CompTIA Security+

• Threat actors, attributes and motivations

  ≈ 2.5%45 min

  Who attacks and why. Covers nation-state, unskilled, hacktivist, insider, organized crime, competitor and terrorist actors, their resources and sophistication, and their motivations (V7 2.1, V8 2.2).

  • Compare threat actors: nation-state/state-sponsored, unskilled attacker, hacktivist, insider (malicious and accidental), organized crime, competitor, terrorist, and shadow IT (SY0-701)
  • Evaluate actor attributes: internal/external, resources/funding and level of sophistication/capability
  • Match motivations to actors: financial gain, espionage, data exfiltration, service disruption, blackmail/extortion, political or ideological beliefs, revenge, notoriety, chaos, war and ethical hacking
  • Explain advanced persistent threats (APTs) and why they are usually attributed to state-sponsored actors

• Threat vectors and attack surfaces

  ≈ 2.5%55 min

  The routes attackers use: message-based, image- and file-based, browser, network and remote access, endpoint and living-off-the-land, supply chain, removable media, IoT/OT and signal-based vectors, and how to shrink the attack surface (V7 2.2, V8 2.3).

  • Identify message-based vectors (email, SMS, RCS, instant messaging, collaboration tools) and image- and attachment-based vectors (QR codes, embedded content, macros, RTF and PDF files)
  • Identify browser-based vectors (extensions, JavaScript, cookies, session tokens, password managers) and network and remote-access vectors (RDP, VNC, VPN, infrastructure and virtualized devices)
  • Explain endpoint-based vectors including built-in and living-off-the-land tools, malicious USB/removable media, and signal-based vectors (Bluetooth, RF, NFC)
  • Assess supply chain vectors: managed service providers, vendors, suppliers, logistics and SaaS providers
  • Reduce the attack surface created by open service ports, default credentials, unsupported software and IoT/OT devices such as cameras, sensors and printers

• Social engineering and human vectors

  ≈ 3%50 min

  Recognising phishing and its variants, pretexting, impersonation, business email compromise, watering holes, typosquatting and deepfakes from scenario clues, and choosing the control that stops each (V7 2.2 and 2.4, V8 2.3 and 2.5).

  • Distinguish phishing, spear phishing, whaling, vishing, smishing and quishing (QR-code phishing) from scenario details
  • Identify business email compromise, pretexting, impersonation, brand impersonation, typosquatting and watering-hole attacks
  • Explain misinformation/disinformation and deepfake-enabled impersonation, and verification through an out-of-band channel
  • Choose the most effective technical or training control for a given social-engineering attack

• Application vulnerabilities and attacks

  ≈ 3%1 h 15 min

  Memory injection, buffer overflows, race conditions, injection, cross-site scripting, request forgery, directory traversal, replay and privilege escalation, recognised from code, URLs and logs, with the secure-coding fix for each (V7 2.3 and 2.4, V8 2.4 and 2.5).

  • Explain memory injection and buffer overflow vulnerabilities and their mitigations (input validation, bounds checking, memory protection)
  • Recognise SQL injection, command injection, cross-site scripting and request forgery (CSRF/SSRF) from log entries, URLs or code snippets
  • Explain race conditions (time-of-check/time-of-use), malicious updates, hardcoded secrets and unsafe exception handling (SY0-801)
  • Identify directory traversal, replay and privilege escalation attacks from URL, log or session evidence
  • Select the secure coding practice or application control that prevents each vulnerability

• OS, hardware, virtualization, cloud and mobile vulnerabilities

  ≈ 3%1 h 5 min

  Vulnerabilities beyond application code: unpatched, legacy and end-of-life systems, firmware, VM escape and resource reuse, cloud misconfiguration, mobile sideloading and jailbreaking, zero-days, stale credentials, rogue devices and shadow IT (V7 2.3, V8 2.4).

