CompTIA Security+ Study Guide

By EarnITCerts · Written by a university cybersecurity instructor who has passed 50+ IT certification exams

The CompTIA Security+ (SY0-701) exam validates foundational cybersecurity skills required to assess security posture, implement zero-trust controls, monitor hybrid environments, and comply with legal frameworks. Below is the complete curriculum organized by domain weight, highlighting the exact distinctions tested on exam day.

1. The CIA Triad & Non-Repudiation

• Confidentiality: Preventing unauthorized data disclosure. Achieved via symmetric/asymmetric encryption (AES-256), access control lists (ACLs), role-based permissions, and data masking.
• Integrity: Guaranteeing data cannot be altered undetected. Enforced through cryptographic hashing (SHA-256, SHA-3) and digital signatures.
• Availability: Ensuring authorized users have uninterrupted access. Maintained via redundant infrastructure (clustering, load balancing, RAID), UPS systems, and active DDoS mitigations.
• Non-Repudiation: The assurance that an individual cannot deny the authenticity of their signature or message. Created by combining integrity (hashing) with authentication (asymmetric private key signing).

2. The AAA Framework

• Authentication (AuthN): Proving identity ("Who are you?"). Relies on Something you know (password), Something you have (hardware token/authenticator app), Something you are (biometrics), Somewhere you are (geolocation), or Something you do (keystroke dynamics).
• Authorization (AuthZ): Granting explicit access ("What are you allowed to do?"). Dictated by models such as RBAC (Role-Based), ABAC (Attribute-Based: e.g., device posture + IP + time), and MAC (Mandatory / Security Labels).
• Accounting: Tracking resource utilization and maintaining tamper-evident audit trails (log reviews, SIEM ingestion).

3. Zero Trust Architecture (ZTA)

Zero Trust replaces perimeter-based security ("castle-and-moat") with the principle: "Never trust, always verify." Core tenets include:

• Assume Breach: Design defense-in-depth under the presumption an attacker is already inside the internal subnet.
• Least Privilege: Grant users only the minimum access needed for their specific job function, strictly bounded by Just-In-Time (JIT) access.
• Continuous Verification: Inspect identity, device health, and context at every session request (ZTNA).
• Microsegmentation: Dividing workloads into granular network zones to stop lateral movement.

1. Threat Actors & Motivations

• Nation-State / APT (Advanced Persistent Threat): Highly funded, patient, sophisticated espionage targeting critical infrastructure or IP.
• Organized Crime: Economically motivated; primary driver behind double-extortion ransomware and business email compromise (BEC).
• Hacktivists: Motivated by political, philosophical, or ideological agendas (e.g., website defacement, public leaks).
• Insider Threats: Disgruntled employees, contractors, or careless staff. Highest risk because they already hold legitimate network credentials.

2. Social Engineering Vectors

• Phishing: Broad email scams casting a wide net.
• Spear Phishing: Highly targeted emails customized to a specific individual or team.
• Whaling: Spear phishing aimed directly at C-suite executives and senior leaders.
• Vishing & Smishing: Voice phishing (phone calls) and SMS text phishing.
• Pretexting: Fabricating a believable scenario (e.g., posing as tier-1 IT support) to manipulate victims into giving credentials.

3. Application & Web Attacks

• SQL Injection (SQLi): Malicious SQL code injected into input fields to bypass auth or dump database contents. Mitigation: Parameterized queries and prepared statements.
• Cross-Site Scripting (XSS): Injected scripts executed in the browser of another user. Mitigation: Robust input sanitization and Content Security Policy (CSP).
• Cross-Site Request Forgery (CSRF): Forces an authenticated user to unknowingly submit unauthorized commands. Mitigation: Anti-CSRF tokens and SameSite cookie attributes.
• Buffer Overflow: Overwriting allocated memory space to execute arbitrary shellcode. Mitigation: Bounds checking, ASLR, and memory-safe languages.

