Complete Security+ SY0-701 study guide — 212 chapters covering all 5 exam domains with real-world examples, exam traps, and practice questions.
This guide works best as a loop: read a chapter, test yourself with practice questions, look up unfamiliar terms in the glossary, then move to the next chapter.
212 chapters covering every exam objective. Each chapter includes key concepts, exam tips, common traps, comparison tables, and a 5-question quiz at the end.
Start Chapter 1Free timed and untimed practice with instant feedback and full explanations. Pick 10–120 questions per session. Filter by domain to drill your weak areas.
Go to practice testEvery SY0-701term defined and searchable. Use it when a chapter mentions a concept you haven't seen before or want a quick refresher on.
Browse glossaryExam blueprint, domain weights, passing score, duration, cost, and registration links. Start here if you're new to this certification.
View exam guide26 chapters
Security Controls
Objective 1.1 · General Security Concepts
Cryptography Fundamentals
Objective 1.4 · General Security Concepts
PKI and Digital Certificates
Objective 1.4 · General Security Concepts
Hashing Algorithms
Objective 1.4 · General Security Concepts
Symmetric vs Asymmetric Encryption
Objective 1.4 · General Security Concepts
Authentication Methods
Objective 1.2 · General Security Concepts
Multi-Factor Authentication (MFA)
Objective 1.2 · General Security Concepts
Zero Trust Architecture
Objective 1.2 · General Security Concepts
Access Control Models (DAC, MAC, RBAC)
Objective 1.1 · General Security Concepts
CIA Triad — Confidentiality, Integrity, Availability
Objective 1.1 · General Security Concepts
Non-Repudiation and Digital Signatures
Objective 1.1 · General Security Concepts
Kerberos Authentication Protocol
Objective 1.2 · General Security Concepts
LDAP, RADIUS, and TACACS+ for Auth
Objective 1.2 · General Security Concepts
Biometric Authentication Types
Objective 1.2 · General Security Concepts
SSO, SAML, and OAuth 2.0
Objective 1.2 · General Security Concepts
Cryptographic Key Management
Objective 1.4 · General Security Concepts
Certificate Lifecycle Management
Objective 1.4 · General Security Concepts
CRL and OCSP — Certificate Revocation
Objective 1.4 · General Security Concepts
Hardware Security Modules (HSM)
Objective 1.4 · General Security Concepts
Secure Network Protocols (HTTPS, SFTP, SRTP)
Objective 1.4 · General Security Concepts
Obfuscation and Steganography
Objective 1.4 · General Security Concepts
Deception Technologies and Honeypots
Objective 1.1 · General Security Concepts
Security Gap Analysis
Objective 1.1 · General Security Concepts
Change Management in Security
Objective 1.1 · General Security Concepts
Security Baselines and Benchmarks
Objective 1.1 · General Security Concepts
Open vs Closed Security Systems
Objective 1.1 · General Security Concepts
49 chapters
Malware Types and Characteristics
Objective 2.4 · Threats Vulnerabilities Mitigations
Social Engineering Attacks
Objective 2.2 · Threats Vulnerabilities Mitigations
Phishing, Vishing, and Smishing
Objective 2.2 · Threats Vulnerabilities Mitigations
Application Attacks: SQL Injection, XSS
Objective 2.3 · Threats Vulnerabilities Mitigations
Network-Based Attacks
Objective 2.3 · Threats Vulnerabilities Mitigations
DoS and DDoS Attacks
Objective 2.3 · Threats Vulnerabilities Mitigations
Vulnerability Scanning and Assessment
Objective 2.1 · Threats Vulnerabilities Mitigations
Threat Intelligence and Indicators of Compromise
Objective 2.1 · Threats Vulnerabilities Mitigations
Password Attacks
Objective 2.4 · Threats Vulnerabilities Mitigations
Insider Threats
Objective 2.1 · Threats Vulnerabilities Mitigations
Ransomware Attacks
Objective 2.4 · Threats Vulnerabilities Mitigations
Advanced Persistent Threats (APT)
Objective 2.1 · Threats Vulnerabilities Mitigations
Supply Chain Attacks
Objective 2.1 · Threats Vulnerabilities Mitigations
Zero-Day Vulnerabilities
Objective 2.1 · Threats Vulnerabilities Mitigations
Business Email Compromise (BEC)
Objective 2.2 · Threats Vulnerabilities Mitigations
Credential Stuffing Attacks
Objective 2.4 · Threats Vulnerabilities Mitigations
Man-in-the-Middle Attacks