  • Explain OS-based, firmware, end-of-life, legacy, unsupported, unpatched, obsolete and unmanaged system vulnerabilities
  • Describe virtualization vulnerabilities (VM escape, resource reuse) and cloud-specific risks such as publicly exposed object storage and public code repositories
  • Identify mobile device vulnerabilities: sideloading, jailbreaking/rooting and unmanaged devices
  • Explain zero-day, cryptographic and misconfiguration vulnerabilities, and the risk from stale credentials, rogue devices, shadow IT and identity providers
  • Identify supply chain vulnerabilities in service, hardware and software providers, and weaknesses in wireless and low-powered communications

• Malware types and indicators of compromise

  ≈ 3.5%1 h 10 min

  Distinguishing malware by behaviour and analysing indicators of malicious activity (hashes, processes, artifacts, account lockouts, impossible travel, missing logs) to decide what happened and what to do first (V7 2.4, V8 2.5).

  • Distinguish ransomware, trojans, worms, viruses, spyware, adware/bloatware, keyloggers, logic bombs, rootkits and fileless malware by behaviour
  • Analyse indicators of compromise: file hashes, malicious IP addresses and domains, malicious processes, file system artifacts, timestamps and plaintext strings
  • Interpret account and resource indicators: account lockout, concurrent sessions, impossible travel, excessive resource consumption, resource inaccessibility and blocked content
  • Recognise log-based indicators: out-of-cycle logging, missing logs and log manipulation
  • Select the appropriate first response for the malware identified (isolate, contain, reimage, restore from backup)

• Network, cryptographic and credential attacks

  ≈ 3.5%1 h 10 min

  Analysing DDoS, DNS, on-path, spoofing, sniffing and wireless attacks, downgrade and collision attacks, and password spraying, brute force, enumeration, replay and MFA bypass from traffic and authentication evidence (V7 2.4, V8 2.5).

  • Analyse DDoS (including amplified and reflected), DNS attacks (cache poisoning, hijacking), on-path, spoofing, sniffing and rogue/evil-twin wireless attacks from traffic or log evidence
  • Recognise protocol/cryptographic downgrade attacks, and collision and birthday attacks on hashes (SY0-701)
  • Distinguish password spraying, brute force, user enumeration, credential replay and MFA bypass/fatigue from authentication logs
  • Select the control that stops each attack (rate limiting, DNSSEC, 802.1X, lockout thresholds, phishing-resistant MFA, TLS with HSTS)

• AI and LLM threats and vulnerabilities (SY0-801)

  ≈ 2%55 min

  Security+ V8 (from ~2026-11-17) only

  The new SY0-801 objective 2.6, plus the LLM attack surface from 2.4. Covers model manipulation, poisoning, prompt injection, jailbreaking, evasion, data loss, privacy, hallucinations, bias, explainability, ethics, session hijacking and code execution in AI-enabled systems.

  • Explain model manipulation, training-data poisoning and evasion attacks against AI systems
  • Recognise direct and indirect prompt injection and jailbreaking against LLM applications, and the session hijacking or code execution they can lead to
  • Assess data loss and privacy risks when users or applications send sensitive data to AI tools
  • Evaluate hallucinations, bias, explainability and ethical considerations as security and governance risks
  • Treat LLMs as an attack surface and select mitigations: input/output filtering, least-privilege tool access, human review, data classification and an AI acceptable-use policy

About 8 h 5 min of study, lessons and core practice

• Cloud, virtualization and modern architecture models

  ≈ 3%1 h 5 min

  Security implications of cloud service and deployment models, the shared responsibility matrix, infrastructure as code, serverless, microservices, containers and virtualization, and the technical and business considerations that decide between them (V7 3.1, V8 3.1).

  • Apply the cloud shared responsibility (responsibility matrix) model across IaaS, PaaS and SaaS
  • Compare public, private, hybrid, community and multicloud deployments, including hybrid and third-party vendor considerations
  • Explain the security implications of infrastructure as code, serverless, microservices, containerization (SY0-701) and virtualization
  • Evaluate architectures against availability, resilience, cost, responsiveness, scalability, ease of deployment and recovery, patch availability, power and compute
  • Weigh business considerations: data sovereignty, data classification, ownership, usability and proprietary vs open source (SY0-801)

• On-premises, segmented, OT, IoT and embedded architectures

  ≈ 2.5%50 min

  Air-gapped and segmented networks, software-defined networking, centralized and decentralized designs, and the special constraints of ICS/SCADA, operational technology, RTOS, embedded and IoT systems that often cannot be patched (V7 3.1, V8 3.1).

