Free · No account required
The Security+ crash course
that isn't secretly an ad.
All five current CompTIA Security+ SY0-701 domains, condensed but real: concepts, terminology, attacks and defenses, a scenario, a diagram, exam reminders, common misconceptions, and a knowledge check — for every single domain. This won't make you an expert by itself, but you'll leave with a legitimate high-level understanding of the whole exam.
Skim it the week before your exam, or work through it domain by domain now. Either way: this is not a substitute for the full course depth, and it will not, on its own, guarantee a passing score on CompTIA's actual exam — but it's a real, honest summary of everything the exam covers.
Domain 1.0 · 12% of the exam
General Security Concepts
Why this domain exists: This domain gives you the vocabulary everything else depends on: what a control actually is, what CIA/AAA/Zero Trust mean, why change management matters, and how cryptography gets used (not the math — the decisions).
Essential concepts
- • Controls have a CATEGORY (technical, managerial, operational, physical) and a TYPE (preventive, deterrent, detective, corrective, compensating, directive) — these are two different axes, and the exam loves mixing them.
- • CIA = Confidentiality, Integrity, Availability. Almost every scenario question is secretly asking 'which of these three did the attacker actually damage?'
- • AAA = Authentication (who are you), Authorization (what can you do), Accounting (what did you do). Three separate jobs that fail independently.
- • Zero Trust means 'never trust, always verify' — no implicit trust just because traffic is 'inside' the network. It has a control plane (policy decisions) and a data plane (enforcement).
- • Change management isn't paperwork for its own sake — an undocumented change is the #1 cause of 'why did production break at 2am' incidents.
- • Cryptography basics: encryption protects confidentiality, hashing protects integrity, digital signatures protect integrity AND non-repudiation (proof of who sent it).
Terminology worth knowing cold
Non-repudiation
Proof that someone can't deny having done something — usually achieved with digital signatures.
PKI (Public Key Infrastructure)
The whole system of certificates, certificate authorities, and keys that lets strangers on the internet trust each other's identity.
Honeypot / honeytoken
Deliberately fake systems or data planted to detect and study attackers without risking anything real.
Obfuscation
Making data hard to understand without necessarily encrypting it — steganography, tokenization, and data masking are examples.
Common attacks and their defenses
| Attack / problem | Defense |
|---|---|
| Attacker relies on employees trusting anything 'inside the firewall' | Zero Trust — verify every request regardless of network location |
| An untested emergency change breaks a production system | Change management: approval process, backout plan, maintenance window |
Realistic scenario
A small medical clinic's front-desk PC has full, unrestricted access to the same network segment as the medical records server, because 'it's all inside our office anyway.' A visiting laptop plugged into an open jack could reach patient records with zero additional authentication. This is exactly the implicit-trust problem Zero Trust exists to fix.
How the exam may test this
- ⚑ If a question describes WHAT a control does physically (a lock, a badge reader), it's PHYSICAL category. If it describes a rule enforced by policy/paperwork, it's MANAGERIAL — don't confuse category with type.
- ⚑ 'Compensating control' means the ideal control isn't possible, so something else covers the gap — the exam usually phrases this as 'due to X constraint, the organization instead did Y.'
Common misconceptions
- ⚠ Myth: hashing and encryption are the same thing. Reality: hashing is one-way (you can't get the original back); encryption is two-way (you can decrypt it).
- ⚠ Myth: Zero Trust means 'no firewalls, just cloud.' Reality: Zero Trust is a philosophy (verify everything, everywhere) that can be implemented on-prem, in the cloud, or hybrid.
Knowledge check — General Security Concepts
A company requires every employee to badge into the building, but a broken badge reader on the loading dock means deliveries are currently let in by a staff member manually checking IDs. What is this manual ID-checking process, from a control-type perspective?
Domain 2.0 · 22% of the exam
Threats, Vulnerabilities, and Mitigations
Why this domain exists: The biggest 'who, how, and what breaks' domain. Threat actors and their motivations, the paths attackers use to get in, the flaws they exploit once they're in, how to recognize an attack from evidence, and what actually stops each one.
Essential concepts
- • Threat actors range from unskilled attackers (low sophistication, opportunistic) to nation-states (high sophistication, high funding, patient). Insider threats and organized crime sit in between with very different motivations.
