Security+ SY0-701 Skills Measured

Know CIA, AAA, nonrepudiation, control categories, cryptographic basics, zero trust, least privilege, segmentation, and secure configuration. Scenario clues often ask whether the problem is confidentiality, integrity, availability, authentication, authorization, or accountability.

Study malware, ransomware, phishing, BEC, password attacks, wireless attacks, social engineering, injection, privilege escalation, DDoS, and insider threats. Pair each threat with a practical mitigation: MFA, patching, EDR, filtering, segmentation, input validation, backups, or awareness training.

Architecture questions test secure design choices: firewalls, DMZs, NAC, VPNs, proxies, load balancers, cloud shared responsibility, high availability, disaster recovery, data classification, PKI, certificates, and identity federation. The right answer often reduces blast radius or improves resilience.

Operations covers monitoring, logging, SIEM, SOAR, EDR, XDR, vulnerability management, incident response, containment, eradication, recovery, DNS security, backups, patching, and secure baselines. Know the difference between detecting a problem and fixing its root cause.

Governance questions involve policies, standards, procedures, guidelines, risk appetite, risk register, business impact analysis, tabletop exercises, auditing, vendor risk, change management, awareness, and compliance. These questions test process discipline, not just tools.

MFA, SSO, SAML, OAuth, OpenID Connect, RBAC, ABAC, PAM, and account lifecycle controls all solve different identity problems. Candidates often choose the tool they recognize instead of the one that matches the scenario.

Hashing verifies integrity; salting strengthens password storage; encryption protects confidentiality; digital signatures support integrity, authentication, and nonrepudiation; certificates bind identities to public keys. Expired or misissued certificates create trust failures, not simply “network issues.”

Security+ expects risk tradeoffs. A critical vulnerability on an internet-facing server is not equal to a low-impact internal finding. Prioritize by likelihood, impact, exploitability, asset value, exposure, and available compensating controls.