  • Compare centralized and decentralized, on-premises designs, and physical isolation (air-gapped networks) vs logical segmentation and software-defined networking
  • Explain the security constraints of ICS/SCADA and operational technology, RTOS, embedded systems and IoT devices: inability to patch, long life cycles, safety and availability priorities
  • Select compensating controls for systems that cannot be patched: segmentation, air gaps, monitoring and strict access control
  • Weigh risk transference, power and compute limitations when choosing an architecture

• Secure enterprise network infrastructure

  ≈ 3.5%1 h 15 min

  Applying security principles to network design: device placement, security zones, failure modes, inline vs tap devices, jump servers, proxies, IDS/IPS, load balancers, 802.1X port security and firewall types (V7 3.2, V8 3.2).

  • Apply device placement, security zones and screened subnets to reduce the attack surface
  • Choose failure modes (fail-open vs fail-closed) and device attributes (active vs passive, inline vs tap/monitor) to meet a requirement
  • Place network appliances correctly: jump servers, proxy servers, IDS/IPS, load balancers and sensors
  • Configure port security with 802.1X and EAP
  • Compare firewall types: web application firewall, UTM, next-generation firewall, and layer 4 vs layer 7 inspection
  • Select effective controls for a network diagram, including vendor and platform diversity (SY0-801)

• Secure communication, remote access and Zero Trust access

  ≈ 2.5%1 h

  VPNs and tunneling (TLS, IPsec), SD-WAN and SASE (V7) and Security Service Edge (V8), secure administrative access and file transfer, Zero Trust access decisions, and the service and privileged identities behind them (V7 3.2, V8 3.2).

  • Compare VPN options and tunneling protocols: TLS VPN vs IPsec (transport vs tunnel mode, AH vs ESP), site-to-site vs remote access
  • Explain SD-WAN and secure access service edge (SASE) (SY0-701) and Security Service Edge (SSE) (SY0-801)
  • Secure administrative access with out-of-band management and jump servers, and use secure file transfer (SFTP, FTPS)
  • Apply Zero Trust access: user authentication, device health and inventory checks, per-application access control and end-to-end encrypted messaging
  • Manage service and privileged identities with group managed service accounts (gMSAs) and least-privilege accounts, and prevent privilege creep (SY0-801)

• Data types, classification, states and protection methods

  ≈ 3%1 h 10 min

  Classifying data, protecting it at rest, in transit and in use, choosing between encryption, hashing, masking, tokenization and obfuscation, and the roles, handling rules, life cycle and sovereignty issues that govern it (V7 3.3, V8 3.3).

  • Classify data by type (regulated, trade secret, intellectual property, legal, financial, human- vs non-human-readable, structured vs unstructured) and label (public, private, sensitive, confidential, restricted, critical, secret/top secret)
  • Protect each data state: at rest, in transit and in use
  • Select protection methods: encryption, hashing, masking, tokenization, obfuscation, de-identification, segmentation, permission restrictions and geographic restrictions/geofencing
  • Explain data sovereignty and geolocation, data protection roles (owner, custodian, steward, controller, processor/subprocessor) and the data life cycle from creation to disposal (roles and life cycle: SY0-801)
  • Apply data compliance categories: health, personal, financial, child/minor, intellectual property and legal data

• High availability and site resilience

  ≈ 2%50 min

  Load balancing, clustering and autoscaling, hot, warm and cold sites, geographic dispersion, platform diversity, multicloud, capacity planning, continuity of operations and power resilience (V7 3.4, V8 3.4).

  • Compare load balancing, clustering and autoscaling for high availability
  • Choose hot, warm or cold sites and geographic dispersion to meet recovery requirements at acceptable cost
  • Apply platform diversity (vendors, hardware, virtualization) and multicloud systems to remove single points of failure
  • Plan capacity across people, technology and infrastructure to sustain continuity of operations
  • Select power resilience: UPS, generators, redundant power supplies and surge protection

• Backups, recovery testing and recovery metrics

  ≈ 2%50 min

  Designing backups (frequency, onsite/offsite, encryption, snapshots, replication, journaling, immutability), testing recovery with tabletop, failover, simulation and parallel processing, and applying RTO, RPO, MTTR and MTBF (V7 3.4 and 5.2, V8 3.4).