- • Threat VECTORS are the path in (email, unsecure Wi-Fi, removable media, supply chain, social engineering). VULNERABILITIES are the weakness that gets exploited once the attacker is there.
- • Malware categories matter because they behave differently: ransomware encrypts and extorts, a worm self-replicates without your help, a Trojan disguises itself as something legitimate, a rootkit hides at a privileged level.
- • Password attacks: spraying tries one common password against MANY accounts (avoids lockouts); brute force tries MANY passwords against one account.
- • Mitigation isn't one-size-fits-all: segmentation, least privilege, patching, hardening, and monitoring each solve a different part of the problem — memorizing 'the' fix for each vulnerability type is the wrong mental model.
Terminology worth knowing cold
Zero-day
A vulnerability that's being exploited before the vendor has released (or even knows about) a fix.
Business email compromise (BEC)
An attacker impersonates an executive or vendor by email to trick someone into a wire transfer or credential handover — no malware required.
Privilege escalation
Turning limited access into greater access — going from 'regular user' to 'admin' through a flaw or misconfiguration.
Indicator of compromise (IoC)
Observable evidence something bad happened — an account lockout spike, impossible travel, unexplained resource consumption.
Common attacks and their defenses
| Attack / problem | Defense |
|---|---|
| Phishing email delivers a malicious macro-enabled document | Email security (DMARC/DKIM/SPF), user awareness training, application allow-listing |
| SQL injection through an unvalidated web form field | Input validation, parameterized queries, a web application firewall |
| Credential stuffing using a leaked password list | MFA, account lockout policy, password reuse prevention |
Realistic scenario
An online retailer's fraud team notices a spike in failed logins from many different accounts, each tried only once or twice, from a rotating set of IPs. No single account is locked out. This pattern — many accounts, few attempts each, deliberately under the lockout threshold — is the signature of password spraying, not a targeted brute-force attack against one account.
How the exam may test this
- ⚑ 'Given a scenario, analyze indicators of malicious activity' is a named objective (2.4) — expect log excerpts or behavioral descriptions, not just 'name the attack.'
- ⚑ Distinguish threat actor SOPHISTICATION from FUNDING from MOTIVATION — a question might describe a highly funded but low-skill actor (some nation-state proxies) to test that you don't conflate the two.
Common misconceptions
- ⚠ Myth: a virus and a worm are the same thing. Reality: a virus needs a host file and usually human action to spread; a worm self-propagates across a network with no help.
- ⚠ Myth: 'unskilled attacker' means low risk. Reality: unskilled attackers using off-the-shelf tools cause enormous real-world damage precisely because there are so many of them.
Knowledge check — Threats, Vulnerabilities, and Mitigations
A security analyst reviewing login logs sees one user account with 4,000 failed login attempts in ten minutes, all from a single IP address, followed by one success. Which attack does this best describe?
Domain 3.0 · 18% of the exam
Security Architecture
Why this domain exists: How environments get designed so a breach in one place doesn't become a breach everywhere — architecture models, applying security principles to infrastructure, protecting data by classification, and building in resilience for when (not if) something fails.
Essential concepts
- • Cloud, on-premises, containerized, virtualized, IoT, and ICS/SCADA environments all have different risk profiles — the exam expects you to compare them, not just define them.
- • Segmentation and zoning (like a DMZ) exist so that compromising a public-facing server doesn't hand an attacker the internal network for free.
- • Data gets classified (public, private, confidential, restricted, critical) and exists in three states: at rest, in transit, and in use — each state needs a different protection method.
- • Resilience isn't just backups. High availability, site diversity (hot/warm/cold sites), platform diversity, and tested failover all reduce single points of failure.
- • 'Given a scenario, apply security principles to secure enterprise infrastructure' (3.2) means expect a network-design decision, not a definition question.
Terminology worth knowing cold
Air-gapped
A system with no physical network connection to anything else — the strongest form of isolation, and the most operationally painful.
Infrastructure as Code (IaC)
Defining servers/networks/configuration in version-controlled files instead of clicking through a console by hand.
RTO / RPO
Recovery Time Objective (how long can we be down) and Recovery Point Objective (how much data can we afford to lose) — both drive your backup strategy.
