CompTIA Certified auto_stories Free Compressed Course : 20% preview

Security+ SY0-701 Certification Course

bolt Everything you need to pass : in one free course.

66 expert modules derived from 90+ exam-style questions. Covers every domain and scenario : organized by blueprint weight so you study what matters most.

Full access from $ 29 One-time · No subscription

play_arrow Start Learning Free payments See Plans

check_circle 14 of 66 modules free · No account needed

Modules

90+

Questions

star star star star star

4.9/5

description Also available: 3-Page Cheat Sheet by Experts

200+ CompTIA Certified 93% First-Attempt Pass Rate 4.9/5 Rating

About This Course

Security+ SY0-701 · 66 modules

This course covers every domain tested on the Security+ SY0-701 exam. Based on our 90+ real practice questions and prepared by certification experts.

info What you'll learn:

Every exam domain with detailed explanations
Common exam traps that catch unprepared candidates
Key concepts, syntax, and configurations
Real-world scenarios aligned with exam objectives
Quick-reference cheat sheets for last-minute review

Your Security+ SY0-701 Roadmap

Security+ SY0-701 certification preparation infographic

You're viewing 14 of 66 free modules

The remaining 52 modules cover advanced topics, exam traps, and scenarios that appear on the certification exam.

Unlock All : $ 29

What the exam is testing

CompTIA Security+ SY0-701 validates whether you can make sound security decisions in realistic business and technical situations. It is not primarily a vocabulary test. Expect questions that ask for the best, most appropriate, or first action when several answers appear plausible.

The exam is vendor-neutral. You must recognize the purpose of controls and tools without relying on a specific product name.

The official exam focus is to verify that you can:

assess an enterprise security posture and recommend appropriate controls;
secure hybrid environments, including cloud, mobile, operational technology, and Internet of Things devices;
operate with an awareness of governance, risk, compliance, and privacy requirements;
identify, analyze, contain, eradicate, and recover from security events and incidents.

Exam format snapshot

Item	SY0-701 exam detail
Exam version	Security+ V7
Exam code	SY0-701
Maximum number of questions	90
Time limit	90 minutes
Passing score	750 on a scale of 100–900
Question styles	Multiple-choice and performance-based questions

How to think like the exam

Use this decision sequence:

Identify the exact requirement. Is the question asking about confidentiality, integrity, availability, authentication, authorization, evidence, containment, resilience, compliance, or cost?
Respect the timing word. “First” usually means stabilize, preserve evidence, or identify scope before making a permanent change. “Best” usually means the option that most directly satisfies the requirement with the least unnecessary risk.
Prefer least privilege and reduced blast radius. Narrow access, segment networks, isolate suspicious systems, and remove unnecessary exposure.
Choose the control closest to the problem. A web application attack suggests a web-focused defense. A compromised endpoint suggests endpoint isolation and EDR. A privileged-account risk suggests PAM and just-in-time access.
Do not solve a governance problem with only a technical tool. A contract, policy, audit, exception, or risk register may be the correct answer.
Do not overreact. Avoid options that disable logging, destroy evidence, grant broad access, apply untested production changes, or rely on one control only.
Prefer repeatable and measurable controls. Centralized logging, documented procedures, version control, baselines, automation with guardrails, and validation are stronger than informal manual steps.

How to use this course

Read sections 1–4 in order for a complete foundation. Use sections 5–8 for targeted scenario practice. Use sections 9–10 in the final days before the exam.

A productive revision loop is:

review one domain;
answer a focused group of practice questions;
write down why your best wrong answer was wrong;
revisit the relevant comparison table;
repeat until you can explain the decision rule without memorizing the wording.

2. Exam Domains

Official domain priorities

Domain	Weight	Study priority	Why it matters
1.0 General Security Concepts	12%	Foundation	Establishes the language used in every other domain: controls, CIA, AAA, zero trust, change management, and cryptography.
2.0 Threats, Vulnerabilities, and Mitigations	22%	High	Tests whether you can recognize attack patterns, distinguish vulnerabilities from threats, and choose practical mitigations.
3.0 Security Architecture	18%	High	Tests design choices for cloud, networks, data protection, resilience, and secure communications.
4.0 Security Operations	28%	Highest	The largest domain. Focus on hardening, monitoring, IAM, vulnerability management, incident response, automation, and investigation data sources.
5.0 Security Program Management and Oversight	20%	High	Tests governance, risk, third-party management, compliance, audits, privacy, and awareness.

