Security+ SY0-701 Final Review

This page is for the point when most of the material is already familiar. It compresses the exam into the distinctions that are easy to blur, the sequences that can get out of order, and the clues that change which otherwise reasonable answer is best.

If a line below feels new rather than familiar, do not try to learn the whole topic from the compressed version. Open the linked Security+ study guide or a focused Quick Review, fix the weak spot, then come back.

1. How to use this final review

Move through the page once without stopping for small details. Mark anything that takes too long to recall, then repair only those weak spots with the deeper guide or Quick Review.

A useful final pass looks like this:

• Explain each distinction before reading the reminder.
• Mark concepts that still depend on memorized wording instead of understanding.
• Open the deeper resource for anything you cannot apply to a short scenario.
• Finish with a fresh randomized practice set rather than rereading this page several times.

The goal is not to turn one page into another study guide. It is to make the important decision points easy to retrieve when several answers look plausible.

2. The five-domain map

The current SY0-701 objectives divide scored content across five domains. The percentages should influence study time, but every domain can appear inside a scenario that also tests another one.

Security Operations is the largest domain, but a single operations question can still require a Domain 2 attack clue, a Domain 3 availability constraint, and a Domain 5 policy requirement. Study the boundaries between concepts, not only the headings they live under.

3. General Security Concepts

Control category and control function answer different questions

A control's category describes what kind of control it is. Its function describes what security job it performs.

One control can have both labels. A badge reader can be a physical control by category and preventive by function. Use the Security Controls Quick Reference if those two classification systems still merge together in your head.

Know the security job before choosing the technology

• Confidentiality limits unauthorized disclosure.
• Integrity protects against unauthorized or undetected change.
• Availability keeps systems and data usable when needed.
• Authentication answers who or what is requesting access.
• Authorization decides what an authenticated identity may do.
• Accounting records activity for review and accountability.
• Non-repudiation supports evidence tying an action or message to a particular party, making later denial difficult when the surrounding identity, key, and logging controls are sound.

If a scenario asks for confidentiality, a hash is not enough. If it asks whether a file changed, encryption alone does not answer the integrity question. Start with the required security property, then choose the mechanism.

Cryptography: match the mechanism to the purpose

The public/private key rule is worth being able to reconstruct instead of memorizing as four isolated facts:

• To encrypt for the recipient, use the recipient's public key.
• The recipient decrypts with the recipient's private key.
• To sign as the sender, use the sender's private key.
• Anyone verifying the signature uses the sender's public key.

Use the Hashing, Encryption, and Encoding Quick Reference and Public Key vs. Private Key Quick Reference if you hesitate on those roles.

Certificates connect identity and public keys

A digital certificate binds identity information to a public key through a trust process. The private key is not stored inside the public certificate.

Know these checks:

• Does the certificate identify the expected subject or service?
• Is it within its validity period?
• Does the trust chain lead to a trusted certificate authority?
• Has it been revoked?
• Is the certificate permitted for the intended use?

A certificate revocation list (CRL) publishes revoked certificate information in a list. Online Certificate Status Protocol (OCSP) supports a more direct status query. Expiration and revocation are different: an expired certificate reached the end of its validity period; a revoked certificate was invalidated before normal expiration.

Use the Digital Certificates Quick Reference when chain, validity, and revocation questions still slow you down.

Zero trust and change management are decision models

Zero trust does not mean trusting nobody or replacing every network control. It removes automatic trust based only on location and makes access decisions from policy, identity, device, resource, and context. Least privilege, segmentation, strong identity, and continuing evaluation support that model.

Physical and deception controls can appear in the same objective area. Bollards help stop vehicles, a mantrap controls physical passage, cameras can provide detective evidence, and access badges help restrict entry. A honeypot is a decoy system or service; a honeynet is a decoy network; a honeytoken is fake data or a fake credential designed to reveal unauthorized use.