Objective 2.3 · Threats Vulnerabilities Mitigations
Session Hijacking and Fixation
Objective 2.3 · Threats Vulnerabilities Mitigations
Replay Attacks and Prevention
Objective 2.3 · Threats Vulnerabilities Mitigations
Pass-the-Hash and Pass-the-Ticket
Objective 2.4 · Threats Vulnerabilities Mitigations
Lateral Movement Techniques
Objective 2.4 · Threats Vulnerabilities Mitigations
Privilege Escalation Attacks
Objective 2.4 · Threats Vulnerabilities Mitigations
Rootkits and Bootkits
Objective 2.4 · Threats Vulnerabilities Mitigations
Fileless Malware Attacks
Objective 2.4 · Threats Vulnerabilities Mitigations
Cryptojacking and Resource Abuse
Objective 2.4 · Threats Vulnerabilities Mitigations
Botnets and Command-and-Control (C2)
Objective 2.4 · Threats Vulnerabilities Mitigations
Watering Hole Attacks
Objective 2.2 · Threats Vulnerabilities Mitigations
ICS and SCADA Security Threats
Objective 2.3 · Threats Vulnerabilities Mitigations
IoT Security Vulnerabilities
Objective 2.3 · Threats Vulnerabilities Mitigations
Wireless Network Attacks (Evil Twin, WPS)
Objective 2.3 · Threats Vulnerabilities Mitigations
Bluetooth Attacks (Bluejacking, Bluesnarfing)
Objective 2.3 · Threats Vulnerabilities Mitigations
Physical Security Attacks
Objective 2.2 · Threats Vulnerabilities Mitigations
Typosquatting and Domain Hijacking
Objective 2.2 · Threats Vulnerabilities Mitigations
Deepfakes and AI-Powered Attacks
Objective 2.2 · Threats Vulnerabilities Mitigations
Threat Actor Types and Motivations
Objective 2.1 · Threats Vulnerabilities Mitigations
Threat Hunting Methodology
Objective 2.1 · Threats Vulnerabilities Mitigations
Penetration Testing Types (Black/White/Grey Box)
Objective 2.1 · Threats Vulnerabilities Mitigations
Buffer Overflow Vulnerabilities
Objective 2.3 · Threats Vulnerabilities Mitigations
XML Injection and XXE Attacks
Objective 2.3 · Threats Vulnerabilities Mitigations
Injection Attacks Overview
Objective 2.3 · Threats Vulnerabilities Mitigations
Insecure Deserialization Attacks
Objective 2.3 · Threats Vulnerabilities Mitigations
Race Condition Vulnerabilities
Objective 2.3 · Threats Vulnerabilities Mitigations
Spyware and Adware
Objective 2.4 · Threats Vulnerabilities Mitigations
RFID and NFC Security Attacks
Objective 2.3 · Threats Vulnerabilities Mitigations
Shoulder Surfing and Dumpster Diving
Objective 2.2 · Threats Vulnerabilities Mitigations
Tailgating and Piggybacking
Objective 2.2 · Threats Vulnerabilities Mitigations
Drive-By Downloads
Objective 2.4 · Threats Vulnerabilities Mitigations
CVEs, CVSS Scoring, and NVD
Objective 2.1 · Threats Vulnerabilities Mitigations
Exploit Kits and Automated Attacks
Objective 2.4 · Threats Vulnerabilities Mitigations
38 chapters
Network Segmentation and Isolation
Objective 3.1 · Security Architecture
Firewall Types and Deployment
Objective 3.1 · Security Architecture
IDS vs IPS
Objective 3.1 · Security Architecture
VPN Types and Protocols
Objective 3.3 · Security Architecture
Cloud Security Fundamentals
Objective 3.6 · Security Architecture
Virtualization and Container Security
Objective 3.6 · Security Architecture
Secure Network Design Principles
Objective 3.1 · Security Architecture
Data Protection and Encryption at Rest
Objective 3.5 · Security Architecture
DMZ Architecture and Design
Objective 3.1 · Security Architecture
Proxy Servers and Forward/Reverse Proxies
Objective 3.1 · Security Architecture
Web Application Firewall (WAF)
Objective 3.1 · Security Architecture
Unified Threat Management (UTM)
Objective 3.1 · Security Architecture
Cloud Access Security Broker (CASB)
Objective 3.6 · Security Architecture
SASE — Secure Access Service Edge
Objective 3.6 · Security Architecture
Microsegmentation in Cloud and SDN
Objective 3.1 · Security Architecture
Air-Gapped Networks
Objective 3.1 · Security Architecture
Bastion Hosts and Jump Servers
Objective 3.1 · Security Architecture
Cloud-Native Security Architecture
Objective 3.6 · Security Architecture
Container and Kubernetes Security
Objective 3.6 · Security Architecture
Serverless Security Considerations
Objective 3.6 · Security Architecture
Infrastructure as Code Security
Objective 3.6 · Security Architecture
