1.1 Compare and contrast various types of security controls.
- Categories: technical, managerial, operational, physical
- Control types: preventive, deterrent, detective, corrective, compensating, directive
This is the list for SY0-701 (Security+ V7), the exam you can sit today, which CompTIA lists as retiring in English on 11 June 2027. Not booked yet, or not sure? Study for SY0-801, the newer exam: see the SY0-801 objectives. Every plan includes both courses.
The weights are the share of the exam each domain takes, as published by CompTIA. A domain’s weight is spread across its objectives, so a single objective in Security Operations (nine objectives sharing 28%) is worth about the same as one in General Security Concepts (four objectives sharing 12%). The objective titles follow CompTIA’s wording; the sub-topic lists are the course’s working summary of the official sub-bullets.
1.0 General Security Concepts
12% of the exam, 4 objectives
1.2 Summarize fundamental security concepts.
- Confidentiality, integrity, and availability (CIA)
- Non-repudiation
- Authentication, authorization, and accounting (AAA): authenticating people, authenticating systems, authorization models
- Gap analysis
- Zero Trust: control plane (adaptive identity, threat scope reduction, policy-driven access control, Policy Administrator, Policy Engine); data plane (implicit trust zones, subject/system, Policy Enforcement Point)
- Physical security: bollards, access control vestibule, fencing, video surveillance, security guard, access badge, lighting, sensors (infrared, pressure, microwave, ultrasonic)
- Deception and disruption technology: honeypot, honeynet, honeyfile, honeytoken
1.3 Explain the importance of change management processes and the impact to security.
- Business processes impacting security operation: approval process, ownership, stakeholders, impact analysis, test results, backout plan, maintenance window, standard operating procedure
- Technical implications: allow lists/deny lists, restricted activities, downtime, service restart, application restart, legacy applications, dependencies
- Documentation: updating diagrams, updating policies/procedures
- Version control
1.4 Explain the importance of using appropriate cryptographic solutions.
- Public key infrastructure (PKI): public key, private key, key escrow
- Encryption level: full-disk, partition, file, volume, database, record
- Encryption: transport/communication
- Encryption: asymmetric, symmetric, key exchange, algorithms, key length
- Tools: Trusted Platform Module (TPM), hardware security module (HSM), key management system, secure enclave
- Obfuscation: steganography, tokenization, data masking
- Hashing
- Salting
- Digital signatures
- Key stretching
- Blockchain; open public ledger
- Certificates: certificate authorities, certificate revocation lists (CRLs), Online Certificate Status Protocol (OCSP), self-signed, third-party, root of trust, certificate signing request (CSR) generation, wildcard
2.0 Threats, Vulnerabilities, and Mitigations
22% of the exam, 5 objectives
2.1 Compare and contrast common threat actors and motivations.
- Threat actors: nation-state, unskilled attacker, hacktivist, insider threat, organized crime, shadow IT
- Attributes of actors: internal/external, resources/funding, level of sophistication/capability
- Motivations: data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical/political beliefs, ethical, revenge, disruption/chaos, war
2.2 Explain common threat vectors and attack surfaces.
- Message-based (email, Short Message Service (SMS), instant messaging (IM)); image-based; file-based; voice call; removable device
- Vulnerable software (client-based vs. agentless); unsupported systems and applications
- Unsecure networks (wireless, wired, Bluetooth); open service ports; default credentials
- Supply chain: managed service providers (MSPs), vendors, suppliers
- Human vectors/social engineering: phishing, vishing, smishing, misinformation/disinformation, impersonation, business email compromise, pretexting, watering hole, brand impersonation, typosquatting
2.3 Explain various types of vulnerabilities.
- Application: memory injection, buffer overflow, race conditions (time-of-check (TOC), time-of-use (TOU)), malicious update
- Operating system (OS)-based; web-based: Structured Query Language injection (SQLi), cross-site scripting (XSS)
