CompTIA A+ / Network+ / Security+ CompTIA Security+: Architecture, Operations & Governance (SY0-701) Syllabus

CompTIA Security+: Architecture, Operations & Governance (SY0-701) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for CompTIA Security+: Architecture, Operations & Governance (SY0-701) in CompTIA A+ / Network+ / Security+, not a summary of it.

1. 1

   Security Architecture

   4 topics

   • Secure Network Design
     • Segmentation, DMZ/screened subnet and VLANs
     • Firewalls, IDS/IPS and network access control
   • Securing Architecture Models
     • On-premises, cloud, hybrid and serverless considerations
     • Microservices, IoT, ICS/SCADA and embedded systems
   • Data Protection
     • Data classification and states (at rest, in transit, in use)
     • Data loss prevention and tokenisation
   • Resilience and Recovery
     • High availability, redundancy and site resiliency
     • Backup strategies and continuity of operations
2. 2

   Identity and Access Management

   3 topics

   • Identity Concepts
     • Provisioning, deprovisioning and identity proofing
     • Federation, SSO and SAML/OAuth/OpenID
   • Authentication Methods
     • Multi-factor authentication factors and attributes
     • Passwordless, biometrics and hardware tokens
   • Access Control Models
     • RBAC, ABAC, MAC, DAC and rule-based
     • Least privilege and privileged access management
3. 3

   Security Operations

   4 topics

   • Secure Configuration and Hardening
     • Baselines, benchmarks and endpoint hardening
     • Mobile device management and BYOD
   • Monitoring and Detection
     • SIEM, log aggregation and alerting
     • Threat hunting and security orchestration (SOAR)
   • Incident Response
     • Preparation, identification, containment, eradication, recovery, lessons learned
     • Digital forensics: chain of custody, e-discovery, acquisition
   • Automation and Orchestration
     • Use cases, benefits and scripting for security operations
4. 4

   Governance, Risk and Compliance

   4 topics

   • Governance and Policies
     • Acceptable use, SOPs and information security policies
     • Roles: owner, controller, processor and custodian
   • Risk Management
     • Risk identification, assessment and appetite/tolerance
     • Quantitative analysis: SLE, ARO and ALE
     • Risk treatment: accept, transfer, mitigate, avoid
   • Third-party Risk Management
     • Vendor assessment, SLAs, MOUs and BPAs
     • Supply-chain analysis and right-to-audit clauses
   • Compliance and UK Regulatory Context
     • UK GDPR and the Data Protection Act 2018
     • PCI DSS, ISO 27001 and NCSC Cyber Essentials
     • Privacy, data retention and breach notification

CompTIA Security+: Architecture, Operations & Governance (SY0-701) flashcards for CompTIA A+ / Network+ / Security+

24 of 75 cards from the CompTIA Security+: Architecture, Operations & Governance (SY0-701) deck — real questions with worked answers.

1. What is the primary goal of network segmentation in secure network design?

   To divide a network into smaller zones so that a compromise in one segment cannot easily spread to others, limiting the blast radius and reducing the attack surface (containment and lateral-movement prevention).

2. In a screened subnet (DMZ) architecture, where are public-facing servers placed and why?

   In the DMZ, a buffer zone between two firewalls (or one firewall with separate interfaces). Public services like web/email reside there so untrusted internet traffic never directly reaches the internal/trusted LAN.

3. What is the difference between an East-West and a North-South traffic flow in a data centre?

   North-South is traffic between the data centre and external networks (in/out). East-West is traffic moving laterally between servers/segments inside the data centre. Microsegmentation primarily controls East-West traffic.

4. Define Zero Trust and its core principle.

   A security model that assumes no implicit trust based on network location. Its core principle is 'never trust, always verify' — every request is continuously authenticated, authorised and validated regardless of origin.

5. In Zero Trust architecture, what are the roles of the Policy Engine, Policy Administrator, and Policy Enforcement Point (PEP)?

   Policy Engine makes the access decision (grant/deny) using policy and trust algorithms; Policy Administrator establishes/terminates the session based on that decision; the PEP enforces it, allowing or blocking the connection between subject and resource.

6. What is the difference between the Zero Trust Control Plane and Data Plane?

   The Control Plane defines and manages policy and access decisions (Policy Engine, Policy Administrator, adaptive identity, threat scope reduction). The Data Plane carries the actual subject-to-resource traffic enforced by the PEP.

