processes associated with third-party risk assessment and management

• 5.3 Security Compliance

  • Elements of effective security compliance

• 5.4 Audits and Assessments

  • Types and purposes of audits and assessments

• 5.5 Security Awareness Practices

  • Phishing: Campaigns, recognizing a phishing attempt, responding to reported suspicious messages

  • Anomalous behavior recognition: Risky, unexpected, unintentional

  • User guidance and training: Policy/handbooks, situational awareness, insider threat, password management, removable media and cables, social engineering, operational security, hybrid/remote work environments

  • Reporting and monitoring: Initial, recurring

  • Development, execution