  • Design backups: onsite/offsite, frequency, encryption, snapshots, replication, journaling, retention, scope and immutability
  • Test resilience with tabletop exercises, failover tests, simulations and parallel processing, and verify restores regularly
  • Define and apply RTO, RPO, MTTR and MTBF, and derive recovery targets from a business impact analysis
  • Choose the backup and recovery strategy that meets a stated RPO and RTO at the lowest cost

About 7 h of study, lessons and core practice

• Mitigation techniques, secure baselines and hardening

  ≈ 2.5%1 h

  The enterprise mitigation toolkit: segmentation, access control, allow lists, isolation, patching, configuration enforcement, decommissioning, secure baselines, hardening each target type, deception technology and sandboxing (V7 2.5 and 4.1, V8 4.1).

  • Apply mitigation techniques: segmentation, access control (ACLs, permissions), application allow/block lists, isolation, patching, encryption, monitoring, least privilege, configuration enforcement and decommissioning
  • Establish, deploy and maintain secure baselines using benchmarks, Group Policy and configuration management
  • Harden workstations, servers, switches, routers, cloud infrastructure, mobile devices, ICS/SCADA, embedded/RTOS and IoT: disable unused ports and protocols, change default passwords, remove unnecessary software, enable host firewall and HIPS
  • Deploy deception and disruption technology: honeypots, honeynets, honeyfiles, honeytokens and canary accounts (SY0-801)
  • Use sandboxing to isolate untrusted code and analyse suspicious files

• Wireless and mobile device security

  ≈ 1.5%45 min

  Planning and securing wireless networks (site surveys, heat maps, WPA3, RADIUS, EAP) and managing mobile devices with MDM across BYOD, COPE and CYOD deployment models (V7 4.1, V8 4.1 and 2.4).

  • Plan wireless installations with site surveys and heat maps
  • Configure wireless security: WPA3 (SAE), enterprise authentication with RADIUS/802.1X and EAP methods, and avoid WEP, WPA and TKIP
  • Deploy mobile device management and choose a deployment model: BYOD, COPE, CYOD or corporate-owned
  • Secure connection methods (cellular, Wi-Fi, Bluetooth) and detect rogue access points with a wireless intrusion prevention system (WIPS)

• Firewalls, IDS/IPS and network access control

  ≈ 2.5%1 h 5 min

  Writing and ordering firewall rules and ACLs, choosing between network, host and wireless IDS/IPS and their detection methods, and enforcing network access control with 802.1X, captive portals and posture checks (V7 4.5, V8 4.1).

  • Write and order firewall rules and access lists (source, destination, port, protocol, action, implicit deny) for a screened subnet scenario
  • Compare NIDS/NIPS, HIDS/HIPS and WIPS, and signature-based vs anomaly/trend-based detection
  • Configure network access control: 802.1X, captive portals, endpoint posture/compliance checks, agent vs agentless
  • Apply rate limiting, WAF rules, UTM and layer 4 vs layer 7 filtering to stop a described attack

• Web filtering, DNS filtering, email security and secure protocols

  ≈ 1.5%50 min

  Web and content filtering, DNS filtering, email authentication (SPF, DKIM, DMARC, BIMI) and gateways, and choosing secure protocols and ports in place of insecure ones (V7 4.5, V8 4.1).

  • Configure web filtering: agent-based vs centralized proxy, URL scanning, content categorization, block rules and reputation
  • Apply DNS filtering and DNSSEC to block malicious domains and prevent spoofed responses
  • Explain SPF, DKIM, DMARC (none/quarantine/reject policies) and BIMI (SY0-801), and secure email gateways
  • Select secure protocols and ports: SSH 22, HTTPS 443, LDAPS 636, SFTP, FTPS, SNMPv3, SRTP, IMAPS 993, POP3S 995 and S/MIME
  • Implement secure protocols by choosing the protocol, port and transport method for a requirement

• Endpoint, operating system and application security

  ≈ 2%55 min

  Antivirus, EDR and XDR, user behaviour analytics, file integrity monitoring and DLP on endpoints, OS hardening with Group Policy and SELinux, and application security controls from input validation to code signing and secrets scanning (V7 4.1 and 4.5, V8 4.1).

