CompTIA A+ / Network+ / Security+ CompTIA Security+: Architecture, Operations & Governance (SY0-701) Syllabus

Differentiate a hot site, warm site, and cold site.

Hot site: fully equipped and running, near-instant failover (most expensive). Warm site: hardware/connectivity in place but data must be loaded, hours to recover. Cold site: empty space with power/space only, longest recovery, cheapest.

What RAID level provides striping with distributed parity, and how many disks can fail?

RAID 5 — block-level striping with distributed parity across all disks; it tolerates the failure of one disk. (RAID 6 uses double parity and tolerates two disk failures.)

What is the difference between high availability achieved through load balancing versus clustering?

Load balancing distributes traffic across multiple active servers to share load and provide redundancy. Clustering groups servers to act as one system, often active-passive, where a standby takes over on failure (failover).

What is the purpose of a tabletop exercise in resilience testing?

A discussion-based walkthrough where stakeholders talk through their roles and responses to a simulated scenario, validating the plan without disrupting live systems (low cost, no real failover).

Distinguish identification, authentication, and authorisation.

Identification: claiming an identity (username). Authentication: proving that identity (password/factor). Authorisation: granting the authenticated identity permission to access specific resources.

What is the difference between identity proofing and accounting/auditing in AAA?

Identity proofing verifies a person is who they claim before issuing credentials. Accounting (the third A in AAA) logs and tracks what an authenticated user does, supporting auditing and non-repudiation.

What are the five authentication factor categories?

Something you know (password/PIN), something you have (token/smart card), something you are (biometric), somewhere you are (location), and something you do (behavioural, e.g. typing pattern).

Why is a password plus a PIN NOT considered multifactor authentication?

Because both are the same factor category — 'something you know.' True MFA requires factors from two or more different categories (e.g. password + hardware token).

Differentiate FAR, FRR, and CER in biometric systems.

FAR (False Acceptance Rate): unauthorised user wrongly accepted. FRR (False Rejection Rate): authorised user wrongly rejected. CER (Crossover Error Rate): the point where FAR equals FRR — lower CER means a more accurate biometric system.

How does TOTP differ from HOTP?

HOTP (HMAC-based One-Time Password) is counter-based and valid until used. TOTP (Time-based One-Time Password) is generated from the current time and a shared secret, expiring after a short window (e.g. 30 seconds).

What is the difference between SSO and federation?

SSO (Single Sign-On) lets a user authenticate once to access multiple systems within one organisation/domain. Federation extends trusted authentication across different organisations/domains using shared standards (e.g. SAML).

Compare SAML and OAuth in terms of purpose.

SAML is an XML-based standard primarily for authentication and SSO (especially enterprise web apps). OAuth is an authorisation framework that grants applications delegated access to resources without sharing credentials (often paired with OpenID Connect for authentication).

Define Mandatory Access Control (MAC).

An access model where access is enforced by the system based on classification labels and clearances set by a central authority; users cannot change permissions. Common in high-security/government environments.

Define Discretionary Access Control (DAC).

An access model where the resource owner decides who gets access and what permissions to grant. Flexible but riskier, as control is decentralised to owners (e.g. file permissions on a typical OS).

How does Role-Based Access Control (RBAC) work?

Permissions are assigned to roles (e.g. 'Accountant'), and users are assigned to roles. Access derives from the user's role rather than individual grants, simplifying administration and supporting least privilege.

What is Attribute-Based Access Control (ABAC)?

A dynamic model that grants access based on evaluated attributes/policies — of the user, resource, action and environment (e.g. department, time, location, device) — allowing fine-grained, context-aware decisions.

What is the principle of least privilege?

Users, processes and systems should be granted only the minimum access and permissions necessary to perform their function, and nothing more, reducing the impact of compromise or misuse.

What is a security baseline in configuration management?

A documented, standardised minimum-security configuration for a system or device. Systems are configured to and audited against this baseline to ensure consistent, hardened settings.

List four common host hardening techniques.

Disable unnecessary services/ports, remove or change default credentials, apply patches/updates, and enforce least-privilege access. (Others: enable host firewall, application allow-listing, and encryption.)

