CompTIA Security+ SY0-701The Complete Beginner's Guide

Security Controls

Objective 1.1 · General Security Concepts

Cryptography Fundamentals

Objective 1.4 · General Security Concepts

PKI and Digital Certificates

Objective 1.4

Hashing Algorithms

Objective 1.4

Symmetric vs Asymmetric Encryption

Objective 1.4

Authentication Methods

Objective 1.2 · General Security Concepts

Multi-Factor Authentication (MFA)

Objective 1.2

Zero Trust Architecture

Objective 1.2

Access Control Models (DAC, MAC, RBAC)

Objective 1.1

CIA Triad — Confidentiality, Integrity, Availability

Objective 1.1

Non-Repudiation and Digital Signatures

Objective 1.1

Kerberos Authentication Protocol

Objective 1.2

LDAP, RADIUS, and TACACS+ for Auth

Objective 1.2

Biometric Authentication Types

Objective 1.2

SSO, SAML, and OAuth 2.0

Objective 1.2

Cryptographic Key Management

Objective 1.4

Certificate Lifecycle Management

Objective 1.4

CRL and OCSP — Certificate Revocation

Objective 1.4

Hardware Security Modules (HSM)

Objective 1.4

Secure Network Protocols (HTTPS, SFTP, SRTP)

Objective 1.4

Obfuscation and Steganography

Objective 1.4

Deception Technologies and Honeypots

Objective 1.1

Security Gap Analysis

Objective 1.1

Change Management in Security

Objective 1.1

Security Baselines and Benchmarks

Objective 1.1

Open vs Closed Security Systems

Objective 1.1

Malware Types and Characteristics

Objective 2.4 · Threats Vulnerabilities Mitigations

Social Engineering Attacks

Objective 2.2 · Threats Vulnerabilities Mitigations

Phishing, Vishing, and Smishing

Objective 2.2

Application Attacks: SQL Injection, XSS

Objective 2.3 · Threats Vulnerabilities Mitigations

Network-Based Attacks

Objective 2.3

DoS and DDoS Attacks

Objective 2.3

Vulnerability Scanning and Assessment

Objective 2.1 · Threats Vulnerabilities Mitigations

Threat Intelligence and Indicators of Compromise

Objective 2.1

Password Attacks

Objective 2.4

Insider Threats

Objective 2.1

Ransomware Attacks

Objective 2.4

Advanced Persistent Threats (APT)

Objective 2.1

Supply Chain Attacks

Objective 2.1

Zero-Day Vulnerabilities

Objective 2.1

Business Email Compromise (BEC)

Objective 2.2

Credential Stuffing Attacks

Objective 2.4

Man-in-the-Middle Attacks

Objective 2.3

Session Hijacking and Fixation

Objective 2.3

Replay Attacks and Prevention

Objective 2.3

Pass-the-Hash and Pass-the-Ticket

Objective 2.4

Lateral Movement Techniques

Objective 2.4

Privilege Escalation Attacks

Objective 2.4

Rootkits and Bootkits

Objective 2.4

Fileless Malware Attacks

Objective 2.4

Cryptojacking and Resource Abuse

Objective 2.4

Botnets and Command-and-Control (C2)

Objective 2.4

Watering Hole Attacks

Objective 2.2

ICS and SCADA Security Threats

Objective 2.3

IoT Security Vulnerabilities

Objective 2.3

Wireless Network Attacks (Evil Twin, WPS)

Objective 2.3

Bluetooth Attacks (Bluejacking, Bluesnarfing)

Objective 2.3

Physical Security Attacks

Objective 2.2

Typosquatting and Domain Hijacking

Objective 2.2

Deepfakes and AI-Powered Attacks

Objective 2.2

Threat Actor Types and Motivations

Objective 2.1

Threat Hunting Methodology

Objective 2.1

Penetration Testing Types (Black/White/Grey Box)