  • Compare antivirus, EDR and XDR, and use user behaviour analytics to detect anomalies
  • Apply file integrity monitoring and data loss prevention (endpoint agent vs network/centralized)
  • Harden operating systems with Group Policy and SELinux
  • Apply application security: input validation, secure cookies, static code analysis, code signing and secrets scanning in code repositories (SY0-801)
  • Enforce application control with allow lists and block lists

• Hardware, software and data asset management

  ≈ 1.5%40 min

  The asset life cycle and its security implications: procurement, assignment and ownership, inventory and enumeration, and disposal with sanitization, destruction and certification (V7 4.2, V8 4.2).

  • Explain the asset life cycle: planning/scoping, acquisition/procurement, assignment/accounting (ownership, classification), monitoring/tracking (inventory, enumeration) and disposal/decommissioning
  • Select disposal methods: sanitization (overwrite, secure erase, cryptographic erase), destruction (shredding, degaussing, pulverizing) and certificates of destruction
  • Balance data retention requirements against disposal
  • Identify the risks created by untracked assets and improper decommissioning

• Threat intelligence and vulnerability management

  ≈ 3%1 h 10 min

  The full vulnerability management cycle: identification (scans, code analysis, pen tests, threat feeds, CSPM), analysis and prioritization with CVSS and CVE, response, validation and reporting, plus bug bounties and responsible disclosure (V7 4.3, V8 2.1 and 4.3).

  • Identify vulnerabilities with credentialed and non-credentialed scans, static/dynamic application analysis, package monitoring, penetration testing, source code review, IPAM and CSPM (IPAM/CSPM: SY0-801)
  • Use threat intelligence: threat feeds, OSINT, proprietary/third-party feeds, information-sharing organizations and the dark web, and assess likelihood and impact
  • Analyse findings: confirm true/false positives and negatives, and prioritize with CVSS, CVE, exposure factor, environmental variables, industry impact and risk tolerance
  • Choose a response: patching, segmentation, compensating controls, insurance, or exceptions and exemptions
  • Validate remediation by rescanning, audit and verification, report internally and externally, and run bug bounty and responsible disclosure programs

• Security alerting and monitoring

  ≈ 2%55 min

  Monitoring systems, applications and infrastructure with SIEM, SCAP and benchmarks, agents and agentless tools, NetFlow, SNMP, syslog and packet analysis, and tuning alerts so the right event gets action first (V7 4.4, V8 4.4).

  • Monitor systems, applications and infrastructure with agent-based and agentless tools
  • Explain monitoring activities: log aggregation, alerting, scanning, reporting, archiving, alert response/quarantine and alert tuning to reduce false positives
  • Use monitoring tools: SIEM, SCAP and benchmarks, antivirus, DLP, vulnerability scanners, SNMP traps, NetFlow, syslog, packet analyzers and port mirroring
  • Interpret dashboards and automated alerts to decide which event needs action first

• Identity management, federation and single sign-on

  ≈ 2%50 min

  The identity life cycle (proofing, provisioning, deprovisioning, access review), SSO and federation with SAML, OAuth and LDAP, account types and attestation (V7 4.6, V8 4.5).

  • Manage the account life cycle: identity proofing, provisioning and deprovisioning, permission assignment and access reviews
  • Compare SSO and federation protocols (SAML, OAuth with OpenID Connect, LDAP) and interoperability between identity providers and service providers
  • Distinguish account types: user, privileged (global/local), service, third-party and emergency access accounts (SY0-801)
  • Use attestation and account auditing to detect privilege creep and orphaned accounts

• Authentication, MFA, passwords and access control models

  ≈ 2.5%1 h

  Access control models (MAC, DAC, RBAC, rule-based, ABAC, time-based, just-in-time), MFA factors and implementations, password policy, passkeys and passwordless login, and privileged access management (V7 4.6, V8 4.5).