What is the difference between application allow-listing and deny-listing?

Allow-listing permits only explicitly approved applications to run and blocks everything else (more secure, more restrictive). Deny-listing blocks only known-bad applications and allows the rest (more flexible, less secure).

What does a Trusted Platform Module (TPM) provide?

A dedicated hardware chip on the motherboard that securely stores cryptographic keys, supports full-disk encryption (e.g. BitLocker), and enables secure boot/attestation of system integrity.

What is the difference between a TPM and an HSM?

A TPM is a fixed chip on a single device providing local key storage and integrity. An HSM (Hardware Security Module) is a dedicated, often network-attached/removable appliance for high-volume key generation, storage and cryptographic operations at scale.

What is the difference between SIEM and SOAR?

SIEM (Security Information and Event Management) aggregates, correlates and alerts on log/event data. SOAR (Security Orchestration, Automation and Response) automates and orchestrates the response workflows to those alerts via playbooks.

Differentiate signature-based, anomaly-based, and behaviour-based detection.

Signature-based matches known patterns of malicious activity (low false positives, misses new threats). Anomaly-based flags deviations from a learned baseline (catches novel attacks, more false positives). Behaviour-based detects actions characteristic of malicious behaviour.

What is the difference between an IDS and an IPS?

An IDS (Intrusion Detection System) detects and alerts on suspicious activity passively. An IPS (Intrusion Prevention System) sits inline and can actively block or drop malicious traffic in real time.

What is the difference between a true positive, false positive, false negative, and true negative in detection?

True positive: alert on real malicious activity. False positive: alert on benign activity (noise). False negative: no alert on real malicious activity (dangerous miss). True negative: correctly no alert on benign activity.

List the phases of the incident response process (NIST/CompTIA).

Preparation; Detection and Analysis (Identification); Containment; Eradication; Recovery; and Lessons Learned (Post-incident Activity).

In incident response, what is the difference between containment, eradication, and recovery?

Containment limits the spread/damage of the incident (e.g. isolate the host). Eradication removes the root cause (e.g. delete malware, close the vulnerability). Recovery restores systems to normal operation and monitors for recurrence.

What is the order of volatility and why does it matter in digital forensics?

It is the sequence for collecting evidence from most volatile to least (CPU registers/cache, RAM, network/connections, disk, archival media). You collect the most ephemeral data first so it isn't lost before acquisition.

What is chain of custody in incident response/forensics?

The documented, unbroken record of who handled evidence, when, why and how it was stored/transferred. It preserves integrity and admissibility of evidence by proving it was not altered or tampered with.

What is the benefit of automation and orchestration in security operations?

It increases consistency and speed, reduces human error, scales repetitive tasks, enforces standard processes, frees staff for complex work, and provides faster, reliable incident response — at the cost of complexity and upfront effort.

What is Infrastructure as Code (IaC) and one security benefit?

Defining and provisioning infrastructure through machine-readable configuration files rather than manual setup. Security benefit: consistent, repeatable, version-controlled, hardened deployments that reduce configuration drift and human error.

Differentiate a policy, standard, procedure, and guideline in governance.

Policy: high-level statement of intent/rules. Standard: mandatory specific requirements supporting a policy. Procedure: step-by-step instructions to achieve a task. Guideline: recommended, non-mandatory best-practice advice.

What is the difference between governance and management in security?

Governance sets direction, defines policy, assigns accountability and oversees risk to align security with business objectives. Management executes and operates within that framework day-to-day.

What is an Acceptable Use Policy (AUP)?

A policy defining the permitted and prohibited uses of an organisation's IT systems and data by users, setting expectations and the consequences of misuse.

Name common governance committee/structure types and a regulatory consideration.

Boards, committees, and government entities (centralised vs decentralised structures). They provide oversight, set policy, and must consider applicable laws/regulations (e.g. UK GDPR, sector regulators) when establishing security direction.

What are the four main risk response strategies?

Accept (tolerate the risk), Avoid (stop the risky activity), Transfer/Share (e.g. insurance, outsourcing), and Mitigate/Reduce (apply controls to lower the risk).