7. What does 'air gap' mean as an architecture control?

   Physically isolating a system or network so it has no electronic (wired or wireless) connection to other networks, used to protect highly sensitive or critical systems from remote compromise.

8. Compare on-premises, cloud, and hybrid architecture in terms of responsibility for security.

   On-prem: the organisation owns all security responsibility. Cloud: responsibility is shared with the provider (shared responsibility model). Hybrid: a mix, splitting responsibility across owned and provider-managed components.

9. In the cloud shared responsibility model, who secures the physical hardware versus the data?

   The cloud provider always secures the underlying physical infrastructure; the customer is always responsible for their own data, access management and (depending on model) the OS and applications.

10. What is a SCADA/ICS system and why does it need special security consideration?

    Supervisory Control and Data Acquisition / Industrial Control Systems manage physical processes (power, water, manufacturing). They often run legacy, fragile, real-time hardware that can't be patched easily, so availability and isolation are prioritised.

11. Distinguish serverless computing from containerisation.

    Serverless (FaaS) runs code on demand with the provider managing all infrastructure and scaling; you pay per execution. Containerisation packages an app with its dependencies into an isolated container sharing the host OS kernel, which you still manage.

12. What are the three states of data that must be protected?

    Data at rest (stored on disk/media), data in transit/motion (moving across a network), and data in use/processing (in memory or being actively used by an application).

13. List the typical data classification levels from least to most sensitive (commercial scheme).

    Public, Private/Internal, Confidential/Sensitive, and Restricted/Critical. (Government equivalent: Unclassified, Confidential, Secret, Top Secret.)

14. What is the difference between tokenisation and encryption for data protection?

    Encryption uses a key and algorithm to mathematically transform data reversibly. Tokenisation replaces sensitive data with a non-sensitive token mapped in a separate secure vault, with no mathematical relationship to the original value.

15. What is data masking and when is it used?

    Obscuring portions of data (e.g. showing only the last 4 digits of a card) so the real value is hidden but the data remains usable. Used in non-production, testing, or limited-display contexts.

16. Define the roles of data owner, data controller, and data processor.

    Data owner holds overall accountability and assigns classification; data controller determines the purpose and means of processing personal data; data processor processes data on behalf of the controller (these terms are central to UK GDPR).

17. What does DLP stand for and what does it do?

    Data Loss Prevention — technology that detects and blocks unauthorised transmission or exfiltration of sensitive data (e.g. across email, USB, cloud uploads) based on content inspection and policy.

18. Define RTO and RPO in resilience planning.

    RTO (Recovery Time Objective) is the maximum acceptable time to restore a system after an outage. RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how far back the last good recovery point can be).

19. What is the formula for Mean Time Between Failures (MTBF)?

    $$\text{MTBF} = \frac{\text{Total operational time}}{\text{Number of failures}}$$ It estimates the average time a repairable system operates between failures.

20. What is MTTR and how does it differ from MTBF?

    MTTR (Mean Time To Repair/Recover) is the average time taken to repair a failed component and restore service. MTBF measures reliability (time between failures); MTTR measures maintainability (time to fix).

21. Differentiate a hot site, warm site, and cold site.

    Hot site: fully equipped and running, near-instant failover (most expensive). Warm site: hardware/connectivity in place but data must be loaded, hours to recover. Cold site: empty space with power/space only, longest recovery, cheapest.

22. What RAID level provides striping with distributed parity, and how many disks can fail?

    RAID 5 — block-level striping with distributed parity across all disks; it tolerates the failure of one disk. (RAID 6 uses double parity and tolerates two disk failures.)

23. What is the difference between high availability achieved through load balancing versus clustering?

    Load balancing distributes traffic across multiple active servers to share load and provide redundancy. Clustering groups servers to act as one system, often active-passive, where a standby takes over on failure (failover).

24. What is the purpose of a tabletop exercise in resilience testing?

    A discussion-based walkthrough where stakeholders talk through their roles and responses to a simulated scenario, validating the plan without disrupting live systems (low cost, no real failover).

See more CompTIA Security+: Architecture, Operations & Governance (SY0-701) flashcards →

Planning CompTIA Security+: Architecture, Operations & Governance (SY0-701) for CompTIA A+ / Network+ / Security+

CompTIA Security+: Architecture, Operations & Governance (SY0-701) (CompTIA A+ / Network+ / Security+) FAQ