  • Compare access control models: mandatory, discretionary, role-based, rule-based, attribute-based (SY0-701), time-of-day/time-based and just-in-time, with least privilege
  • Implement MFA using factors (something you know, have, are; somewhere you are) and methods: biometrics, hard/soft tokens, security keys, OTP and backup codes
  • Apply password best practices (length, complexity, reuse, expiration, age), password managers, passwordless authentication and passkeys (SY0-801), and compromised-credential monitoring
  • Use privileged access management: just-in-time permissions, password vaulting and ephemeral credentials

• Automation, orchestration and AI in security operations

  ≈ 1.5%40 min

  Where scripting and orchestration improve security (provisioning, guard rails, ticketing, CI/CD), their benefits and risks, and AI capabilities in security operations (V7 4.7, V8 4.6).

  • Identify automation use cases: user and resource provisioning, guard rails, security groups, ticket creation and escalation, enabling/disabling services and access, CI/CD testing, desired state management and API integrations
  • Explain benefits: efficiency, enforcing baselines, standard configurations, secure scaling, faster reaction time and workforce multiplication
  • Weigh considerations: complexity, cost, single points of failure, technical debt, ongoing supportability and process risk
  • Describe AI in security operations: agentic AI, chatbots, predictive analysis and AI-augmented baselines (SY0-801)

• Incident response process and activities

  ≈ 2.5%1 h

  The incident response life cycle in order, preparation with playbooks and exercises, choosing the right next step, root cause analysis, threat hunting, and notification and negotiation in V8 (V7 4.8, V8 4.7).

  • Order the incident response process: preparation, detection/identification, analysis, containment, eradication, recovery and lessons learned (SY0-801 adds investigation, negotiation and notification/external reporting)
  • Prepare with training, roles, playbooks, tabletop exercises and simulations
  • Select the correct next action at each stage (for example, contain before eradicating, and preserve evidence before reimaging)
  • Perform root cause analysis and proactive threat hunting
  • Handle notification to stakeholders, customers, law enforcement and regulators, including ransomware negotiation considerations (SY0-801)

• Digital forensics and investigation data sources

  ≈ 2%1 h

  Forensic principles (legal hold, chain of custody, order of volatility, preservation, e-discovery) and choosing and correlating the log and data sources that answer an investigation question (V7 4.8 and 4.9, V8 4.7 and 4.8).

  • Apply forensic principles: legal hold, chain of custody, acquisition by order of volatility, preservation, e-discovery and reporting
  • Choose the log source that answers an investigation question: firewall, application, endpoint, OS security, IDS/IPS, network, authentication logs and metadata
  • Use data sources: vulnerability scans, automated reports, dashboards, packet captures, NetFlow/IPFIX and surveillance footage
  • Acquire system images (memory dump, bit-level copy, snapshot) and verify integrity with hashes
  • Parse and correlate logs to build an incident timeline

About 11 h 50 min of study, lessons and core practice

• Security governance: policies, standards and procedures

  ≈ 3%55 min

  The governance document hierarchy (guidelines, policies, standards, procedures), key policies, external considerations, governance structures and roles for systems and data (V7 5.1, V8 5.1).

  • Distinguish guidelines, policies, standards and procedures, and choose the right document for a need
  • Explain key policies: acceptable use, information security, business continuity, disaster recovery, incident response, SDLC, change management, BYOD, clean desk, data classification and retention, access control, data disposal, vulnerability disclosure and privacy
  • Describe standards (password, access control, physical security, encryption, baselines) and procedures (onboarding/offboarding, playbooks, runbooks, SOPs)
  • Explain external considerations (regulatory, legal, industry, local/regional, national, global) and governance structures (boards, committees, government entities, centralized vs decentralized)
  • Assign roles for systems and data: owner, controller, processor, custodian/steward

• Risk management and quantitative risk analysis

  ≈ 3.5%1 h 10 min

  The risk management process from identification to reporting: qualitative and quantitative analysis (SLE, ALE, ARO, EF), risk registers, appetite and tolerance, treatment strategies and business impact analysis (V7 5.2, V8 5.2).

