CompTIA A+ / Network+ / Security+ CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) Syllabus

CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) in CompTIA A+ / Network+ / Security+, not a summary of it.

1. 1

   General Security Concepts

   3 topics

   • Security Controls
     • Categories: technical, managerial, operational, physical
     • Types: preventive, deterrent, detective, corrective, compensating, directive
   • Fundamental Security Principles
     • CIA triad and non-repudiation
     • Authentication, authorisation and accounting (AAA)
     • Zero trust: control and data planes
   • Change Management and Security
     • Approval, ownership, impact analysis and backout plans
2. 2

   Threats, Vulnerabilities and Mitigations

   5 topics

   • Threat Actors and Motivations
     • Nation-state, hacktivist, insider, organised crime
     • Attributes: resources, sophistication and intent
   • Attack Surfaces and Threat Vectors
     • Message-based, image-based and supply-chain vectors
     • Removable media and unsecured networks
   • Common Attack Types
     • Malware: ransomware, trojans, worms, spyware, logic bombs
     • Application attacks: injection, XSS, CSRF, buffer overflow
     • Network attacks: DDoS, on-path, DNS poisoning, replay
   • Social Engineering
     • Phishing, pretexting, business email compromise
     • Watering hole, typosquatting and impersonation
   • Vulnerability Management
     • Scanning, CVSS scoring and CVE references
     • Patch management and remediation prioritisation
3. 3

   Cryptographic Solutions

   4 topics

   • Cryptography Fundamentals
     • Symmetric versus asymmetric encryption
     • Hashing, salting and digital signatures
   • Public Key Infrastructure
     • Certificate authorities, CSRs and chains of trust
     • Certificate revocation: CRL and OCSP
   • Encryption Applications
     • Full-disk, file, database and transport encryption
     • TLS, IPsec and VPN tunnelling
   • Cryptographic Concepts and Tools
     • Key exchange, key escrow and stretching
     • Trusted Platform Module and hardware security modules
     • Blockchain, steganography and obfuscation

CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) flashcards for CompTIA A+ / Network+ / Security+

19 of 56 cards from the CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) deck — real questions with worked answers.

1. What are the four main categories of security controls by type?

   Technical (technological/logical, e.g. firewalls, encryption), Managerial (administrative policies and oversight, e.g. risk assessments), Operational (implemented by people, e.g. security guards, awareness training), and Physical (tangible barriers, e.g. locks, fences).

2. List the six functional categories of security controls.

   Preventive (stop an incident), Deterrent (discourage an attacker), Detective (identify/log an incident), Corrective (fix/restore after an incident), Compensating (alternative when primary control is infeasible), and Directive (instruct/guide behavior, e.g. policies).

3. What does the CIA triad stand for?

   Confidentiality (preventing unauthorized disclosure), Integrity (ensuring data is not altered without authorization), and Availability (ensuring authorized users have reliable access to resources).

4. What is non-repudiation and how is it commonly achieved?

   Non-repudiation ensures a party cannot deny having performed an action (e.g. sending a message). It is commonly achieved with digital signatures, audit logs, and timestamps.

5. What is the AAA framework in security?

   Authentication (verifying identity), Authorization (granting appropriate permissions/access), and Accounting (tracking and logging user activity).

6. What is the principle of 'Zero Trust' and its two planes?

   Zero Trust assumes no implicit trust and verifies every request ('never trust, always verify'). It separates the Control Plane (policy decisions: adaptive identity, policy engine, policy administrator) from the Data Plane (policy enforcement: subject/system, policy enforcement point).

7. Define the principle of least privilege.

   Users, processes, and systems should be granted only the minimum access rights and permissions necessary to perform their required functions, and no more.

8. What is defense in depth (layered security)?

   A strategy that uses multiple, overlapping layers of security controls so that if one control fails, others continue to protect the asset.

9. What is a honeypot versus a honeynet?

   A honeypot is a single decoy system designed to lure and study attackers. A honeynet is a network of multiple honeypots simulating a realistic environment to observe attacker behavior at scale.

10. Why is change management important to security, and what risk does unapproved change create?

    Change management ensures modifications are reviewed, approved, tested, and documented so they don't introduce vulnerabilities or outages. Unapproved (unauthorized) changes can create misconfigurations, security gaps, and untracked attack surface.

11. What is the purpose of a maintenance window and a backout (rollback) plan in change management?

    A maintenance window is a scheduled period for performing changes to minimize business disruption. A backout/rollback plan defines how to revert a change if it fails or causes problems, restoring the prior known-good state.

12. In change management, what are the typical 'impact analysis' considerations before approval?

    Assessing the scope, affected systems/dependencies, downtime, risk to security and operations, required resources, and test results, plus stakeholder approval from the Change Advisory Board (CAB).

13. What are the technical implications of change documented under 'allow/deny lists' and 'restricted activities'?

    Updating allow/deny lists, respecting restricted activities and downtime, handling service/application restarts, legacy applications, and dependencies that the change may affect.

14. List the main categories of threat actors.

    Nation-state/APT, Organized crime, Hacktivist, Insider threat, Unskilled attacker ('script kiddie'), and Shadow IT.

15. What distinguishes an Advanced Persistent Threat (APT)?

    An APT is typically a nation-state or highly resourced actor that gains long-term, stealthy, persistent access to a network, with high sophistication, large funding, and strategic/espionage motivation.

16. List common motivations of threat actors.

    Financial gain, espionage, data exfiltration, service disruption, blackmail/extortion, revenge, ethical/hacktivism, war, philosophical/political beliefs, and chaos.

17. Compare internal vs external threat actor attributes.

    Internal actors (insiders) have authorized access and knowledge of systems but usually fewer resources. External actors lack inside access but may range from low to very high resources/funding and sophistication.

18. What is an attack surface and an attack (threat) vector?

    An attack surface is the total set of points where an attacker could attempt entry. A threat vector is the specific path or method used to gain access (e.g. email, removable media, unsecured network).

19. Name common threat vectors (paths of attack).

    Message-based (email, SMS, IM), image-based, file-based, voice calls (vishing), removable devices/USB, vulnerable software, unsupported systems, unsecure networks, open service ports, default credentials, and the supply chain.

See more CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) flashcards →

Planning CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) for CompTIA A+ / Network+ / Security+

CompTIA Security+: Threats, Attacks & Cryptography (SY0-701) (CompTIA A+ / Network+ / Security+) FAQ