- Hardware: firmware, end-of-life, legacy
- Virtualization (virtual machine (VM) escape, resource reuse); cloud-specific
- Supply chain: service provider, hardware provider, software provider
- Cryptographic; misconfiguration
- Mobile device: side loading, jailbreaking
- Zero-day
2.4 Given a scenario, analyze indicators of malicious activity.
- Malware attacks: ransomware, trojan, worm, spyware, bloatware, virus, keylogger, logic bomb, rootkit
- Physical attacks: brute force, radio frequency identification (RFID) cloning, environmental
- Network attacks: distributed denial-of-service (DDoS) (amplified, reflected), Domain Name System (DNS) attacks, wireless, on-path, credential replay, malicious code
- Application attacks: injection, buffer overflow, replay, privilege escalation, forgery, directory traversal
- Cryptographic attacks (downgrade, collision, birthday); password attacks (spraying, brute force)
- Indicators: account lockout, concurrent session usage, blocked content, impossible travel, resource consumption, resource inaccessibility, out-of-cycle logging, published/documented, missing logs
2.5 Explain the purpose of mitigation techniques used to secure the enterprise.
- Segmentation; access control (access control list (ACL), permissions); application allow list; isolation; patching; encryption; monitoring; least privilege; configuration enforcement; decommissioning
- Hardening techniques: encryption, installation of endpoint protection, host-based firewall, host-based intrusion prevention system (HIPS), disabling ports/protocols, default password changes, removal of unnecessary software
3.0 Security Architecture
18% of the exam, 4 objectives
3.1 Compare and contrast security implications of different architecture models.
- Cloud: responsibility matrix, hybrid considerations, third-party vendors; infrastructure as code (IaC), serverless, microservices
- Network infrastructure: physical isolation (air-gapped), logical segmentation, software-defined networking (SDN); on-premises; centralized vs. decentralized
- Containerization, virtualization
- IoT, industrial control systems (ICS)/supervisory control and data acquisition (SCADA), real-time operating system (RTOS), embedded systems, high availability
- Considerations: availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, ease of recovery, patch availability, inability to patch, power, compute
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
- Infrastructure considerations: device placement, security zones, attack surface, connectivity, failure modes (fail-open, fail-closed)
- Device attribute (active vs. passive, inline vs. tap/monitor); network appliances: jump server, proxy server, intrusion prevention system (IPS)/intrusion detection system (IDS), load balancer, sensors
- Port security (802.1X, Extensible Authentication Protocol (EAP)); firewall types: web application firewall (WAF), unified threat management (UTM), next-generation firewall (NGFW), Layer 4/Layer 7
- Secure communication/access: virtual private network (VPN), remote access, tunneling (TLS, IPSec), software-defined wide area network (SD-WAN), secure access service edge (SASE); selection of effective controls
3.3 Compare and contrast concepts and strategies to protect data.
- Data types: regulated, trade secret, intellectual property, legal information, financial information, human- and non-human-readable
- Data classifications: sensitive, confidential, public, restricted, private, critical
- General data considerations: data states (data at rest, data in transit, data in use), data sovereignty, geolocation
- Methods to secure data: geographic restrictions, encryption, hashing, masking, tokenization, obfuscation, segmentation, permission restrictions
3.4 Explain the importance of resilience and recovery in security architecture.
- High availability (load balancing vs. clustering); site considerations: hot, cold, warm, geographic dispersion
- Platform diversity, multi-cloud systems, continuity of operations, capacity planning (people, technology, infrastructure)
- Testing: tabletop exercises, fail over, simulation, parallel processing
- Backups: onsite/offsite, frequency, encryption, snapshots, recovery, replication, journaling
- Power: generators, uninterruptible power supply (UPS)
