Security+ (SY0-701) Exam Mindset Rules
Target audience: Early-career security engineers, sysadmins, SOC analysts, and developers entering cybersecurity.
- Match the exact protocol, port, or log artifact to the attack: Security+ tests practical hands-on recognition: reading a packet trace, identifying SQLi vs. XSS, or choosing between WPA3-SAE and 802.1X EAP-TLS.
- Know control types and categories cold: Classify every safeguard along two axes: Category (Technical, Managerial/Administrative, Operational, Physical) and Function (Preventive, Detective, Corrective, Deterrent, Compensating, Directive).
- Prioritize vulnerabilities using exposure + exploitation evidence: Combine CVSS severity with internet reachability, CISA KEV active exploitation, and asset criticality.
DOMAIN 1 · 12% OF EXAM
Domain 1: General Security Concepts
CIA triad, non-repudiation, AAA, zero trust architecture, physical security controls, and cryptographic solutions (PKI, hashing, symmetric/asymmetric encryption).
Drill Domain 1 practice questions ↗
Objectives & Mapped Field Lessons
Objective 1.1: Compare and contrast security controls, CIA triad, AAA, and Zero Trust principles
- Assets and the CIA triad: what we protect and how it fails (F1 · 8 min)
- Identity, authentication, authorization, and recovery (F4 · 9 min)
- Least privilege, defense in depth, and Zero Trust boundaries (F5 · 8 min)
- Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together (F8a · 8 min)
Objective 1.2: Explain cryptographic concepts, PKI certificates, hashing, and physical security controls
- Symmetric and asymmetric cryptography: ciphers, modes, and hybrid envelopes (AR3 · 11 min)
- Hashing, HMAC, digital signatures, and PKI lifecycle (AR4 · 11 min)
- Two sides derive one secret: TLS 1.3 key exchange and name binding (F3b · 8 min)
- Physical and facility security: CPTED, mantraps, and access zones (AR5 · 10 min)
Domain 1 Rapid-Review Cheat Sheet
DOMAIN 2 · 22% OF EXAM
Domain 2: Threats, Vulnerabilities, and Mitigations
Threat actors, social engineering, phishing, application and network attacks, vulnerability types, indicators of compromise, and hardening techniques.
Drill Domain 2 practice questions ↗
Objectives & Mapped Field Lessons
Objective 2.1: Analyze social engineering, phishing, network protocol attacks, and application vulnerabilities
- Phishing and social engineering: how attackers exploit workflow urgency (SE1 · 9 min)
- OSI and TCP/IP layers, encapsulation, and protocol attacks (N1 · 11 min)
- Application trust boundaries: why the client UI is never a security gate (F5b · 9 min)
- Software assurance: SDLC models, database integrity, and classic application attacks (A5 · 15 min)
- Prompt injection and untrusted retrieval (RAG): when data hijacks instructions (G1 · 10 min)
Objective 2.2: Explain vulnerability types, supply chain exposures, and mitigation strategies
- Threat, vulnerability, and risk: the core equation (F2 · 9 min)
- Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure (S2 · 9 min)
- Direct and transitive dependencies: inherited code in your runtime (A2 · 9 min)
- Network segmentation, firewall generations, SASE, and NAC (N2 · 10 min)
Domain 2 Rapid-Review Cheat Sheet
DOMAIN 3 · 18% OF EXAM
Domain 3: Security Architecture
Cloud shared responsibility, infrastructure segmentation, secure network design, data protection, resilience, backups, RAID, and power/environmental controls.
Drill Domain 3 practice questions ↗
Objectives & Mapped Field Lessons
Objective 3.1: Compare cloud models, virtualization, network segmentation, and secure communication channels
Objective 3.2: Apply data classification, protection states, RAID, backups, and continuity sites
- Data protection and resilience: why encryption is not a backup plan (F6 · 8 min)
- Data lifecycle, classification, and governance roles (D2a · 10 min)
- Continuity operations: recovery sites, backup strategies, RAID, and DR testing (S6 · 14 min)
- Environmental controls: HVAC, power anomalies, and fire suppression (AR6 · 10 min)
Domain 3 Rapid-Review Cheat Sheet
DOMAIN 4 · 28% OF EXAM
Domain 4: Security Operations
Hardening, vulnerability management, SIEM/EDR/SOAR monitoring, email authentication (SPF/DKIM/DMARC), IAM federation (OAuth/OIDC/SAML/Kerberos), incident response, and digital forensics.
Drill Domain 4 practice questions ↗
Objectives & Mapped Field Lessons
Objective 4.1: Configure and verify identity, federation, access control models, and email authentication
- Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) (E1a · 8 min)
- DMARC rollout: monitor with p=none, fix legitimate senders, then enforce (E1b · 8 min)
- Who holds the ticket: OAuth 2.0 roles and bearer token verification (IF1 · 10 min)
- OAuth 2.0 Authorization Code + PKCE: front channel vs back channel (IF1a · 8 min)
- OIDC and SAML assertions: signed identity claims are not admin permission (IF2 · 11 min)
- Federation failure modes: five ways SSO and token trust break (IF3 · 11 min)
- Access control models: DAC, MAC, RBAC, ABAC, and Rule-Based controls (IF5 · 10 min)
- Kerberos, biometric CER math, NIST 800-63 assurance, and PAM lifecycle (IF4 · 11 min)
Objective 4.2: Perform alert triage, vulnerability prioritization, incident response, and forensic evidence collection
- Logs, alerts, and evidence: why an alert title is a hypothesis, not proof (F7 · 8 min)
- Identity alert triage: reconstructing who, what, and how across logs (S1 · 11 min)
- Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof (S3 · 10 min)
- Digital forensics: order of volatility, chain of custody, and legal evidence (S5 · 10 min)
- Agentic SOC architecture: autonomous triage vs human-gated containment (S4 · 10 min)
- Penetration testing, Rules of Engagement, and vulnerability validation (AT2 · 10 min)
Domain 4 Rapid-Review Cheat Sheet
DOMAIN 5 · 20% OF EXAM
Domain 5: Security Program Management and Oversight
Governance policies, quantitative/qualitative risk management, BIA metrics, third-party/supply chain risk, compliance audits (SOC 2, ISO 27001, NIST CSF), and privacy.
Drill Domain 5 practice questions ↗
Objectives & Mapped Field Lessons
Objective 5.1: Execute risk management, BIA calculations, governance cadence, and third-party/supply chain oversight
- Write the risk sentence: cause, asset, and business impact (R1 · 9 min)
- Choose the control and its evidence: policies do not execute themselves (R2 · 10 min)
- Governance as an operating cadence: NIST CSF 2.0 Govern in practice (R3 · 11 min)
- Quantitative risk and BIA math: SLE, ALE, RTO, and RPO (R6 · 11 min)
- Security governance and the policy hierarchy (R5 · 9 min)
- SBOM evidence and priority: binding inventory to the running build (A4 · 7 min)