CompTIA Security+ (SY0-701) — the full course

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives. The paid tier adds the 730-question exam simulator; nothing is taken away from the free course to make room for it.

47written lessons

79hands-on labs

76hours of lab work

730practice questions

Start with lesson 1 — Security controls: the four categories and the six types Exam simulator

Jump to a domain: 1. General Security Concepts · 2. Threats, Vulnerabilities, and Mitigations · 3. Security Architecture · 4. Security Operations · 5. Security Program Management and Oversight

What the exam weighs

Domain	Share of the exam	Lessons here
1. General Security Concepts	12%	6
2. Threats, Vulnerabilities, and Mitigations	22%	10
3. Security Architecture	18%	8
4. Security Operations	28%	13
5. Security Program Management and Oversight	20%	9

The curriculum

1. General Security Concepts 12% of the exam

01 Security controls: the four categories and the six types objective 1.1 part single
- Write a compensating control that an auditor would accept applied · 75 min
- Classify the controls already running on your own machine short · 30 min
02 CIA, AAA and non-repudiation, stated precisely enough to be useful objective 1.2 part single
- Produce something only you could have produced short · 30 min
03 Zero trust, and the deception technology that sits beside it objective 1.2 part single
- Shrink an implicit trust zone and measure the difference applied · 80 min
- Plant a honeyfile and prove the alert fires short · 35 min
04 Change management, which is a security control and is examined as one objective 1.3 part single
- Detect drift from a baseline you recorded yourself applied · 70 min
- Write the change record for a change you actually make short · 30 min
05 PKI, encryption and the key management that decides whether any of it works objective 1.4 part single
- Build a two-tier certificate chain and break it on purpose short · 40 min
06 Hashing, digital signatures, obfuscation and blockchain objective 1.4 part single
- Tell tokenisation, masking and encryption apart by what survives applied · 75 min
- Sign a release, distribute it, and detect a tampered copy capstone · 120 min
- Show what salting changes and what it does not short · 30 min

2. Threats, Vulnerabilities, and Mitigations 22% of the exam

01 Threat actors, sorted by what they can afford rather than by how scary they sound objective 2.1 part single
- Sort five real incidents by what the actor could afford short · 30 min
02 Motivations, shadow IT, and the threat that already has a badge objective 2.1 part single
- Build the leaver checklist by finding what you would have missed applied · 70 min
- Find the shadow IT your own DNS log already knows about short · 35 min
03 Message, voice and file-based vectors, and the social engineering behind them objective 2.2 part single
- Read the headers and decide whether the sender is real short · 35 min
04 Unsecure networks, supply chain, and the software you did not write objective 2.2 part single
- Answer 'are we affected?' from a bill of materials applied · 75 min
- Count your own attack surface, then reduce it short · 35 min
05 Application, web and operating-system vulnerabilities objective 2.3 part single
- Watch a race condition happen, then close it short · 40 min
06 Hardware, mobile, virtualisation, cloud and supply-chain vulnerabilities objective 2.3 part single
- Write the compensating control for a device that can never be patched applied · 80 min
- Find the shared responsibility line for three services short · 30 min
07 Recognising malware by the evidence it leaves objective 2.4 part single
- Detect a beacon by its regularity, not its content short · 40 min
08 Password and cryptographic attacks, and the controls that end them objective 2.4 part single
- Tell spraying and brute force apart in your own auth log short · 40 min
09 Network, application and physical attack indicators objective 2.4 part single
- Build a timeline from three sources that disagree about time applied · 80 min
- Name the attack from the log line short · 35 min
10 Mitigation techniques, chosen for the vulnerability in front of you objective 2.5 part single
- Match each mitigation to the vulnerability it actually closes applied · 75 min
- Take one lab VM from default install to defended, and measure every step capstone · 130 min
- Show an allow list stopping what a deny list cannot short · 40 min

3. Security Architecture 18% of the exam

01 On-premises, cloud and virtualisation, compared by where the risk lands objective 3.1 part single
- Show what a shared kernel shares short · 35 min
02 IoT, ICS/SCADA, embedded systems and infrastructure as code objective 3.1 part single
- Make the insecure configuration impossible to deploy applied · 80 min
- Break your own air gap four ways on paper short · 30 min
03 Device placement, security zones and attack surface objective 3.2 part single
- Prove a sensor is blind to the traffic you care about short · 40 min
04 Firewalls, appliances and selecting the control that fits objective 3.2 part single
- Make a firewall rule fail by putting it in the wrong place short · 35 min
05 Secure communication and access: VPN, tunnelling and remote work objective 3.2 part single
- Choose an access method against a constraint that rules things out applied · 75 min
- Watch what a tunnel hides and what it does not short · 40 min
06 Data types, classification, and the protection each class earns objective 3.3 part single
- Build the data inventory that a subject access request needs applied · 80 min
- Protect the same field in three states and find the gap short · 40 min
07 High availability, site resilience and power objective 3.4 part single
- Measure a failover instead of assuming it short · 40 min
08 Backups, testing, and continuity of operations objective 3.4 part single
- Show that a snapshot is not a backup applied · 70 min
- Run a recovery exercise against a stated RTO and RPO capstone · 140 min
- Restore from a backup and time it short · 45 min