1. Cloud & Shared Responsibility Model

2. Network Security Architecture

• Next-Generation Firewall (NGFW): Operates up to Layer 7 (Application Layer); inspects packet payloads, enforces IPS rules, and detects SSL/TLS-encrypted malware.
• DMZ / Screened Subnet: A buffer zone hosting public-facing services (web, DNS, mail) isolated between an external and internal firewall.
• Jump Server / Bastion Host: A hardened server used solely to securely access private subnets via encrypted SSH/RDP sessions.
• Air-Gapping: Complete physical isolation of sensitive networks (such as industrial SCADA/ICS control systems) with zero network connectivity.

Representing 28% of the examination, Security Operations is the heaviest domain on SY0-701. You will be tested heavily on incident response workflows, logging tools, and digital forensics.

1. Incident Response Lifecycle (NIST & PICERL)

1. Preparation: Establishing policies, hardening playbooks, training the CIRT, and deploying monitoring sensors.
2. Identification (Detection): Analyzing SIEM alerts, IDS thresholds, and anomaly baselines to confirm a security event is a true incident.
3. Containment: Isolating affected subnets, severing C2 (command and control) channels, or disconnecting infected endpoints to halt lateral spread.
4. Eradication: Sanitizing systems, reimaging compromised drives, revoking compromised credentials, and closing exploited vulnerabilities.
5. Recovery: Restoring clean systems from verified offline backups, monitoring closely for recurring malicious activity.
6. Lessons Learned: Retrospective review held within two weeks to update procedures, improve defenses, and document root causes.

2. Digital Forensics & Order of Volatility

When collecting digital evidence, capture sources from most volatile (lost on power-off) to least volatile:

1. CPU Registers & Cache
2. Routing Tables, ARP Cache, Kernel Statistics & Process Tables
3. System Memory (RAM)
4. Temporary File Systems / Swap Space
5. Hard Disk Drives, SSDs, & Flash Media
6. Remote Logs & Monitoring Data
7. Physical Archival Media (Tapes, Optical)

1. Quantitative Risk Assessment

CompTIA loves quantitative risk scenarios. Commit these three formulas to memory:

• SLE = AV × EF · Single Loss Expectancy = Asset Value × Exposure Factor (% of asset destroyed by a single incident).
• ALE = SLE × ARO · Annualized Loss Expectancy = Single Loss Expectancy × Annualized Rate of Occurrence (how many times per year it happens).
• Cost-Benefit Analysis: A security control is justified only if the annualized cost of the safeguard is less than the reduction in ALE: (ALE_before - ALE_after) - Annual_Cost_of_Control > 0.

2. Business Continuity Metrics

• RTO (Recovery Time Objective): The maximum acceptable duration of system downtime after an outage before irreversible damage occurs ("How fast must we be back up?").
• RPO (Recovery Point Objective): The maximum tolerable amount of data loss measured in time ("How much data can we afford to lose?"). Dictates backup frequency.
• MTBF (Mean Time Between Failures): Average expected operating lifetime of a repairable system component.
• MTTR (Mean Time to Repair): Average time taken to repair and restore a failed system.

Expect multiple questions and PBQs requiring you to configure firewall rules, ACLs, or interpret packet captures based on standard ports:

Every Security+ exam begins with 3 to 5 Performance-Based Questions (simulations, drag-and-drops, log analysis, and network diagram configurations). Use this 4-step framework:

1. Flag and Skip Initially: Do not burn 25 minutes on PBQ #1. Flag all PBQs immediately, proceed to the 75+ multiple-choice questions, build testing momentum, and return to PBQs with 30–35 minutes remaining.
2. Firewall PBQs (Implicit Deny): When configuring an ACL or firewall table, remember that packet filters evaluate rules top-to-bottom. Specific ALLOW rules must go first, followed by an implicit DENY ANY ANY at the bottom.
3. Remediation PBQs: If asked to remediate an active ransomware or malware outbreak, disconnect the network cable / isolate the host first before running antivirus scans or memory dumps.
4. Certificate PBQs: Matching certificate formats is common:
   • .PEM / .CRT: Base64 ASCII format, starts with -----BEGIN CERTIFICATE-----.
   • .DER: Binary encoding, commonly used in Java or single certs.
   • .PFX / .P12: PKCS#12 format used to package both public certificate AND private key (password protected).