Objective 2.1

Buffer Overflow Vulnerabilities

Objective 2.3

XML Injection and XXE Attacks

Objective 2.3

Injection Attacks Overview

Objective 2.3

Insecure Deserialization Attacks

Objective 2.3

Race Condition Vulnerabilities

Objective 2.3

Spyware and Adware

Objective 2.4

RFID and NFC Security Attacks

Objective 2.3

Shoulder Surfing and Dumpster Diving

Objective 2.2

Tailgating and Piggybacking

Objective 2.2

Drive-By Downloads

Objective 2.4

CVEs, CVSS Scoring, and NVD

Objective 2.1

Exploit Kits and Automated Attacks

Objective 2.4

Network Segmentation and Isolation

Objective 3.1 · Security Architecture

Firewall Types and Deployment

Objective 3.1

IDS vs IPS

Objective 3.1

VPN Types and Protocols

Objective 3.3 · Security Architecture

Cloud Security Fundamentals

Objective 3.6 · Security Architecture

Virtualization and Container Security

Objective 3.6

Secure Network Design Principles

Objective 3.1

Data Protection and Encryption at Rest

Objective 3.5 · Security Architecture

DMZ Architecture and Design

Objective 3.1

Proxy Servers and Forward/Reverse Proxies

Objective 3.1

Web Application Firewall (WAF)

Objective 3.1

Unified Threat Management (UTM)

Objective 3.1

Cloud Access Security Broker (CASB)

Objective 3.6

SASE — Secure Access Service Edge

Objective 3.6

Microsegmentation in Cloud and SDN

Objective 3.1

Air-Gapped Networks

Objective 3.1

Bastion Hosts and Jump Servers

Objective 3.1

Cloud-Native Security Architecture

Objective 3.6

Container and Kubernetes Security

Objective 3.6

Serverless Security Considerations

Objective 3.6

Infrastructure as Code Security

Objective 3.6

API Security — OAuth, JWT, Rate Limiting

Objective 3.1

Data Loss Prevention (DLP)

Objective 3.5

Digital Rights Management (DRM)

Objective 3.5

Secure Backup and Recovery Architecture

Objective 3.5

Redundancy and Resilience Strategies

Objective 3.4 · Security Architecture

High Availability Clustering

Objective 3.4

Geographic Redundancy and Replication

Objective 3.4

Disaster Recovery Tiers (RTO and RPO)

Objective 3.4

Third-Party Risk in Architecture

Objective 3.2 · Security Architecture

Secure Baseline Configurations

Objective 3.2

NAT and Firewall Rule Design

Objective 3.1

Load Balancer Security Considerations

Objective 3.1

Software-Defined Networking Security

Objective 3.1

Cloud IAM and Identity Architecture

Objective 3.6

Secure Software Design Principles

Objective 3.2

Supply Chain Risk Architecture

Objective 3.2

Honeynet Deployment and Design

Objective 3.1

Identity and Access Management

Objective 4.6 · Security Operations

Privileged Access Management

Objective 4.6

Incident Response Process

Objective 4.8 · Security Operations

Log Monitoring and SIEM

Objective 4.9 · Security Operations

Endpoint Detection and Response (EDR)

Objective 4.5 · Security Operations

System and OS Hardening

Objective 4.1 · Security Operations

Patch and Vulnerability Management

Objective 4.1

Digital Forensics Basics

Objective 4.8

Wireless Security Protocols

Objective 4.4 · Security Operations

Email Security (SPF, DKIM, DMARC)

Objective 4.4

Mobile Device Security

Objective 4.5

Physical Security Controls

Objective 4.1

User Provisioning and De-provisioning

Objective 4.6

Account Lifecycle Management

Objective 4.6

Directory Services — Active Directory

Objective 4.6

Federated Identity Management

Objective 4.6

Behavioral Analytics in Security

Objective 4.9

UEBA — User and Entity Behavior Analytics

Objective 4.9

Alert Triage and Investigation

Objective 4.8

False Positive Management and Tuning

Objective 4.9

XDR — Extended Detection and Response

Objective 4.9

SOAR — Security Orchestration Automation

Objective 4.9

Chain of Custody in Digital Forensics

Objective 4.8

Memory Forensics Techniques

Objective 4.8

Disk Forensics and Imaging

Objective 4.8

Network Forensics and Packet Analysis

Objective 4.8

Windows Event Log Analysis

Objective 4.9

Linux Syslog and Journal Analysis

Objective 4.9

Indicators of Compromise vs Attack (IOC/IOA)