Change management questions usually reward controlled change rather than improvisation. Assess impact, obtain required approval, test when practical, plan rollback, implement, validate, and document. Exact organizational workflows differ, so use the scenario's stated process rather than forcing one universal checklist onto every question.

4. Threats, Vulnerabilities, and Mitigations

Read the layer the question is testing

A crowded attack scenario becomes easier when you separate who, how, what weakness, what happened, and what reduces the risk.

• Nation-state actors tend to have strategic goals and substantial resources.
• Organized crime commonly pursues financial gain.
• Hacktivists are driven by an ideological or social cause.
• An insider already has some legitimate relationship or access; the behavior can be malicious, negligent, or accidental.
• An unskilled attacker may rely heavily on tools or techniques created by others.

A threat vector is the path used to reach the target. Email and messaging, social engineering, exposed services, removable media, wireless access, cloud services, and the software supply chain can all be vectors. Do not confuse the delivery path with the vulnerability that makes the attack succeed.

Keep a few malware distinctions retrievable too: ransomware denies access or threatens disclosure for extortion; a worm can spread without a user copying it from host to host; a Trojan disguises malicious code as something legitimate; a rootkit helps hide or maintain privileged access; a logic bomb waits for a condition; and malicious cryptomining steals computing resources.

Follow the chain from weakness to business impact

These terms are related, but they are not interchangeable:

• A vulnerability is a weakness that could be used or triggered.
• A threat source is something capable of causing harm.
• An exploit is a method, technique, or code that takes advantage of a weakness.
• Risk is the possibility that uncertainty or harmful events will create loss, harm, disruption, or missed objectives.
• A mitigation reduces likelihood, impact, exposure, or another part of that risk.

Use the Vulnerability vs. Threat vs. Risk vs. Exploit Quick Reference if a question makes several of those words look like synonyms.

Attack clues should trigger a specific idea

Do not stop at naming the attack. Security+ often cares more about the mitigation.

Vulnerability priority is contextual

A scanner finding is the beginning of a decision, not the decision itself. A useful working flow is:

Discover → analyze → prioritize → remediate → validate → track and report

Consider exploitability, known exploitation, internet exposure, asset criticality, data sensitivity, business impact, existing controls, and remediation risk. A high severity score on an isolated test system may be less urgent than an actively exploited issue on an exposed production service.

5. Security Architecture

Start with the requirement and constraint

Architecture questions often provide a control that is strong in isolation but wrong for the environment. Availability, safety, latency, cost, regulation, legacy support, and operational complexity can all change the best answer.

A bank transaction system, an industrial controller, and a disposable development environment can face the same technical vulnerability and still require different implementation choices.

Cloud responsibility moves, but it never disappears

The exact boundary comes from the service and contract. “The provider handles security” is never a safe blanket assumption.

Architecture also changes the control options. Virtual machines share a hypervisor, containers commonly share a host kernel, serverless workloads reduce some infrastructure administration, and embedded or operational technology may put safety, reliability, or uptime ahead of ordinary patch cycles. The right control has to fit the platform and its constraints.

Segmentation, isolation, and air gaps are different degrees of separation

• Segmentation divides environments and controls traffic between them.
• Isolation separates a system or workload more strongly so interaction is restricted.
• An air gap is physical or logical separation intended to prevent ordinary network connectivity.

Segmentation can limit lateral movement and reduce blast radius. It does not make every host inside a segment trusted.

Match data state to the protection

Use the Data at Rest vs. Data in Transit vs. Data in Use Quick Reference for more scenarios.

Tokenization replaces sensitive data with a token that maps back through a controlled system. Masking hides part or all of a value for display or lower-risk use. Neither term is simply another word for encryption.

Availability and recovery terms describe different jobs

Recovery metrics are frequent confusion points:

• Recovery time objective (RTO): target for how long restoration can take.
• Recovery point objective (RPO): target for how much data loss, measured in time, is acceptable.
• Mean time to repair (MTTR): average time needed to repair or restore a failed component or service.
• Mean time between failures (MTBF): average operating time between failures for a repairable system.

