SY0-701 — CompTIA Security+ Quick Review

Quick Review purpose

This Quick Review is for candidates preparing for the real CompTIA Security+ (SY0-701) exam. Use it as a fast, practical refresher before moving into topic drills, mock exams, and detailed explanations in an IT Mastery question bank.

The goal is not to replace full study. The goal is to help you quickly reconnect major concepts, spot common traps, and practice choosing the best answer when multiple options sound plausible.

This page is IT Mastery exam-prep support and is not affiliated with CompTIA.

How to use this page before practice

1. Scan the decision tables first. They help with “best,” “first,” and “most likely” questions.
2. Mark weak areas. If a row feels vague, turn it into a topic drill.
3. Practice by objective style, not just by definition. Security+ questions often ask what to do next, what control is most appropriate, or what risk is being reduced.
4. Review every explanation. For missed questions, the explanation is where you learn why the tempting answer was not best.

High-yield exam mindset

Security+ questions usually reward practical judgment:

Core security principles

CIA, AAA, and non-repudiation

Security control categories

Security+ often tests whether you can classify a control by purpose and implementation type.

Trap: A camera is usually detective if it records evidence, but it can also be deterrent if the question emphasizes discouraging intruders.

Identity and access management

Authentication factors

MFA trap: Two passwords are not MFA. MFA requires different factor types.

Access control models

Federation and identity protocols

Decision rule: If the question involves delegated access to an API, think OAuth. If it involves enterprise web SSO assertions, think SAML. If it involves identity claims plus login, think OpenID Connect.

Cryptography and PKI

Know the function, not just the term

PKI quick path

Common trap: Encoding, hashing, and encryption are different.

• Encoding changes format and is reversible without a secret.
• Hashing is one-way and supports integrity verification.
• Encryption is reversible only with the correct key.

Threats, attacks, and indicators

Social engineering

Best mitigation choices: user training helps, but technical controls such as MFA, email filtering, DMARC/SPF/DKIM, least privilege, and payment verification procedures are often stronger depending on the question.

Malware and endpoint threats

Trap: If the malware spreads without user action, a worm is more likely than a virus.

Application and web attacks

Password and credential attacks

Vulnerability management

Practical workflow

    flowchart LR
	    A[Discover assets] --> B[Scan or assess]
	    B --> C[Validate findings]
	    C --> D[Prioritize risk]
	    D --> E[Remediate or mitigate]
	    E --> F[Rescan and verify]
	    F --> G[Document exceptions]

Prioritization factors

Do not rely only on a severity label. Prioritize using context.

Trap: A vulnerability scan finding is not always proof of exploitability. Validate false positives before disruptive remediation.

Assessment types

Network security review

Segmentation and traffic control

Decision rule: If the attack is against a web application layer, a WAF is often more specific than a traditional firewall.

Secure protocol choices

Common ports worth recognizing

Trap: Ports help identify traffic, but modern attacks often use common allowed ports such as 443. Do not choose an answer based only on a port if the scenario gives stronger clues.

Secure architecture

Zero Trust

Zero Trust is a security model, not one product.

Trap: A VPN alone is not Zero Trust. VPNs often grant broad network access after connection.

Resilience and availability

Decision rule: If the question asks how much data loss is acceptable, think RPO. If it asks how long the service can be down, think RTO.

Cloud and shared responsibility

Trap: Moving to cloud does not remove the need for logging, IAM governance, encryption decisions, backups, and incident response planning.

IaaS, PaaS, SaaS

Containers and serverless

Endpoint, mobile, IoT, and OT security

Endpoint hardening

Mobile deployment models

Mobile controls

IoT and OT reminders

Trap: In OT environments, immediately patching or rebooting may be unsafe. Segmentation, monitoring, compensating controls, and planned maintenance may be better first answers.

Application security and DevSecOps

Secure SDLC essentials

Testing types

Trap: SAST may find code-level issues early, but it may miss runtime/configuration issues. DAST can find runtime behavior but usually sees less internal code detail.

