CompTIA Security+ (SY0-701)
0% Completed
M1 — General Security Concepts
CIA triad, non-repudiation and the vocabulary the exam assumes
Reading
Zero trust: verify explicitly, least privilege, assume breach
Reading
Control types: managerial, technical, operational and physical
Reading
Deter, detect, prevent, correct and compensate as answer choices
Reading
Scenario reasoning: choosing the control that actually fits
Reading
Where this domain usually catches people out
Reading
M2 — Threats, Vulnerabilities and Mitigations
Threat actors: nation-state, criminal, insider, hacktivist and their motives
Reading
Attack surfaces, attack vectors and the difference between them
Reading
Common attacks: phishing, on-path, injection, brute force and their mitigations
Reading
Vulnerabilities in application, cloud, mobile and AI systems
Reading
Mitigation tooling: EDR, DLP, NAC, WAF and secure baselines
Reading
Reading an advisory and deciding what it means for you
Reading
M3 — Security Architecture
Securing the network: segmentation, firewalling and secure protocols
Reading
Cloud and virtualisation security, shared responsibility and misconfiguration
Reading
Resilience: high availability, redundancy and the failure modes
Reading
Embedded and IoT security, and why it keeps ending up in headlines
Reading
Data states and data protection: in transit, at rest and in use
Reading
Secure baselines and the configuration-drift problem
Reading
M4 — Security Operations
Building, tuning and acting on security alerts and rules
Reading
The incident response lifecycle, in the order the exam expects it
Reading
Digital forensics: order of volatility and chain of custody
Reading
Hardening: host, application and cloud-image baselines
Reading
Vulnerability scanning, penetration testing and the difference between them
Reading
Automation and orchestration for an analyst, not just for engineers
Reading
M5 — Security Program Management and Oversight
Risk management: identification, analysis, response and monitoring
Reading
Governance, policies, standards and procedures as layered artefacts
Reading
Compliance and the frameworks the exam names
Reading
Third-party and supply-chain risk, and vendor assessment in practice
Reading
Audits, assessments and the evidence they demand
Reading
Security awareness training and why it is scored, not assumed
Reading
M6 — Cryptography and PKI in Practice
Symmetric and asymmetric cryptography, and where each belongs
Reading
Hashing, salting, digital signatures and non-repudiation
Reading
Certificates, certificate authorities and the chain of trust
Reading
Key management: generation, rotation, escrow and destruction
Reading
PKI failure modes: revocation, expiry and the quiet outages they cause
Reading
What quantum risk means for today’s algorithms
Reading
M7 — Identity and Access with Real Tooling
Authentication, authorization and accounting in a working system
Reading
MFA factors, phishing-resistant methods and their limits
Reading
Directory services, federation and single sign-on
Reading
Privileged access management and just-in-time elevation
Reading
Account lifecycle: joiner, mover and leaver done properly
Reading
Access reviews that produce evidence rather than a tick
Reading
M8 — Capstone: Practice Exams and Exam-Day Strategy
A full timed 90-question practice exam under real conditions
Reading
Scoring by domain to find the weak areas, not just the total
Reading
Question deconstruction: stem, distractors and the best-of-two trap
Reading
Elimination method for scenario-based wording
Reading
Exam-day logistics: time budget, flagging and review passes
Reading
A two-week revision plan built from the domain scores
Reading
📞
Enroll Now
Start Your Journey
Fill in your details and our team will get back to you within 24 hours