If the question says “How much data can we lose?” think RPO. If it says “How long can the service be down?” think RTO. Use the Recovery Metrics Quick Reference if you still have to stop and decode the initials.

Backup patterns are also worth keeping straight. A full backup captures the selected data set. An incremental backup captures changes since the previous backup of any type, which can make backup jobs smaller but restoration more dependent on the chain. A differential backup captures changes since the last full backup, so it generally grows until the next full but can simplify restoration.

For alternate sites, a hot site is the most ready and typically the most expensive; a cold site has much less ready infrastructure and takes longer to activate; a warm site sits between them. The best choice depends on recovery targets and cost rather than on one site type always being “more secure.”

6. Security Operations

Security Operations carries the largest SY0-701 weight. Expect scenarios where several actions are useful and the question is really testing timing, scope, evidence, or operational risk.

Identity: separate factor, method, and access decision

Multifactor authentication (MFA) requires factors from different categories, such as something you know plus something you have. Two passwords are still one factor category.

Common factor categories include:

• Knowledge: something you know, such as a password or personal identification number (PIN).
• Possession: something you have, such as a hardware token or device-bound authenticator.
• Inherence: something you are, such as a biometric characteristic.

Use the Authentication Factors vs. Methods Quick Reference when a question mixes factor categories, authenticators, and authentication methods.

Keep these identity relationships clear:

For authorization models, role-based access control (RBAC) follows job roles, while attribute-based access control (ABAC) evaluates attributes such as user, resource, action, and environment. Whatever model is used, least privilege and prompt deprovisioning matter when roles change or accounts end.

Detection tools differ by visibility and response

Use the IDS vs. IPS vs. EDR vs. XDR Quick Reference when a scenario asks which evidence or enforcement point fits best.

Hardening is a maintained state

Secure operations include more than applying a baseline once. Typical work includes:

• remove or disable unnecessary services and default accounts
• patch supported software and firmware
• enforce secure configuration baselines
• protect privileged access and service accounts
• use allowlisting where it fits the environment
• centralize useful logs and keep time synchronized
• protect secrets and cryptographic keys
• validate backups and recovery procedures
• monitor for drift and unauthorized change

A baseline establishes the intended secure state. Configuration monitoring and change control help keep systems there. Asset management supports the same work: know what exists, who owns it, how important or sensitive it is, where it is, and how it should be handled through retirement and disposal.

For service and firewall scenarios, use the Common Ports and Protocols Reference rather than memorizing a second port list from this page. Be able to recognize the service, whether a secure alternative exists, and whether the question is asking about a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port or an IP protocol number.

Incident response: know the purpose of each phase

For Security+ review, use this working order:

Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons learned

• Preparation: plans, roles, contacts, tools, logging, backups, exercises.
• Detection: notice suspicious activity or an alert.
• Analysis: validate the event, determine scope and impact, identify evidence needs.
• Containment: limit spread or further harm.
• Eradication: remove malicious presence, compromised access, or exploited weakness.
• Recovery: restore, validate, reconnect, and monitor.
• Lessons learned: review what happened and improve controls, process, and preparation.

Containment is not eradication. Recovery is not eradication. An alert is not automatically a confirmed incident.

Use the Incident Response Order Quick Reference for FIRST and NEXT scenarios.

Evidence handling rewards restraint

When investigation or legal requirements matter, preserve useful evidence before an irreversible action when the situation allows. Volatile evidence can disappear when a system is powered off. Hashes can support evidence-integrity verification. Chain-of-custody records document who handled evidence, when, and why. Write blockers can help prevent changes to storage evidence during acquisition.

Do not let “preserve evidence” override immediate life-safety or severe-harm concerns. The scenario's priority still matters.

Automation can improve consistency and speed, but automated actions still need controlled permissions, testing, logging, error handling, and rollback or recovery plans. A script that makes the wrong change faster is not an operational win.