What matters most

The source bank and official blueprint point to the following high-value areas:

Security operations: incident response ordering, log selection, hardening, EDR, SIEM, IAM, PAM, vulnerability remediation, automation, and validation.
Threat recognition and mitigation: phishing, credential attacks, application attacks, network attacks, malware, social engineering, and supply-chain risk.
Architecture decisions: segmentation, zero trust, secure protocols, data states, cloud shared responsibility, backups, recovery sites, and availability design.
Risk and governance: risk treatments, BIA metrics, policy hierarchy, vendor due diligence, contracts, audits, exceptions, awareness, and privacy.
Foundational reasoning: CIA, AAA, control categories, encryption versus hashing versus signatures, PKI, and change management.

3. Start-to-Finish Study Path

Phase 1: Foundation

Build the vocabulary required to eliminate obviously wrong answers.

Study in this order:

CIA triad, AAA, non-repudiation, least privilege, separation of duties.
Control types and categories.
Hashing, encryption, digital signatures, certificates, PKI, and key management.
Threat actors, social engineering, malware, password attacks, and common web attacks.
Network basics: segmentation, DMZ, VPN, TLS, IPSec, firewalls, IDS, IPS, WAF, and NAC.

Checkpoint: You should be able to explain why a hash does not provide confidentiality, why an IDS is not an IPS, and why a broad VPN group conflicts with least privilege.

Phase 2: Intermediate application

Move from definitions to selecting the best control.

Study:

Endpoint hardening and secure baselines.
IAM lifecycle, MFA, SSO, federation, PAM, access reviews, and service accounts.
Vulnerability management: scan, prioritize, remediate, rescan, and verify.
Monitoring: SIEM, EDR, XDR, logs, packet captures, dashboards, and alerts.
Data protection: classification, encryption, tokenization, masking, DLP, retention, and disposal.
Cloud architecture and shared responsibility.
Risk register, risk treatment, RTO, RPO, MTTR, MTBF, and third-party agreements.

Checkpoint: Given a scenario, you should be able to choose the most relevant control and explain why a generic control is weaker.

Phase 3: Advanced scenario reasoning

Focus on priority, tradeoffs, and sequence.

Study:

Incident response order: preparation, detection, analysis, containment, eradication, recovery, lessons learned.
Forensic evidence: preserve before changing, maintain chain of custody, use legal hold when required.
Architecture tradeoffs: availability versus cost, convenience versus least privilege, rapid automation versus guardrails, temporary exceptions versus permanent bypasses.
Governance-document selection: policy, standard, procedure, guideline, SLA, NDA, MOU, rules of engagement.
Recovery design: backup type, immutable or offline copies, replication, journaling, snapshots, warm versus hot versus cold sites.
Zero trust and segmentation: evaluate identity, device posture, and resource-level authorization continuously.

Checkpoint: You should be able to identify why a technically useful answer may still be wrong because it occurs too early, grants too much access, destroys evidence, or fails to address the underlying cause.

Phase 4: Final review

Use sections 8–10 as a condensed review sheet. Practice mixed scenarios under time pressure. Flag questions containing BEST, FIRST, MOST likely, MOST appropriate, and Select TWO because wording determines the required reasoning style.

4. Core Concepts by Domain

Domain 1: General Security Concepts : 12%

1.1 Security control categories and functions

A control can be categorized by how it is implemented and what it does.

Implementation categories

Category	Meaning	Examples
Technical	Implemented with technology	Firewall, MFA, EDR, encryption, access control list
Managerial	Administrative oversight and governance	Risk assessment, security policy, vendor review
Operational	People-driven process	Awareness training, incident handling procedure, change review
Physical	Protects physical access or environment	Locks, bollards, guards, cameras, fencing

Functional types

Type	Purpose	Example	Common trap
Preventive	Stops an event before it occurs	MFA, firewall allowlist, locked door	Do not confuse with a control that only alerts afterward.
Detective	Identifies an event	IDS alert, log review, motion sensor	Detection does not block the attack.
Corrective	Fixes or restores after an event	Patch deployment, restore from backup	Restoration is not the same as prevention.
Deterrent	Discourages attempts	Warning sign, visible camera	A deterrent changes behavior but may not stop an attacker.
Directive	Tells people what to do	Policy, standard, security procedure	A document does not enforce a technical restriction by itself.
Compensating	Alternative when the preferred control is not feasible	Jump host and allowlisting for a legacy system lacking MFA	Use only when the preferred control cannot reasonably be implemented.