Data protection

Security operations

Logging and monitoring

High-yield log clues:

Incident response sequence

A common practical flow:

    flowchart LR
	    A[Preparation] --> B[Identification]
	    B --> C[Containment]
	    C --> D[Eradication]
	    D --> E[Recovery]
	    E --> F[Lessons learned]

Trap: Do not jump to wiping systems if the question emphasizes evidence preservation or scope identification. In many scenarios, containment and evidence handling come before full remediation.

Evidence and forensics

Common volatility order, from more volatile to less volatile:

1. CPU registers/cache
2. RAM
3. Network connections/processes
4. Disk data
5. Backups/archives

Governance, risk, and compliance concepts

Policy hierarchy

Trap: If the question asks for a mandatory configuration requirement, “standard” is often better than “guideline.”

Risk management

Risk response options:

Business impact and continuity

Trap: A backup that has never been restored is an assumption, not proof of recoverability.

Third-party and supply chain risk

Trap: Third-party risk is not eliminated by outsourcing. Accountability for data and access decisions often remains with the organization.

Common “best answer” decision rules

Common candidate mistakes

Mistake 1: Choosing the most technical answer automatically

Security+ does not always reward the most advanced tool. If the scenario is about governance, user process, or risk acceptance, a policy, procedure, approval, or risk register entry may be the best answer.

Mistake 2: Confusing detection with prevention

An IDS detects. An IPS can block. A SIEM correlates and alerts. A firewall enforces traffic rules. Read whether the question asks to detect, prevent, respond, or document.

Mistake 3: Ignoring business context

Patching is important, but immediate patching may not be the best answer for a critical OT system, high-availability production service, or system requiring change control.

Mistake 4: Treating encryption as a solution for everything

Encryption protects confidentiality. It does not automatically provide availability, authorization, input validation, or user accountability.

Mistake 5: Missing “first” versus “best long-term”

• First: identify, contain, preserve, notify proper internal roles, follow procedure.
• Best long-term: remediate root cause, improve controls, automate, train, monitor.

Mistake 6: Overlooking least privilege

When two answers both work, the one that grants less access, narrows scope, or reduces blast radius is often better.

Performance-based question review tactics

For interactive or scenario-style questions:

1. Read the task before the exhibits. Know what you are building, matching, or selecting.
2. Identify constraints. Look for “least privilege,” “most secure,” “minimum downtime,” or “cost-effective.”
3. Place controls by layer. Network controls do not fix insecure code; IAM controls do not replace patching.
4. Use elimination. Remove insecure protocols, overly broad permissions, and answers that solve the wrong problem.
5. Check for completeness. A partially secure design may miss logging, redundancy, or access control.
6. Do not overconfigure. If the question asks for one best action, avoid adding assumptions not in the scenario.

Fast final review checklist

Before starting topic drills or a mock exam, confirm you can explain:

• Difference between authentication, authorization, and accounting
• MFA factor types and common identity protocols
• Symmetric encryption, asymmetric encryption, hashing, and digital signatures
• PKI certificate validation and revocation basics
• Common social engineering, malware, password, and web attacks
• Vulnerability management workflow and prioritization
• Firewalls, WAF, IDS, IPS, proxies, NAC, VPN, and ZTNA
• Secure protocol replacements for insecure services
• Zero Trust principles and segmentation
• Cloud shared responsibility across IaaS, PaaS, and SaaS
• Endpoint, mobile, IoT, and OT security constraints
• Secure SDLC, SAST/DAST, dependency scanning, and secrets management
• SIEM/SOAR/EDR monitoring and incident response phases
• Chain of custody and evidence integrity
• RTO, RPO, BIA, BCP, and DRP
• Risk responses: avoid, mitigate, transfer, accept
• Policy, standard, procedure, guideline, and baseline differences
• Third-party and supply chain risk controls

Practice focus recommendations

Use this Quick Review to choose your next practice set:

A practical next step: start with a focused set of original practice questions on your weakest SY0-701 topic, read every detailed explanation, then take a mixed question bank quiz to confirm you can apply the concept outside its original context.

Continue in IT Mastery

Use this Quick Review as a final concept map, then move into IT Mastery for focused topic drills, mixed practice sets, timed mock exams, and detailed explanations. The practice questions are original IT Mastery practice items; they are not official CompTIA questions, copied live-exam content, or exam dumps.