7. Security Program Management and Oversight

Governance documents differ by authority and detail

Use the Policies vs. Standards vs. Procedures vs. Guidelines Quick Reference if authority and detail are still getting mixed together.

Risk terms should describe the decision, not just the formula

• Risk appetite is the amount of possible loss, harm, disruption, or uncertainty an organization is willing to accept while pursuing its goals.
• Risk tolerance is the limit for how much loss, harm, delay, or disruption is acceptable in one area.
• Inherent risk is the risk before considering the effect of controls.
• Residual risk is what remains after controls and treatments are considered.
• Likelihood estimates how probable an event is.
• Impact describes the consequence if it occurs.

Common risk responses:

• Mitigate: reduce likelihood or impact with controls.
• Transfer/share: move or share part of the financial or contractual consequence, such as through insurance or agreements.
• Avoid: stop the activity creating the risk.
• Accept: knowingly retain the risk within authorized limits.

A compensating control is an alternative control used when the preferred or normal control cannot be implemented and comparable protection is still required. An exception should be approved and documented according to governance, not treated as permission to ignore a requirement indefinitely.

Quantitative risk: know what each number means

Single loss expectancy (SLE) = asset value (AV) × exposure factor (EF)

Annualized loss expectancy (ALE) = SLE × annualized rate of occurrence (ARO)

Example: A $100,000 asset with a 25% expected loss per incident has an SLE of $25,000. If the event is expected once every four years, ARO is 0.25 and ALE is $6,250.

Use the SLE, ARO, ALE and Risk Calculations Quick Reference when frequency conversions or formula roles need another pass.

Due care and due diligence are related, not interchangeable

Due care is the responsibility to take reasonable and appropriate steps to protect people, assets, and interests from foreseeable harm.

Due diligence is the ongoing process of investigating, verifying, monitoring, and documenting whether those safeguards remain appropriate and effective.

Care is about taking appropriate protective action. Diligence is the continuing work used to understand, verify, and maintain that protection.

Know what kind of third-party document you are looking at

Read the scenario for the missing business need. “Uptime target” points somewhere different from “keep this information confidential” or “define the deliverables for this project.”

Third-party risk does not end when the contract is signed. Selection can require due diligence, security questionnaires or evidence, data-flow review, clear responsibilities, incident-notification terms, and appropriate audit rights. Ongoing monitoring should match the provider's access, criticality, and the risk it introduces.

Assessment, audit, and testing answer different questions

A vulnerability scan finds potential weaknesses. A penetration test attempts exploitation within an authorized scope to show what can actually be achieved. An audit compares evidence and practice against defined criteria or requirements. A risk assessment identifies and analyzes risk. A gap analysis compares the current state with a target state.

Privacy and data-governance questions often reward collecting only what is needed, applying appropriate classification and access, keeping data only as long as required, and disposing of it appropriately. Regulatory or contractual requirements can change the correct retention and handling decision.

Security awareness works best as part of a larger control system. Training, phishing exercises, role-based instruction, reporting paths, and technical protections support one another. A user-awareness program does not replace email security, MFA, or monitoring.

8. Sequences, formulas, and memory anchors

Use this section as a final retrieval check. If you have to reason through every line from scratch, open the linked Quick Review and repair that topic before relying on the compressed version.

These are working review sequences. Real organizations may combine, rename, repeat, or reorder activities when circumstances require it. On the exam, use the process and facts given in the scenario rather than arguing with them because your employer labels a phase differently.

9. Decision rules for Security+ questions

Security+ frequently gives you more than one answer that could help. The task is to identify the one that best fits the requirement, timing, and constraints.

Read the question word before solving the technology

FIRST asks what belongs before the other valid actions in the scenario's current state.

NEXT asks what follows what has already happened.

BEST and MOST appropriate ask for the strongest fit, not the strongest-sounding technology.

LEAST, NOT, and other negative wording reverse the selection. Re-read the last sentence before committing an answer when the prompt is long.