4. Security Operations 28% of the exam

01 Secure baselines, and hardening the targets that appear on the exam objective 4.1 part single
- Make the baseline reapply itself applied · 75 min
- Apply a published benchmark and count what it changed short · 45 min
02 Wireless, mobile deployment, application security and sandboxing objective 4.1 part single
- Break an application with input it did not expect short · 40 min
03 Asset management, from purchase order to certificate of destruction objective 4.2 part single
- Prove data is gone, three ways, with evidence applied · 80 min
- Find the assets your inventory does not know about short · 40 min
04 Vulnerability management, end to end objective 4.3 part single
- Prioritise a finding list that the severity column gets wrong applied · 80 min
- Show a false negative appearing between two scans short · 40 min
05 Alerting and monitoring, and the tools CompTIA names objective 4.4 part single
- Forward the logs off the host before you need them applied · 75 min
- Write an alert, then tune it until it is worth reading short · 45 min
06 Modifying firewalls, IDS/IPS and the filtering layers objective 4.5 part single
- Block a name before the connection is made short · 40 min
07 DLP, NAC, EDR/XDR and email security objective 4.5 part single
- Catch a process tree that every binary in it is signed applied · 80 min
- Publish SPF, DKIM and DMARC and check they agree short · 45 min
08 Provisioning identity, single sign-on and federation objective 4.6 part single
- Show permission creep happening in one afternoon short · 40 min
09 Multifactor authentication, password concepts and privileged access objective 4.6 part single
- Remove standing privilege and measure what is left applied · 80 min
- Make a credential that expires before it can be reused short · 40 min
10 Automation and orchestration, and when not to automate objective 4.7 part single
- Build a guard rail, then try to get a bad change past it applied · 75 min
- Automate the enrichment and leave the decision alone short · 40 min
11 The incident response process, and the preparation that decides the outcome objective 4.8 part single
- Run a tabletop and find the decision nobody owns short · 45 min
12 Root cause analysis, threat hunting and digital forensics objective 4.8 part single
- Hunt from a hypothesis and leave a detection behind applied · 80 min
- Capture memory before you lose it short · 45 min
13 Reading log data and other sources to support an investigation objective 4.9 part single
- Discover what you cannot answer, and fix the collection applied · 80 min
- Investigate an incident you staged a week ago capstone · 150 min
- Build a timeline from five sources and write the finding short · 50 min

5. Security Program Management and Oversight 20% of the exam

01 Governance structures, and who is allowed to decide objective 5.1 part single
- Assign every decision in an estate to somebody who can make it short · 35 min
02 Policies, standards, procedures and guidelines, and the difference between them objective 5.1 part single
- Run a gap analysis against a standard you did not write applied · 80 min
- Split one requirement across all four document levels short · 35 min
03 Risk identification, assessment and analysis objective 5.2 part single
- Do the arithmetic until the units stop catching you out short · 30 min
04 The risk register, appetite, response strategies and business impact objective 5.2 part single
- Derive RTO and RPO from the business, then check you can meet them applied · 80 min
- Write a risk register entry somebody can actually act on short · 35 min
05 Third-party risk: assessing and selecting a vendor objective 5.3 part single
- Write a questionnaire whose answers you could check short · 35 min
06 Agreements, and monitoring a vendor after the ink dries objective 5.3 part single
- Build the vendor register and find the one nobody owns applied · 75 min
- Match the agreement to the relationship short · 30 min
07 Compliance, privacy, and the cost of getting it wrong objective 5.4 part single
- Answer an access request and a deletion request from real data applied · 80 min
- Build the obligations register you are measured against short · 35 min
08 Audits, assessments and where penetration testing fits objective 5.5 part single
- Audit your own estate and track the findings to closure applied · 80 min
- Assess the whole programme and report it to a board capstone · 150 min
- Write rules of engagement somebody could work to short · 35 min
09 Security awareness that changes behaviour rather than completion rates objective 5.6 part single
- Design a phishing campaign you could defend to HR applied · 80 min

Supplementary not examined — background reading

01 A lab you can break safely, and why your laptop is not it part single
- Prove the isolation before you trust it short · 35 min

The exam simulator

730 questions, every one mapped to an objective and to the lesson that teaches it. Timed full-length papers drawn to the real domain split, retakes weighted to your weak areas, and a readiness report from your own results.

Open the simulator See the paid tier

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.