API Security — OAuth, JWT, Rate Limiting
Objective 3.1 · Security Architecture
Data Loss Prevention (DLP)
Objective 3.5 · Security Architecture
Digital Rights Management (DRM)
Objective 3.5 · Security Architecture
Secure Backup and Recovery Architecture
Objective 3.5 · Security Architecture
Redundancy and Resilience Strategies
Objective 3.4 · Security Architecture
High Availability Clustering
Objective 3.4 · Security Architecture
Geographic Redundancy and Replication
Objective 3.4 · Security Architecture
Disaster Recovery Tiers (RTO and RPO)
Objective 3.4 · Security Architecture
Third-Party Risk in Architecture
Objective 3.2 · Security Architecture
Secure Baseline Configurations
Objective 3.2 · Security Architecture
NAT and Firewall Rule Design
Objective 3.1 · Security Architecture
Load Balancer Security Considerations
Objective 3.1 · Security Architecture
Software-Defined Networking Security
Objective 3.1 · Security Architecture
Cloud IAM and Identity Architecture
Objective 3.6 · Security Architecture
Secure Software Design Principles
Objective 3.2 · Security Architecture
Supply Chain Risk Architecture
Objective 3.2 · Security Architecture
Honeynet Deployment and Design
Objective 3.1 · Security Architecture
64 chapters
Identity and Access Management
Objective 4.6 · Security Operations
Privileged Access Management
Objective 4.6 · Security Operations
Incident Response Process
Objective 4.8 · Security Operations
Log Monitoring and SIEM
Objective 4.9 · Security Operations
Endpoint Detection and Response (EDR)
Objective 4.5 · Security Operations
System and OS Hardening
Objective 4.1 · Security Operations
Patch and Vulnerability Management
Objective 4.1 · Security Operations
Digital Forensics Basics
Objective 4.8 · Security Operations
Wireless Security Protocols
Objective 4.4 · Security Operations
Email Security (SPF, DKIM, DMARC)
Objective 4.4 · Security Operations
Mobile Device Security
Objective 4.5 · Security Operations
Physical Security Controls
Objective 4.1 · Security Operations
User Provisioning and De-provisioning
Objective 4.6 · Security Operations
Account Lifecycle Management
Objective 4.6 · Security Operations
Directory Services — Active Directory
Objective 4.6 · Security Operations
Federated Identity Management
Objective 4.6 · Security Operations
Behavioral Analytics in Security
Objective 4.9 · Security Operations
UEBA — User and Entity Behavior Analytics
Objective 4.9 · Security Operations
Alert Triage and Investigation
Objective 4.8 · Security Operations
False Positive Management and Tuning
Objective 4.9 · Security Operations
XDR — Extended Detection and Response
Objective 4.9 · Security Operations
SOAR — Security Orchestration Automation
Objective 4.9 · Security Operations
Chain of Custody in Digital Forensics
Objective 4.8 · Security Operations
Memory Forensics Techniques
Objective 4.8 · Security Operations
Disk Forensics and Imaging
Objective 4.8 · Security Operations
Network Forensics and Packet Analysis
Objective 4.8 · Security Operations
Windows Event Log Analysis
Objective 4.9 · Security Operations
Linux Syslog and Journal Analysis
Objective 4.9 · Security Operations
Indicators of Compromise vs Attack (IOC/IOA)
Objective 4.9 · Security Operations
Threat Sharing — MISP, STIX, TAXII
Objective 4.9 · Security Operations
Vulnerability Management Lifecycle
Objective 4.1 · Security Operations
Vulnerability Remediation Prioritization
Objective 4.1 · Security Operations
Application Whitelisting and Control
Objective 4.1 · Security Operations
Hardening Windows Systems
Objective 4.1 · Security Operations
Hardening Linux Systems
Objective 4.1 · Security Operations
Hardening Network Devices
Objective 4.1 · Security Operations
Mobile Device Management (MDM/MAM)
Objective 4.5 · Security Operations
Container Hardening Best Practices
Objective 4.1 · Security Operations
Cloud Workload Protection
Objective 4.5 · Security Operations
DNS Filtering and Sinkholing
Objective 4.4 · Security Operations
Web Proxy Security Controls
Objective 4.4 · Security Operations
Email Security — DMARC, Advanced Threats
Objective 4.4 · Security Operations
Data Exfiltration Detection
Objective 4.9 · Security Operations
File Integrity Monitoring (FIM)