Hot / warm / cold site
Disaster-recovery facilities ranging from fully live and ready (hot) to bare infrastructure needing setup (cold).
Common attacks and their defenses
| Attack / problem | Defense |
|---|---|
| A compromised public web server is used as a pivot point into the internal network | DMZ segmentation, internal firewall, least-privilege server-to-server access |
| Ransomware encrypts production data and the only backups are also online and reachable | Offline/immutable backups, tested recovery, backup encryption |
Realistic scenario
A school district's student information system and its public-facing enrollment portal sit on the same flat network with no firewall between them. When the enrollment portal is compromised through an outdated plugin, the attacker has a direct path to student records — because there was never a segmentation boundary to stop them.
How the exam may test this
- ⚑ Data STATE (at rest / in transit / in use) is a favorite distractor pairing — a question describing a database file on disk is 'at rest' even if the database itself is actively running.
- ⚑ Site-resilience terms (hot/warm/cold) get tested by asking you to match a recovery-time requirement to the cheapest sufficient option, not just define the terms.
Common misconceptions
- ⚠ Myth: a DMZ is 'a demilitarized zone with no security.' Reality: it's a controlled, monitored buffer zone — arguably one of the MOST watched parts of the network, not the least.
- ⚠ Myth: backups alone equal resilience. Reality: an untested backup is a hope, not a plan — the exam cares about TESTING (tabletop exercises, failover drills, parallel processing) as much as the backup itself.
Knowledge check — Security Architecture
A company needs its disaster recovery site to be fully operational within minutes of a primary-site outage, with live, continuously replicated data. Which site type best fits this requirement?
Domain 4.0 · 28% of the exam
Security Operations
Why this domain exists: The largest domain — the actual day-to-day job. Hardening systems, managing assets, running vulnerability management, monitoring and alerting, modifying enterprise defenses, identity and access management, automation, and incident response.
Essential concepts
- • Hardening means reducing attack surface: disabling unused ports/services/protocols, changing default credentials, applying secure baselines.
- • Vulnerability management is a cycle, not an event: identify (scan) → analyze (CVSS score, false-positive check) → respond/remediate (patch, compensating control) → validate (rescan) → report.
- • SIEM aggregates logs from everywhere and correlates them; SOAR takes it a step further and can automatically ACT on what SIEM finds (open a ticket, quarantine a host).
- • IAM covers the whole identity lifecycle: provisioning, authentication (including MFA factors: something you know/have/are/somewhere you are), authorization models (RBAC, ABAC, MAC, DAC), and de-provisioning.
- • Incident response has a defined process — preparation, detection, analysis, containment, eradication, recovery, lessons learned — and the exam tests correct SEQUENCING as much as definitions.
Terminology worth knowing cold
EDR / XDR
Endpoint Detection and Response monitors and responds to threats on individual devices; XDR extends that correlation across endpoints, network, and cloud.
CVSS
Common Vulnerability Scoring System — a standardized 0–10 severity score used to help PRIORITIZE which vulnerability to fix first.
SSO / federation
Single sign-on lets one login work across multiple systems; federation extends that trust across organizational boundaries (e.g. logging into a partner's app with your company identity).
Root cause analysis
Digging past the symptom of an incident to find the actual underlying reason it happened, so the fix prevents recurrence, not just cleans up this one instance.
Common attacks and their defenses
| Attack / problem | Defense |
|---|---|
| A critical vulnerability with a public exploit sits unpatched for months | A vulnerability management program with SLA-driven prioritization, not just occasional scanning |
| A former employee's account still has active access after they leave | Automated de-provisioning tied to HR offboarding, access reviews |
Realistic scenario
A manufacturing environment's vulnerability scan returns 200 findings. The security team has time to fix five before the next scan. A 'critical' CVSS 9.8 finding sits on an air-gapped historian server with no network path from the internet; a 'high' CVSS 7.5 finding sits on the internet-facing VPN gateway. Fixing strictly by CVSS score alone would prioritize the wrong one — exposure and reachability matter as much as the raw severity number.
How the exam may test this
- ⚑ 'Given a scenario, use data sources to support an investigation' (4.9) — expect to be handed a log excerpt or dashboard description and asked what it does or doesn't prove.