Objective 4.9

Threat Sharing — MISP, STIX, TAXII

Objective 4.9

Vulnerability Management Lifecycle

Objective 4.1

Vulnerability Remediation Prioritization

Objective 4.1

Application Whitelisting and Control

Objective 4.1

Hardening Windows Systems

Objective 4.1

Hardening Linux Systems

Objective 4.1

Hardening Network Devices

Objective 4.1

Mobile Device Management (MDM/MAM)

Objective 4.5

Container Hardening Best Practices

Objective 4.1

Cloud Workload Protection

Objective 4.5

DNS Filtering and Sinkholing

Objective 4.4

Web Proxy Security Controls

Objective 4.4

Email Security — DMARC, Advanced Threats

Objective 4.4

Data Exfiltration Detection

Objective 4.9

File Integrity Monitoring (FIM)

Objective 4.9

Network Access Control (NAC)

Objective 4.4

Incident Containment Strategies

Objective 4.8

Incident Eradication and Recovery

Objective 4.8

Post-Incident Review and Lessons Learned

Objective 4.8

Threat Modeling — STRIDE and PASTA

Objective 4.1

Red Team vs Blue Team Operations

Objective 4.1

Purple Team Operations

Objective 4.1

Bug Bounty Programs

Objective 4.1

Secure Coding Practices (OWASP)

Objective 4.2 · Security Operations

Security Code Review

Objective 4.2

DevSecOps — Security in DevOps Pipelines

Objective 4.2

Cryptographic Operations in SOC

Objective 4.7 · Security Operations

Key Escrow and Recovery

Objective 4.7

Certificate Pinning and Transparency

Objective 4.7

DNSSEC and DNS Security

Objective 4.4

Endpoint Privilege Management

Objective 4.5

OT/IT Convergence Security

Objective 4.5

Embedded System and Firmware Security

Objective 4.5

SOC Tool Stack Overview

Objective 4.9

Security Metrics and KPIs

Objective 4.9

Risk Management Concepts

Objective 5.2 · Security Program Management

Risk Assessment and Analysis

Objective 5.2

Compliance and Regulatory Frameworks

Objective 5.4 · Security Program Management

GDPR, HIPAA, and PCI-DSS

Objective 5.4

Security Policies and Procedures

Objective 5.1 · Security Program Management

Security Awareness Training

Objective 5.6 · Security Program Management

Business Continuity and Disaster Recovery

Objective 5.3 · Security Program Management

Data Classification and Privacy

Objective 5.5 · Security Program Management

Quantitative vs Qualitative Risk Analysis

Objective 5.2

Risk Register Management

Objective 5.2

Risk Treatment — Accept, Avoid, Transfer, Mitigate

Objective 5.2

Third-Party Risk Assessment

Objective 5.4

Vendor Due Diligence in Security

Objective 5.4

Contractual Security Requirements

Objective 5.4

Privacy by Design Principles

Objective 5.5

Data Subject Rights under Privacy Law

Objective 5.5

Data Retention and Destruction Policies

Objective 5.5

Data Breach Notification Requirements

Objective 5.5

Legal Holds and e-Discovery

Objective 5.5

Information Security Governance

Objective 5.1

NIST CSF and Security Frameworks

Objective 5.1

ISO 27001 and ISMS Overview

Objective 5.1

SOC 2 and FedRAMP Compliance

Objective 5.4

Phishing Simulations and Awareness

Objective 5.6

Tabletop Exercises and Simulations

Objective 5.3

Business Impact Analysis (BIA)

Objective 5.3

Business Continuity Testing

Objective 5.3

Executive Security Reporting and Dashboards

Objective 5.1

Insider Threat Program Management

Objective 5.6

Security Budget and ROI Justification

Objective 5.1

Regulatory Investigations and Enforcement

Objective 5.4

Security SLAs and MSSPs

Objective 5.4

System Certification and Accreditation

Objective 5.1

NIST Risk Management Framework (RMF)

Objective 5.2

Security Automation in Programs

Objective 5.1