Objective 4.9 · Security Operations
Network Access Control (NAC)
Objective 4.4 · Security Operations
Incident Containment Strategies
Objective 4.8 · Security Operations
Incident Eradication and Recovery
Objective 4.8 · Security Operations
Post-Incident Review and Lessons Learned
Objective 4.8 · Security Operations
Threat Modeling — STRIDE and PASTA
Objective 4.1 · Security Operations
Red Team vs Blue Team Operations
Objective 4.1 · Security Operations
Purple Team Operations
Objective 4.1 · Security Operations
Bug Bounty Programs
Objective 4.1 · Security Operations
Secure Coding Practices (OWASP)
Objective 4.2 · Security Operations
Security Code Review
Objective 4.2 · Security Operations
DevSecOps — Security in DevOps Pipelines
Objective 4.2 · Security Operations
Cryptographic Operations in SOC
Objective 4.7 · Security Operations
Key Escrow and Recovery
Objective 4.7 · Security Operations
Certificate Pinning and Transparency
Objective 4.7 · Security Operations
DNSSEC and DNS Security
Objective 4.4 · Security Operations
Endpoint Privilege Management
Objective 4.5 · Security Operations
OT/IT Convergence Security
Objective 4.5 · Security Operations
Embedded System and Firmware Security
Objective 4.5 · Security Operations
SOC Tool Stack Overview
Objective 4.9 · Security Operations
Security Metrics and KPIs
Objective 4.9 · Security Operations
35 chapters
Risk Management Concepts
Objective 5.2 · Security Program Management
Risk Assessment and Analysis
Objective 5.2 · Security Program Management
Compliance and Regulatory Frameworks
Objective 5.4 · Security Program Management
GDPR, HIPAA, and PCI-DSS
Objective 5.4 · Security Program Management
Security Policies and Procedures
Objective 5.1 · Security Program Management
Security Awareness Training
Objective 5.6 · Security Program Management
Business Continuity and Disaster Recovery
Objective 5.3 · Security Program Management
Data Classification and Privacy
Objective 5.5 · Security Program Management
Quantitative vs Qualitative Risk Analysis
Objective 5.2 · Security Program Management
Risk Register Management
Objective 5.2 · Security Program Management
Risk Treatment — Accept, Avoid, Transfer, Mitigate
Objective 5.2 · Security Program Management
Third-Party Risk Assessment
Objective 5.4 · Security Program Management
Vendor Due Diligence in Security
Objective 5.4 · Security Program Management
Contractual Security Requirements
Objective 5.4 · Security Program Management
Privacy by Design Principles
Objective 5.5 · Security Program Management
Data Subject Rights under Privacy Law
Objective 5.5 · Security Program Management
Data Retention and Destruction Policies
Objective 5.5 · Security Program Management
Data Breach Notification Requirements
Objective 5.5 · Security Program Management
Legal Holds and e-Discovery
Objective 5.5 · Security Program Management
Information Security Governance
Objective 5.1 · Security Program Management
NIST CSF and Security Frameworks
Objective 5.1 · Security Program Management
ISO 27001 and ISMS Overview
Objective 5.1 · Security Program Management
SOC 2 and FedRAMP Compliance
Objective 5.4 · Security Program Management
Phishing Simulations and Awareness
Objective 5.6 · Security Program Management
Tabletop Exercises and Simulations
Objective 5.3 · Security Program Management
Business Impact Analysis (BIA)
Objective 5.3 · Security Program Management
Business Continuity Testing
Objective 5.3 · Security Program Management
Executive Security Reporting and Dashboards
Objective 5.1 · Security Program Management
Insider Threat Program Management
Objective 5.6 · Security Program Management
Security Budget and ROI Justification
Objective 5.1 · Security Program Management
Regulatory Investigations and Enforcement
Objective 5.4 · Security Program Management
Security SLAs and MSSPs
Objective 5.4 · Security Program Management
System Certification and Accreditation
Objective 5.1 · Security Program Management
NIST Risk Management Framework (RMF)
Objective 5.2 · Security Program Management
Security Automation in Programs
Objective 5.1 · Security Program Management
Free SY0-701 practice questions with full explanations. Test what you learn chapter by chapter.
SY0-701 Practice Questions