- ⚑ MFA 'factors' (know/have/are/somewhere) are frequently confused with MFA 'implementations' (biometrics, hardware tokens, security keys) — a factor is a CATEGORY, an implementation is a specific technology.
Common misconceptions
- ⚠ Myth: patching is the only vulnerability remediation. Reality: segmentation, compensating controls, and documented exceptions/exemptions are all legitimate responses when patching isn't immediately possible.
- ⚠ Myth: containment means the incident is over. Reality: containment just stops it from getting worse — eradication (removing the actual cause) and recovery (restoring normal operation) still have to happen.
Knowledge check — Security Operations
During an active ransomware incident, the response team disconnects the infected server from the network but has not yet removed the malware or restored from backup. Which phase of incident response are they in?
Domain 5.0 · 20% of the exam
Security Program Management and Oversight
Why this domain exists: The governance layer: how policy gets made and enforced, how risk gets measured and managed, how third parties get vetted, how compliance gets proven, how audits work, and how security awareness actually gets built.
Essential concepts
- • Governance flows downward: guidelines → policies → standards → procedures, each more specific than the last, all shaped by external considerations (regulatory, legal, industry).
- • Risk management has real math: SLE (Single Loss Expectancy) × ARO (Annualized Rate of Occurrence) = ALE (Annualized Loss Expectancy) — this is a genuinely testable calculation, not just vocabulary.
- • Risk response strategies: transfer (insurance/outsourcing), accept (with documented exemption or exception), avoid (stop doing the risky thing), mitigate (reduce likelihood or impact).
- • Third-party risk uses agreement types with distinct purposes: SLA (service levels), NDA (confidentiality), MOU/MOA (informal/formal understanding), BPA (business partnership terms).
- • Audits and assessments differ by WHO does them and WHAT they're checking: internal self-assessment vs. independent third-party audit; a penetration test can be known/unknown/partially-known environment.
Terminology worth knowing cold
Risk appetite vs. risk tolerance
Appetite is how much risk an organization WANTS to take on in general (expansionary, conservative, neutral); tolerance is the specific acceptable deviation for a given risk.
Attestation
A formal statement (often signed) that something is true or was done — used both internally (self-assessment) and externally (compliance attestation).
Right-to-audit clause
A contract term giving you the legal ability to inspect a vendor's security practices — without it, you're trusting them on faith.
Data controller vs. processor
The controller decides WHY and HOW data is processed; the processor handles data on the controller's behalf, under instruction — a core privacy-law distinction.
Common attacks and their defenses
| Attack / problem | Defense |
|---|---|
| A vendor with access to sensitive data has never been assessed for their own security practices | Vendor risk assessment, right-to-audit clauses, security questionnaires before onboarding |
| Employees can't recognize a phishing email | A structured security-awareness program: phishing simulation campaigns, recurring training, clear reporting channels |
Realistic scenario
A government contractor calculates that a specific server outage costs $50,000 per incident (SLE) and historically happens about twice a year (ARO of 2). Their ALE for that risk is $100,000/year. A vendor offers a $30,000/year redundancy contract that would eliminate the outage entirely. On pure numbers, mitigating is clearly worth it — this is exactly the kind of risk-math scenario the exam builds around real SLE/ARO/ALE figures.
How the exam may test this
- ⚑ Expect at least one SLE × ARO = ALE style calculation — practice the arithmetic, not just the definitions.
- ⚑ Penetration-testing environment types (known/unknown/partially known) map to how much information the tester was given beforehand — a favorite exact-wording distractor set.
Common misconceptions
- ⚠ Myth: 'accepting' a risk means ignoring it. Reality: formal risk acceptance requires documentation (an exemption or exception) — it's a deliberate, recorded decision, not neglect.
- ⚠ Myth: compliance and security are the same thing. Reality: an organization can be fully compliant with a framework and still have real security gaps the framework doesn't cover — they overlap but aren't identical.
Knowledge check — Security Program Management and Oversight
A retailer's PCI DSS assessment is conducted by an independent, licensed Qualified Security Assessor hired specifically to certify compliance. What type of assessment is this?
That's the whole exam, condensed. Ready to actually go deep?
See Security+ Complete ↗