Use what the scenario has already told you

If an incident is already confirmed and scoped, choosing “verify whether the alert is real” moves backward unless new uncertainty is introduced.

If containment is complete and the threat still exists, eradication may be the missing job.

If a vulnerability has already been patched, the next step may be validation rather than another scan that only rediscovers the original state.

Separate cause, symptom, and evidence

A system running slowly is a symptom. High processor utilization caused by malicious mining is evidence of a likely cause. Rebooting might remove the symptom temporarily without addressing persistence or the exploited weakness.

Pick the answer that addresses the problem the question actually asks about.

Respect the stated constraint

Availability, safety, evidence preservation, regulatory rules, legacy support, budget, latency, and business priority can eliminate an answer that would otherwise be technically sound.

Do not add a constraint that the scenario never gave you. “This company probably has no budget” is an invented fact unless the question says so.

Prefer the narrow action that satisfies the requirement

Least privilege and least functionality are useful security principles because they reduce unnecessary exposure. The same reasoning helps with questions: do not choose a disruptive enterprise-wide action when a targeted control fully addresses the stated problem.

This does not mean “always choose the smallest change.” Choose the action that solves the requirement without unnecessary scope.

Preserve evidence before destructive changes when investigation matters

Collect volatile or otherwise important evidence before wiping, rebuilding, or powering off when the scenario allows. Immediate safety and harm reduction can take priority, so this is a decision rule rather than an absolute command.

When every option sounds true, ask what security job each one performs

A firewall, EDR agent, SIEM, MFA deployment, encryption control, backup, and policy can all improve security. Only one may satisfy the specific requirement in the prompt.

Label the job in a few words:

• stop network traffic
• detect endpoint behavior
• correlate logs
• strengthen authentication
• protect confidentiality
• restore lost data
• establish organizational direction

The correct answer often becomes obvious once the jobs are separated.

For more question-pattern examples, use How Security+ Questions Try to Trick You.

10. Final readiness checklist

Before treating the final review as complete, make sure you can explain these without reading the answer first:

• the difference between a control category and a control function
• confidentiality, integrity, availability, authentication, authorization, accounting, and non-repudiation
• hashing, HMAC, encryption, encoding, digital signatures, salts, and key stretching
• who uses the public and private keys for encryption, decryption, signing, and verification
• what a certificate proves, what a trust chain does, and how expiration differs from revocation
• vulnerability, threat source, exploit, risk, and mitigation
• the clue that separates password spraying, credential stuffing, pass the hash, phishing variants, SQL injection, XSS, SSRF, replay, and common network attacks
• why the best vulnerability priority depends on context instead of severity alone
• cloud service-model responsibility and the limits of “the provider handles it”
• segmentation, isolation, data states, backups, replication, snapshots, and alternate-site tradeoffs
• RTO, RPO, MTTR, and MTBF
• authentication factors, MFA, SSO, federation, SAML, OAuth, OIDC, LDAP, and Kerberos at the level needed to identify their job
• IDS, IPS, EDR, XDR, SIEM, and SOAR
• the purpose and order of incident-response phases
• evidence integrity, chain of custody, and why volatile data may need to be collected first
• policy, standard, procedure, guideline, due care, due diligence, risk appetite, risk tolerance, and risk treatments
• SLE, ARO, and ALE calculations
• the difference between a vulnerability scan, penetration test, audit, risk assessment, and gap analysis
• the purpose of common third-party agreements such as NDA, SLA, MSA, SOW, MOU, and MOA

Do not spend another hour rereading items you can already explain. Open the exact domain guide or Quick Review for the few lines that still stall you.

Then use a fresh Security+ SY0-701 practice test. Review answers you guessed correctly as carefully as answers you missed. The useful final signal is whether you can recognize the clue, identify the security job, and explain why the chosen action fits better than the alternatives.

11. Official references

• CompTIA Security+ certification and exam information
• NIST SP 800-207: Zero Trust Architecture
• NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
• NIST Cybersecurity Framework 2.0