Give the formula for Single Loss Expectancy (SLE).

$$\text{SLE} = \text{Asset Value (AV)} \times \text{Exposure Factor (EF)}$$ where EF is the percentage of asset value lost in a single incident.

Give the formula for Annualized Loss Expectancy (ALE).

$$\text{ALE} = \text{SLE} \times \text{ARO}$$ where ARO is the Annualized Rate of Occurrence (expected number of incidents per year).

Differentiate quantitative and qualitative risk assessment.

Quantitative assigns numeric/monetary values (e.g. SLE, ALE) for objective cost-benefit analysis. Qualitative uses subjective ratings (e.g. high/medium/low) based on judgement when precise figures aren't available.

What is the difference between inherent risk, residual risk, and risk appetite?

Inherent risk is the risk before any controls. Residual risk is the risk remaining after controls are applied. Risk appetite is the amount/type of risk an organisation is willing to accept in pursuit of its objectives.

What is a Business Impact Analysis (BIA) and what key metrics does it produce?

A process that identifies critical functions and the impact of their disruption. It produces metrics such as RTO, RPO, MTD (Maximum Tolerable Downtime), and the resources needed to recover.

What is the purpose of a risk register?

A central document that records identified risks, their likelihood and impact, owners, current controls, risk responses and status — used to track and manage risk over time.

In third-party/vendor risk, distinguish an SLA, MOU/MOA, BPA, and MSA.

SLA: service-level agreement defining performance/uptime guarantees. MOU/MOA: memorandum of understanding/agreement, an informal/formal statement of intent. BPA: business partners agreement governing a partnership. MSA: master service agreement setting overarching contract terms.

What is the purpose of due diligence and due care in third-party risk management?

Due diligence is the investigation/assessment of a vendor's security and viability before engagement. Due care is the ongoing reasonable effort and monitoring to ensure the vendor maintains required security throughout the relationship.

What is a supply chain attack and how is it mitigated in vendor risk?

An attack that compromises an organisation by targeting a trusted third-party supplier, vendor or software component. Mitigations include vendor assessments, audits, monitoring, contractual security requirements and validating software integrity.

What is the difference between an RFP, RFQ, and RFI in vendor selection?

RFI (Request for Information): gather general info about capabilities. RFP (Request for Proposal): solicit detailed proposed solutions. RFQ (Request for Quotation): obtain specific pricing for defined requirements.

What is the difference between a right-to-audit clause and vendor attestation?

A right-to-audit clause contractually permits the organisation to directly inspect/audit the vendor's controls. Vendor attestation is a self-reported or independently certified assurance (e.g. a SOC 2 report) provided by the vendor instead of a direct audit.

What is UK GDPR and what does it govern?

The UK's retained version of the EU General Data Protection Regulation, governing the processing of personal data of individuals in the UK — covering lawful basis, data subject rights, breach notification, and accountability.

Which UK body regulates data protection, and what is the GDPR breach notification deadline?

The Information Commissioner's Office (ICO). Notifiable personal-data breaches must be reported to the ICO without undue delay and within 72 hours of becoming aware where feasible.

What is the UK Data Protection Act 2018 and how does it relate to UK GDPR?

The DPA 2018 is the UK law that sits alongside and supplements UK GDPR, implementing and tailoring data-protection rules (including law-enforcement and intelligence processing) within UK law.

What is the difference between a regulation, a standard, and a framework in compliance?

A regulation is legally mandated (e.g. UK GDPR). A standard is a defined requirement set, sometimes contractually required (e.g. PCI DSS, ISO 27001). A framework is a structured guidance model for organising security practices (e.g. NIST CSF).

What are common consequences of non-compliance?

Fines/sanctions, loss of business or licence, reputational damage, contractual penalties, increased scrutiny/audits, and potential legal liability for the organisation and its officers.

Differentiate a SOC 2 Type I and Type II report.

SOC 2 Type I assesses whether controls are suitably designed at a single point in time. Type II assesses both the design and the operating effectiveness of those controls over a period (typically 3-12 months).

What is PCI DSS and to whom does it apply?

The Payment Card Industry Data Security Standard — a contractual standard that applies to any organisation that stores, processes or transmits cardholder/payment card data, mandating controls to protect that data.