Security+ Study Checklist (SY0-701)

Track your readiness across all five domains of the current CompTIA Security+ exam (SY0-701). Work through each domain, mark what you know, and target the gaps. Print it and tick items as you go.

Exam at a glance

Up to 90 questions, 90 minutes, passing score 750 out of 900. SY0-701 launched in late 2023 and is the current version.

1.0 General Security Concepts

• Security control categories (technical, managerial, operational, physical) and types (preventive, deterrent, detective, corrective, compensating, directive)
• CIA triad, AAA, non-repudiation, and the gap analysis concept
• Zero Trust: control plane, data plane, policy engine, policy enforcement point
• Physical security: bollards, fencing, access control vestibules, video, sensors
• Deception and disruption: honeypots, honeynets, honeytokens
• Change management: approval, ownership, testing, backout plans, and its security impact
• Cryptography: symmetric vs asymmetric, hashing, salting, key stretching, digital signatures
• PKI: public and private keys, certificates, certificate authorities, key escrow
• Tools: TPM, HSM, secure enclave, and the role of blockchain

2.0 Threats, Vulnerabilities, and Mitigations

• Threat actors (nation-state, unskilled, hacktivist, insider, organized crime, shadow IT) and their motivations
• Threat vectors and attack surfaces: messages, files, voice, removable media, supply chain
• Social engineering: phishing, vishing, smishing, pretexting, business email compromise, pharming
• Vulnerability types: application, OS, web, hardware, virtualization, cloud, supply chain, zero-day, misconfiguration
• Indicators of malicious activity: malware (ransomware, trojan, worm, rootkit, logic bomb), network and application attacks, password attacks
• Mitigation techniques: segmentation, access control, hardening, isolation, patching, encryption, monitoring, least privilege

3.0 Security Architecture

• Architecture models: cloud, serverless, microservices, IaC, on-prem, virtualization, IoT, ICS and SCADA, embedded
• Secure infrastructure: device placement, security zones, firewalls, IDS and IPS, proxies, VPN, SD-WAN, SASE
• Data protection: classification, data states, encryption at rest and in transit, DLP, tokenization, masking
• Resilience and recovery: high availability, site considerations, backups, capacity planning, testing

4.0 Security Operations

• Secure baselines and hardening targets: workstations, mobile, servers, network devices, cloud, IoT
• Asset management: acquisition, monitoring, sanitization, and secure disposal
• Vulnerability management: scanning, threat intelligence, penetration testing, remediation, validation, reporting
• Security monitoring: SIEM, alerting, log aggregation, SNMP, NetFlow
• Enterprise capabilities: firewall, IDS and IPS, web and DNS filtering, email security, EDR and XDR, DLP
• Identity and access management: provisioning, federation, SSO, MFA, password best practices, privileged access management
• Automation and orchestration use cases and benefits
• Incident response: preparation, detection, analysis, containment, eradication, recovery, lessons learned, digital forensics

5.0 Security Program Management and Oversight

• Governance: policies, standards, procedures, guidelines, roles, and governance structures
• Risk management: assessment, analysis, risk register, tolerance and appetite, strategies, and business impact analysis (RTO, RPO, MTTR, MTBF)
• Third-party risk: vendor assessment, agreements (SLA, MOU, MOA, BPA), supply chain risk
• Compliance: reporting, monitoring, privacy, and legal considerations
• Audits and assessments: internal, external, penetration testing, attestation
• Security awareness: training, phishing campaigns, user guidance, and reporting

Want this taught live with labs and an instructor? Explore CISNET's Security+ training and the cybersecurity career path.