  • Explain risk identification, assessment types (ad hoc, recurring, one-time, continuous) and qualitative vs quantitative analysis
  • Calculate SLE = asset value × exposure factor and ALE = SLE × ARO, and use ALE to justify a control’s cost
  • Maintain a risk register with owners, key risk indicators and thresholds, and define risk appetite (expansionary, conservative, neutral: SY0-701) and tolerance
  • Choose a risk treatment (transfer, accept with exemption or exception, avoid, mitigate) and identify residual risk
  • Conduct a business impact analysis and report risk to management

• Third-party risk assessment and management

  ≈ 2.5%45 min

  Selecting, contracting and monitoring vendors: due diligence, right-to-audit, questionnaires, agreement types (SLA, MOU, MOA, MSA, SOW, NDA, BPA) and rules of engagement (V7 5.3, V8 5.3).

  • Assess vendors with penetration testing, right-to-audit clauses, evidence of internal audits, independent assessments, supply chain analysis and questionnaires
  • Select vendors using due diligence and conflict-of-interest checks, and RFP, RFI, RFQ and EOI processes (SY0-801)
  • Compare agreement types: SLA, SLO (SY0-801), MOA, MOU, MSA, SOW/work order, NDA and BPA
  • Monitor vendors, define rules of engagement, and weigh vendor lock-in, jurisdiction and staffing constraints

• Security compliance and privacy

  ≈ 2.5%50 min

  Compliance reporting and monitoring, consequences of non-compliance, privacy obligations (data subject rights, controller vs processor, retention, right to be forgotten) and legal compliance such as legal holds (V7 5.4, V8 5.4).

  • Explain compliance reporting (internal, external) and monitoring: due diligence/due care, attestation and acknowledgement, and automation
  • Identify consequences of non-compliance: fines, sanctions, reputational damage, loss of license and contractual impacts
  • Apply privacy concepts: data subject, controller vs processor, ownership, data inventory and retention, right to be forgotten, opt-in/opt-out and processing restrictions
  • Explain legal implications at local/regional, national and global levels, legal holds and legal orders
  • Describe compliance training such as data handling, AML/CTF and anti-bribery (SY0-801)

• Audits, assessments and penetration testing

  ≈ 2.5%55 min

  Internal and external audits and attestation, penetration test types and environments, passive vs active reconnaissance, assessment scoping, and in V8 the attack frameworks used to structure findings (V7 5.5, V8 5.5).

  • Distinguish internal audits (compliance, audit committee, self-assessments), external audits (regulatory, examinations, assessments, independent third-party audits) and attestation
  • Compare penetration test types (physical, offensive, defensive, integrated) and environments (known, partially known, unknown)
  • Distinguish passive and active reconnaissance and give examples of each
  • Plan assessments: scoping, audit charter, frequency, rules of engagement, gap analysis and benchmarking (SY0-801)
  • Use MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model of Intrusion Analysis to structure assessment findings (SY0-801)

• Security awareness practices

  ≈ 2%40 min

  Running phishing campaigns, recognising anomalous behaviour, delivering user training on the right topics, and measuring whether the program works (V7 5.6, V8 5.6).

  • Run phishing campaigns and teach users to recognise and report suspicious messages
  • Recognise anomalous user behaviour: risky, unexpected and unintentional
  • Deliver training on policies/handbooks, situational awareness, insider threat, password management, removable media and cables, social engineering, operational security and hybrid/remote work
  • Choose training types (onboarding, ongoing, targeted, corrective) and delivery mechanisms, and measure effectiveness with metrics and reports (SY0-801)

About 5 h 15 min of study, lessons and core practice

• Performance-based question (PBQ) skills

  ≈ 1%1 h

  How to work the 3–5 simulations that open most Security+ forms. Covers completing firewall rule tables, analysing logs, matching attacks to controls, placing devices on diagrams and ordering procedures, all under time pressure.

  • Complete or correct a firewall rule table or ACL, including rule order and implicit deny
  • Analyse web, authentication, firewall and endpoint logs to identify the attack, the affected host and the correct response
  • Match attacks, controls, protocols or policies to descriptions, and place security devices and controls on a network diagram
  • Order incident response, forensic acquisition (order of volatility) and change management steps
  • Manage PBQ time: preview, skip and flag, answer the multiple choice first if needed, then return with a fixed time budget

About 1 h of study, lessons and core practice