4.0 Security Operations
28% of the exam, 9 objectives
4.1 Given a scenario, apply common security techniques to computing resources.
- Secure baselines (establish, deploy, maintain); hardening targets (mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS/SCADA, embedded systems, RTOS, IoT devices)
- Wireless devices: installation considerations (site surveys, heat maps); wireless security settings (WPA3, AAA/RADIUS, cryptographic protocols, authentication protocols)
- Mobile solutions: MDM, deployment models (BYOD, COPE, CYOD), connection methods (cellular, Wi-Fi, Bluetooth)
- Application security (input validation, secure cookies, static code analysis, code signing); sandboxing; monitoring
4.2 Explain the security implications of proper hardware, software, and data asset management.
- Acquisition/procurement process; assignment/accounting (ownership, classification)
- Monitoring/asset tracking (inventory, enumeration)
- Disposal/decommissioning (sanitization, destruction, certification, data retention)
4.3 Explain various activities associated with vulnerability management.
- Identification methods: vulnerability scan; application security (static analysis, dynamic analysis, package monitoring); threat feed (OSINT, proprietary/third-party, information-sharing organization, dark web); penetration testing; responsible disclosure program (bug bounty program); system/process audit
- Analysis: confirmation (false positive, false negative), prioritize, CVSS, CVE, vulnerability classification, exposure factor, environmental variables, industry/organizational impact, risk tolerance
- Vulnerability response and remediation: patching, insurance, segmentation, compensating controls, exceptions and exemptions
- Validation of remediation (rescanning, audit, verification); reporting
4.4 Explain security alerting and monitoring concepts and tools.
- Monitoring computing resources: systems, applications, infrastructure
- Activities: log aggregation, alerting, scanning, reporting, archiving, alert response and remediation/validation (quarantine, alert tuning)
- Tools: SCAP, benchmarks, agents/agentless, SIEM, antivirus, DLP, SNMP traps, NetFlow, vulnerability scanners
4.5 Given a scenario, modify enterprise capabilities to enhance security.
- Firewall (rules, access lists, ports/protocols, screened subnets); IDS/IPS (trends, signatures)
- Web filter (agent-based, centralized proxy, URL scanning, content categorization, block rules, reputation); DNS filtering
- Operating system security (Group Policy, SELinux); implementation of secure protocols (protocol selection, port selection, transport method)
- Email security: DMARC, DKIM, SPF, gateway
- File integrity monitoring; DLP; network access control (NAC); EDR/XDR; user behavior analytics
4.6 Given a scenario, implement and maintain identity and access management.
- Provisioning/de-provisioning user accounts; permission assignments and implications; identity proofing
- Federation; single sign-on (LDAP, OAuth, SAML); interoperability; attestation
- Access controls: mandatory, discretionary, role-based, rule-based, attribute-based, time-of-day restrictions, least privilege
- Multifactor authentication: implementations (biometrics, hard/soft authentication tokens, security keys); factors (something you know, something you have, something you are, somewhere you are)
- Password concepts: password best practices (length, complexity, reuse, expiration, age), password managers, passwordless
- Privileged access management tools: just-in-time permissions, password vaulting, ephemeral credentials
4.7 Explain the importance of automation and orchestration related to secure operations.
- Use cases of automation and scripting: user provisioning, resource provisioning, guard rails, security groups, ticket creation, escalation, enabling/disabling services and access, continuous integration and testing, integrations and APIs
- Benefits: efficiency/time saving, enforcing baselines, standard infrastructure configurations, scaling in a secure manner, employee retention, reaction time, workforce multiplier
- Other considerations: complexity, cost, single point of failure, technical debt, ongoing supportability
4.8 Explain appropriate incident response activities.
- Process: preparation, detection, analysis, containment, eradication, recovery, lessons learned
- Training; testing (tabletop exercise, simulation); root cause analysis; threat hunting
- Digital forensics: legal hold, chain of custody, acquisition, reporting, preservation, e-discovery
4.9 Given a scenario, use data sources to support an investigation.
- Log data: firewall logs, application logs, endpoint logs, OS-specific security logs, IPS/IDS logs, network logs, metadata
- Data sources: vulnerability scans, automated reports, dashboards, packet captures
