A complete, self-paced prep course for the current CompTIA Security+ (SY0-701) certification — the DoD 8570 IAT Level II baseline and the most-requested entry-level cybersecurity cert on job postings. Includes 6 video lectures covering the exam orientation plus all 5 official domains, 6 class exercises (60 questions), 5 full-length practice exams, 3-page printable notes per lecture, official references, Pearson VUE registration walkthrough, and personalized improvement plans.
CompTIA Security+ (SY0-701) is a globally recognized, vendor-neutral entry-level cybersecurity certification. The exam launched in November 2023, replacing SY0-601. It is required or recommended by the U.S. Department of Defense (DoD 8570 IAT Level II baseline), major MSSPs, and thousands of employers hiring SOC analysts, security specialists, junior penetration testers, and network security engineers. The exam contains a maximum of 90 questions (multiple-choice + performance-based simulations) taken over 90 minutes, with a passing score of 750 on a scaled 100–900 range.
The SY0-701 blueprint is organized into five domains: (1) General Security Concepts — 12%, (2) Threats, Vulnerabilities & Mitigations — 22%, (3) Security Architecture — 18%, (4) Security Operations — 28%, and (5) Security Program Management & Oversight — 20%. Security Operations is the largest domain, so weight your study time there. Performance-Based Questions (PBQs) usually appear in the first 5–10 questions and are the highest-effort items — many test-takers flag them, complete the multiple-choice items first, and return.
Register at pearsonvue.com/comptia after purchasing an exam voucher from CompTIA's store (US $404 retail — cheaper voucher + practice bundles are common). You can test at any Pearson VUE test center or take the exam online with OnVUE remote proctoring. Bring two forms of valid, unexpired photo ID. Certification is valid for 3 years; you renew by earning 50 Continuing Education Units (CEUs) or passing a higher-level CompTIA exam like CySA+, PenTest+, or CASP+.
The CIA triad — Confidentiality, Integrity, Availability — is the foundation. Confidentiality prevents unauthorized disclosure (achieved via encryption, access control, MFA). Integrity ensures data is unaltered (hashing with SHA-256, digital signatures, HMAC). Availability guarantees access when needed (redundancy, load balancing, RAID, DR sites). AAA — Authentication (proving identity), Authorization (what you're allowed to do), and Accounting (audit logs) — extends this and is enforced by systems like RADIUS, TACACS+, and Kerberos.
Security controls fall into three categories by function — preventive (firewall, MFA), detective (IDS, SIEM), and corrective (patching, backup restore) — and four categories by type: technical (encryption), managerial (policy), operational (awareness training), and physical (locks, mantraps, bollards). Compensating controls substitute for a required control that cannot be implemented. Zero Trust is the modern model: 'never trust, always verify' — every request is authenticated, authorized, and encrypted regardless of network location, using a Policy Engine + Policy Administrator + Policy Enforcement Point architecture.
Cryptography basics: symmetric ciphers (AES-256, ChaCha20) use one shared key and are fast — good for bulk data. Asymmetric ciphers (RSA, ECC) use a public/private key pair — good for key exchange and digital signatures but slow. Hashing (SHA-256, SHA-3, BLAKE2) is one-way and produces a fixed-length digest. Public Key Infrastructure (PKI) uses X.509 certificates issued by a trusted Certificate Authority (CA) with a chain of trust; certificates are validated via CRL or OCSP. Change management (RFC → CAB approval → maintenance window → rollback plan → post-change review) prevents most self-inflicted outages.
Threat actors are ranked by capability and intent. Nation-state APTs (Advanced Persistent Threats) have unlimited budget, custom zero-days, and long dwell times. Organized crime targets money (ransomware, banking trojans, BEC). Hacktivists pursue ideology (DDoS, defacement). Insider threats — malicious or negligent — are among the hardest to detect because they hold legitimate credentials. Script kiddies use pre-built tools; shadow IT (unauthorized SaaS) creates unmanaged risk. Every threat actor has a motivation (financial, political, ethical, retaliation, espionage) and a level of sophistication that shapes your defense.
Common attack vectors: phishing/spear-phishing/whaling (email), smishing (SMS), vishing (voice), pretexting, business-email compromise, watering-hole attacks, supply-chain compromise, USB drops, and misconfigured cloud storage. Malware categories: ransomware (encrypts + extorts), trojans (disguised), worms (self-propagating), rootkits (kernel-level persistence), fileless malware (lives in RAM/PowerShell), keyloggers, spyware, and logic bombs. Application attacks: SQL injection, cross-site scripting (XSS: stored / reflected / DOM), CSRF, directory traversal, buffer overflow, race conditions, and API abuse.
Mitigation techniques map directly to attack categories. Against phishing: DMARC/SPF/DKIM email authentication + user training + email gateway sandboxing. Against ransomware: 3-2-1 backups (3 copies, 2 media, 1 offsite), immutable backups, EDR, application allow-listing, and network segmentation. Against SQLi and XSS: parameterized queries, prepared statements, output encoding, Content Security Policy, and a WAF. Against insider threat: least privilege, separation of duties, mandatory vacation, job rotation, and UEBA. Vulnerability management follows a lifecycle: identify (scan) → prioritize (CVSS + business context) → remediate (patch/mitigate/accept) → verify (rescan) → report.
