CompTIA Security+ Course
Table of Contents
CompTIA Security+ SY0-701 covers five domains. This course introduces their terms and connects them through one fictional Harbor Library case. It gives you safe practice in control selection, threat analysis, architecture, operations, and risk governance. It does not replace the official objectives or supervised experience.
Before starting, understand basic IP networks, accounts and file permissions, the command line, and how a web service uses a database. If these are new, read the Network+ course and the Linux+ course first. Plan five study sessions for the lessons, then one session for the final exercise. Add time for terms or tools you need to learn.
You need a text editor and, for the optional hash exercise, a local terminal. Do not scan systems you do not own. The case uses only invented people, records, and documentation IP addresses . You can complete every worksheet without an employer account or cloud subscription.
| Order | Domain | Exam weight | Your evidence |
|---|---|---|---|
| 1 | General Security Concepts | 12% | Control matrix, file hashes, change record |
| 2 | Threats, Vulnerabilities, and Mitigations | 22% | Attack-chain worksheet and layered controls |
| 3 | Security Architecture | 18% | Trust-boundary diagram, flow rules, recovery plan |
| 4 | Security Operations | 28% | Synthetic alert triage and evidence record |
| 5 | Security Program Management and Oversight | 20% | Risk register, vendor questions, audit evidence |
The percentages follow the official SY0-701 objectives . Check the current CompTIA exam page before booking. The exam covers more detail than any one case.
How to study
- Read one lesson in order. Write the named evidence artifact before moving on.
- Compare your work with the example decision and pass condition in the lesson. Correct any claim you cannot support.
- Keep one folder with
controls.md,attack-chain.md,architecture.md,triage.md, andrisk-register.md. These are text files you create. Do not place real member or employer data in them. - Return to a lesson when you cannot explain why a control was selected, what evidence supports an incident conclusion, or how you would test a proposed fix.
Final practical assessment
Harbor Library reports that the Friday member export was found in a shared folder. Two failed sign-ins followed by one successful sign-in to its archive account appeared in a synthetic log. A vendor hosts encrypted backups, but nobody has recorded a restore test. The library must keep its public catalog available. Treat these as case facts, not proof of who accessed the data.
Create one short security decision package:
- A diagram with internet, public catalog, staff app, records database, backup store, and each trust boundary. Show allowed and denied flows.
- An attack timeline which separates observations, possible explanations, and missing evidence. Name an escalation owner and preserve the original log before analysis.
- A control table with at least three preventive, two detective, and one corrective control. Give each owner and a positive or negative test.
- A recovery plan with a stated RTO and RPO, backup scope, isolated restore test, and evidence fields. Explain why replication alone would not meet the requirement.
- A risk-register row with assumptions, estimated impact, treatment, residual risk, owner, and review date. Include one question for the backup vendor.
Pass only when you can defend each decision from the case facts, identify which tests remain unrun, and trace every proposed control to a risk. A peer should be able to reproduce your reasoning from the package without asking what a field means. Revise weak sections before taking the Security+ practice test . Practice questions check recall and judgment; a score alone does not prove workplace readiness.
Objective map and limits
Use the official SY0-701 objectives, version 5.0 as the detailed checklist. Each numbered objective below has a lesson and a practice artifact or a declared gap. The Harbor Library case covers a subset of the exam’s technologies and environments. An introduced topic is not evidence of independent implementation skill.
| Objective | Lesson and artifact | Further practice needed |
|---|---|---|
| 1.1 | General Concepts control matrix | Compare more control types. |
| 1.2 | General Concepts access decision | Physical and deception controls. |
| 1.3 | General Concepts change record | Run a supervised real change. |
| 1.4 | General Concepts hash and signature choice | Certificate lifecycle and key management. |
| 2.1 | Threats actor evidence decision | Attribute no actor from one case. |
| 2.2 | Threats attack-chain worksheet | Compare more vector types. |
| 2.3 | Threats weakness column | Reproduce distinct vulnerability classes safely. |
| 2.4 | Threats indicator timeline | Interpret more log and network patterns. |
| 2.5 | Threats control validation | Test controls in more environments. |
| 3.1 | Architecture responsibility matrix | Compare IaaS, PaaS, and SaaS duties. |
| 3.2 | Architecture flow rules | Test real network controls under supervision. |
| 3.3 | Architecture data-state controls | Compare classification and data handling. |
| 3.4 | Architecture restore plan | Perform an isolated restore. |
| 4.1 | Operations baseline board | Apply platform-specific baselines. |
| 4.2 | Operations asset entry | Trace an asset through disposal. |
| 4.3 | Operations vulnerability ticket | Verify a real authorized remediation. |
| 4.4 | Operations alert triage | Correlate varied alert sources. |
| 4.5 | Operations protocol decision | Configure and test approved controls. |
| 4.6 | Operations IAM rule | Test identity lifecycle in a lab. |
| 4.7 | Operations automation decision | Build a reviewed automation runbook. |
| 4.8 | Operations incident decision | Join a supervised exercise. |
| 4.9 | Operations synthetic log record | Compare packet, endpoint, and cloud evidence. |
| 5.1 | Program Management policy hierarchy | Review a real governance process. |
| 5.2 | Program Management risk register | Validate assumptions with an owner. |
| 5.3 | Program Management vendor question | Obtain an actual vendor answer. |
| 5.4 | Program Management applicability note | Check duties with counsel or compliance staff. |
| 5.5 | Program Management audit entry | Conduct a scoped assessment. |
| 5.6 | Program Management tabletop result | Assess an approved awareness program. |
Do not book the exam from this case alone. Close each gap with official objectives, additional labs, and practice questions. For workplace tasks, follow local authorization and review.
Filled final-package example
The completed example begins with two separate flows: internet to public catalog allowed on HTTPS and internet to records database denied. The archive sign-in sequence is an observation, not proof of compromise. The incident lead receives the preserved log and asks the account owner for a change record. The records lead restricts named exports and approves count-only output for the contractor. The backup owner sets an 8-hour RTO and 24-hour RPO, then records a restore test as not run. The risk owner records an open exception until the test and vendor access answer exist.
Score your own package before asking a peer:
| Criterion | Points |
|---|---|
| Correct trust zones and allow/deny flows | 2 |
| Timeline separates observed events from explanations | 2 |
| Controls have owner and positive or negative test | 2 |
| RTO/RPO math and restore evidence state are honest | 2 |
| Risk register names assumptions, owner, follow-up | 2 |
Pass the synthetic assessment at 10 of 10. If no peer is available, use each lesson’s worked checkpoint, hide it while you attempt the task, then compare line by line. Record any missed criterion and redo the task with a changed fact, such as a different source account or shorter RPO. Do not label a test passed if it was not run. Passing this package supports supervised foundation work, not independent incident command or exam certification.
References and next step
Use the official SY0-701 objectives as the scope checklist. NIST CSF 2.0 offers a way to organize governance and security outcomes. Continue into the Cybersecurity Career Playbook if you want role-specific pathways. Browse the course index for adjacent subjects.