5.0 Security Program Management and Oversight
20% of the exam, 6 objectives
5.1 Summarize elements of effective security governance.
- Guidelines; policies (acceptable use policy (AUP), information security policies, business continuity, disaster recovery, incident response, software development lifecycle (SDLC), change management); standards (password, access control, physical security, encryption); procedures (change management, onboarding/offboarding, playbooks)
- External considerations (regulatory, legal, industry, local/regional, national, global); monitoring and revision
- Types of governance structures: boards, committees, government entities, centralized/decentralized
- Roles and responsibilities for systems and data: owners, controllers, processors, custodians/stewards
5.2 Explain elements of the risk management process.
- Risk identification; risk assessment (ad hoc, recurring, one-time, continuous)
- Risk analysis: qualitative, quantitative, single loss expectancy (SLE), annualized loss expectancy (ALE), annualized rate of occurrence (ARO), probability, likelihood, exposure factor, impact
- Risk register (key risk indicators, risk owners, risk threshold); risk tolerance; risk appetite (expansionary, conservative, neutral)
- Risk management strategies: transfer, accept (exemption, exception), avoid, mitigate; risk reporting
- Business impact analysis: recovery time objective (RTO), recovery point objective (RPO), mean time to repair (MTTR), mean time between failures (MTBF)
5.3 Explain the processes associated with third-party risk assessment and management.
- Vendor assessment: penetration testing, right-to-audit clause, evidence of internal audits, independent assessments, supply chain analysis
- Vendor selection: due diligence, conflict of interest
- Agreement types: service-level agreement (SLA), memorandum of agreement (MOA), memorandum of understanding (MOU), master service agreement (MSA), work order (WO)/statement of work (SOW), non-disclosure agreement (NDA), business partners agreement (BPA)
- Vendor monitoring, questionnaires, rules of engagement
5.4 Summarize elements of effective security compliance.
- Compliance reporting (internal, external); consequences of non-compliance (fines, sanctions, reputational damage, loss of license, contractual impacts)
- Compliance monitoring: due diligence/care, attestation and acknowledgement, internal and external, automation
- Privacy: legal implications (local/regional, national, global), data subject, controller vs. processor, ownership, data inventory and retention, right to be forgotten
5.5 Explain types and purposes of audits and assessments.
- Attestation; internal (compliance, audit committee, self-assessments); external (regulatory, examinations, assessment, independent third-party audit)
- Penetration testing: physical, offensive, defensive, integrated, known environment, partially known environment, unknown environment, reconnaissance (passive, active)
5.6 Given a scenario, implement security awareness practices.
- Phishing: campaigns, recognizing a phishing attempt, responding to reported suspicious messages
- Anomalous behavior recognition: risky, unexpected, unintentional
- User guidance and training: policy/handbooks, situational awareness, insider threat, password management, removable media and cables, social engineering, operational security, hybrid/remote work environments
- Reporting and monitoring (initial, recurring); development; execution
How to use this list
Treat the objectives as a checklist, not a reading order. The verbs matter: compare and contrast and explain objectives are tested with scenarios that ask which option is BEST or MOST likely, while given a scenario objectives are the ones most likely to appear as performance-based questions. If you can explain every sub-topic to someone else in a sentence or two, and tell it apart from its neighbours, you are ready for that objective.
In the course, every lesson and every exercise is tagged with the objective and sub-topic it covers, so the readiness estimate and the next-best-action picker work at this granularity. The exam guide covers the format, timing and scoring; the practice exams page explains how a full-length run is built to these weights.
CompTIA publishes the official objectives document (version 5.0 for SY0-701) on comptia.org; check it for the current version. SY0-801 has its own list, with different weights and numbering: what SY0-701 calls 1.4 (cryptographic solutions) is 1.3 in SY0-801, for example. In the course, an answer counts for both exams wherever the material is shared, so switching later keeps that progress.
Cover all 28 objectives by answering, not watching
103 interactive lessons and 1,642 original exercises for SY0-701, tracked per objective, and the SY0-801 course in the same plan. Try one lesson free first.