Architectural models: on-premises (full control, high capex), private cloud (dedicated hardware in a provider DC), public cloud (multi-tenant IaaS/PaaS/SaaS), hybrid, and community cloud. The shared responsibility model is critical: with IaaS the customer secures OS, apps, and data; with PaaS the customer secures apps and data; with SaaS only data and identity. Serverless (FaaS) and containers (Docker/Kubernetes) shift more security to the provider but introduce their own attack surface (misconfigured IAM roles, exposed API endpoints, container escape).
Network security design: DMZ (screened subnet) hosts internet-facing services; East-West traffic between microservices needs microsegmentation via VLANs, SDN, or service mesh. Firewalls: stateless (packet filter), stateful, next-generation (NGFW with IPS/DPI), web application firewall (WAF at L7), and unified threat management (UTM). Secure Access Service Edge (SASE) collapses SD-WAN + CASB + ZTNA + SWG + FWaaS into a single cloud-delivered stack. VPN types: site-to-site (IPsec tunnel between offices), remote access (SSL VPN), and split-tunnel vs full-tunnel — split-tunnel improves performance but risks split-horizon data leakage.
Data protection and resilience: classify data (public, internal, confidential, restricted). Protect data at rest with full-disk or file-level encryption (BitLocker, LUKS, TDE for databases), data in transit with TLS 1.3 or IPsec, and data in use with confidential computing (Intel SGX, AMD SEV). Data loss prevention (DLP) inspects egress for regulated content. Resilience patterns: high availability (active-active clusters, load balancers), fault tolerance (RAID, redundant PSUs), disaster recovery sites (hot / warm / cold), RTO (how fast to recover) and RPO (how much data loss is tolerated), 3-2-1 backups, immutable backups against ransomware, and geographic diversity. Test the DR plan with tabletop exercises and full failover drills.
Identity and Access Management (IAM): authentication factors — something you know (password, PIN), have (token, smart card, phone), are (biometric), do (behavior), and somewhere you are (geolocation). Multi-factor authentication (MFA) combines two or more factors. Federated identity (SAML, OAuth 2.0, OpenID Connect) enables SSO across organizations. Access control models: DAC (owner decides), MAC (system enforces labels), RBAC (role-based, most common), ABAC (attribute-based, most flexible), and rule-based. Least privilege and separation of duties are foundational; privileged access management (PAM) vaults break-glass accounts and rotates credentials.
System hardening reduces attack surface: disable unused services, remove default accounts, apply CIS Benchmarks, enable host-based firewall + EDR, enforce full-disk encryption, and patch on a defined cadence (typically 30 days for high, 14 for critical). Monitoring stack: logs (syslog, Windows Event Log) → SIEM (Splunk, Sentinel, Elastic) → correlation rules → SOAR playbooks for automated response. NetFlow/sFlow show traffic patterns. IDS detects; IPS prevents. EDR/XDR gives endpoint visibility and response. Baseline every asset — deviations are alerts.
Incident response follows NIST SP 800-61: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Lessons Learned. Digital forensics preserves evidence with a documented chain of custody, uses write-blockers, images the target with dd or FTK Imager, and hashes originals + copies (SHA-256). Volatile evidence is captured first (order of volatility: CPU registers → RAM → network state → running processes → disk → archived media). Legal hold suspends normal retention. Automation (SOAR, Ansible, Terraform) handles repeatable response — auto-quarantine a phishing email, auto-isolate an infected endpoint, auto-block a malicious IP.
Governance provides the structure — policies (mandatory), standards (specific implementations), guidelines (recommendations), and procedures (step-by-step). Governance frameworks include NIST CSF (Identify, Protect, Detect, Respond, Recover), ISO/IEC 27001/27002, COBIT, and CIS Controls v8. Roles: Data Owner (accountable for classification), Data Custodian (technical stewardship), Data Steward (quality), Data Processor (acts on behalf of controller), and Data Subject (the individual). RACI matrices clarify Responsible/Accountable/Consulted/Informed for each control.
Risk management lifecycle: identify assets → identify threats and vulnerabilities → assess impact and likelihood (qualitative: High/Medium/Low; quantitative: SLE = Asset Value × Exposure Factor, ALE = SLE × ARO) → treat risk (avoid, transfer via insurance, mitigate, accept) → monitor. Risk register tracks each risk with owner, treatment, and status. Key metrics: KRI (Key Risk Indicator) trends toward incidents, KPI (Key Performance Indicator) measures program health. Business impact analysis (BIA) drives DR/BCP planning by identifying critical processes, MTD (Maximum Tolerable Downtime), RTO, RPO, and dependencies.
Compliance regimes: PCI DSS (payment cards), HIPAA (US healthcare PHI), GDPR (EU personal data — 72-hour breach notification), CCPA/CPRA (California), SOX (financial reporting), FISMA + FedRAMP (US federal), GLBA (financial), FERPA (education). Third-party risk uses SLAs, MSAs, NDAs, BPA (business partner agreement), and MOUs; vet vendors with SOC 2 Type II reports and questionnaires like SIG or CAIQ. Security awareness training must be role-based, tested with simulated phishing, and refreshed at least annually. Anomalous user behavior is baselined and monitored with UEBA. A privacy program includes DPIAs, data minimization, purpose limitation, and a documented data-retention schedule.