Decision rule

When the question says a preferred control is impossible because of a legacy constraint, choose a compensating control that reduces exposure and is monitored. Never choose “ignore the risk” or “publish the service directly.”

1.2 Fundamental concepts

CIA triad

Property	Question to ask	Typical failure
Confidentiality	Was information exposed to an unauthorized party?	Data leak, excessive permissions, unencrypted sensitive data
Integrity	Was data changed without authorization?	Tampering, unauthorized database edit, malicious software update
Availability	Can authorized users access the system when needed?	Denial of service, outage, ransomware disruption

AAA

Element	Purpose	Example
Authentication	Prove identity	Password, passkey, smart card, biometric
Authorization	Determine allowed actions	Role-based permissions, ACL, least privilege
Accounting	Record actions	Audit log showing commands used by an administrator

Non-repudiation

Non-repudiation provides evidence that a specific party performed an action and cannot credibly deny it later. A common mechanism is a digital signature created with the signer’s private key.

Zero trust

Zero trust assumes that network location alone is not proof of trust. Evaluate:

user identity;
device health and posture;
resource sensitivity;
context such as location and risk;
least-privilege access;
continuous verification.

Trap: “The user is on the internal network” is not enough to justify broad access.

Deception and disruption technology

Technology	Purpose
Honeypot	Decoy system intended to attract suspicious activity
Honeynet	Network of decoy systems
Honeyfile	Decoy file that should not be accessed legitimately
Honeytoken	Decoy credential or data element that triggers an alert if used

1.3 Change management

Security controls can create outages when implemented without review. A sound change process includes:

request and business justification;
impact analysis and dependency review;
approval;
testing;
communication;
implementation during an appropriate window;
monitoring;
rollback plan;
documentation updates;
version control and audit history.

Exam trap: The fastest technical fix is not always the best answer. If the question emphasizes avoiding an undocumented outage, choose assessment, approval, testing, and rollback.

1.4 Cryptographic solutions

Fast comparison

Need	Best-fit mechanism
Keep data secret	Encryption
Detect unauthorized modification	Cryptographic hashing
Verify origin and integrity	Digital signature
Verify a website or system identity	Certificate and PKI validation
Store passwords safely	Salted, slow password-hashing algorithm
Encrypt a large archive efficiently	Symmetric encryption with secure key management
Protect data in transit	TLS, IPSec, or another approved secure protocol

Symmetric versus asymmetric cryptography

Characteristic	Symmetric	Asymmetric
Keys	Same secret key encrypts and decrypts	Public/private key pair
Speed	Faster	Slower
Best use	Bulk encryption	Key exchange, digital signatures, identity verification
Main challenge	Securely distribute and protect the shared key	More computational overhead and certificate/key management complexity

Hashing, salting, and signatures

A hash is one-way and is used to verify integrity.
A salt makes identical passwords produce different stored hashes and reduces precomputed hash attacks.
A digital signature provides integrity, authenticity, and non-repudiation. It is not primarily used to keep content secret.

PKI essentials

Term	Purpose
Certificate authority (CA)	Issues and signs certificates
Registration authority (RA)	Supports identity verification before certificate issuance
Certificate signing request (CSR)	Request used to obtain a certificate
Certificate revocation list (CRL)	Published list of revoked certificates
Online Certificate Status Protocol (OCSP)	Query a certificate’s revocation status
Key escrow	Controlled storage of a cryptographic key for recovery or legal requirements

Data obfuscation techniques

Technique	Best use
Tokenization	Replace sensitive values with tokens; common for payment data
Masking	Hide portions of data from display or testing environments
Redaction	Remove sensitive content from a document or output
Hashing	Verify integrity or securely store password representations
Encryption	Keep the original data confidential while allowing authorized recovery

Domain 1 traps

Hashing is not encryption.
Encoding is not encryption.
A shared symmetric key does not prove which individual approved a transaction.
An IDS detects; it does not automatically block.
Internal network location does not eliminate the need for authorization.
A compensating control is a governed alternative, not an excuse to ignore risk.

Domain 2: Threats, Vulnerabilities, and Mitigations : 22%

lock

2.1 Threat actors and motivations

This module is part of the full course. Unlock all 66 modules + 90+ practice questions.