What the SY0-701 exam looks like
The two largest domains, Security Operations and Security Program Management, together account for nearly half the exam. Both are heavier on process and governance than on technology, which is the opposite of what most candidates expect from a security exam.
| Item | Detail |
|---|---|
| Exam code | SY0-701 |
| Questions | Maximum 90 |
| Time | 90 minutes |
| Format | Multiple choice and performance-based questions |
| Scoring | Scaled 100-900, passing score 750 |
| General Security Concepts | 12% |
| Threats, Vulnerabilities and Mitigations | 22% |
| Security Architecture | 18% |
| Security Operations | 28% |
| Security Program Management and Oversight | 20% |
Practice: threats and attacks
A finance employee receives an email that appears to come from the chief executive, requesting an urgent wire transfer and asking them to keep it confidential. Which attack is this?
Business email compromise, delivered as whaling - a phishing attack impersonating or targeting a senior executive. The distinguishing features are the executive impersonation, the urgency and the secrecy request, which together defeat the normal approval process. Generic phishing would not name a specific executive or target a specific employee.
An attacker leaves USB drives in a company car park hoping employees will plug them in. What is this?
Baiting, a social-engineering technique that relies on curiosity. The related terms are worth separating: tailgating is following someone through a controlled door, pretexting is inventing a scenario to justify a request, and shoulder surfing is observing credentials being entered.
A web application allows a user to submit input that is stored and later rendered in another user's browser, executing script. Which vulnerability?
Stored cross-site scripting. The word stored matters: reflected XSS returns the payload immediately in the response to the same request, while stored XSS persists it for other users. SQL injection would involve the input reaching a database query rather than being rendered as script.
Which attack involves an adversary positioning themselves between two parties to intercept and potentially alter their communications?
An on-path attack, previously known as man-in-the-middle. CompTIA has adopted on-path as the current terminology, which matters if your study material is older - the exam uses the newer term.
Practice: controls, architecture and governance
Two classification systems run in parallel here and the exam checks that you have not merged them. A control has a category - technical, managerial, operational or physical - describing who or what implements it, and a type - preventive, detective, corrective, deterrent, compensating or directive - describing what it does.
A security awareness training programme falls into which control category?
Operational, because it is carried out by people rather than by technology, management structures or physical barriers. Note the two-axis trap: by type, the same programme is preventive, since its purpose is to stop incidents occurring. A question may ask for either axis, so read which one it wants.
A legacy system cannot be patched without breaking a critical application. The organisation isolates it on a dedicated network segment with restricted access. What kind of control is the segmentation?
A compensating control. The defining characteristic is that the primary control - patching - is not feasible, so an alternative reduces the risk to an acceptable level. Compensating control questions almost always contain a stated reason why the obvious fix cannot be applied; that clause is the clue.
Which document defines the specific performance metrics and uptime a service provider must meet?
The service level agreement. Learn the neighbouring documents alongside it: a memorandum of understanding records a broad, generally non-binding intent; a business partners agreement governs the relationship between two companies working together; a non-disclosure agreement covers confidentiality; and a master service agreement sets the overarching terms under which specific work orders operate.
A company wants access decisions to depend on the user's department, the device's compliance state and the time of day. Which access-control model?
Attribute-based access control. Multiple simultaneous attributes are the signal. Role-based access control would grant permissions by job role alone, discretionary access control leaves decisions to the resource owner, and mandatory access control enforces them centrally by classification labels.
Which cryptographic property does a digital signature provide that a message authentication code does not?
Non-repudiation. A digital signature uses the sender's private key, which only they hold, so they cannot credibly deny having signed. A MAC uses a shared secret key, so either party could have produced it - which gives integrity and authentication but not non-repudiation.
Practice: security operations and incident response
The largest domain, and the one where ordering questions concentrate. Learn the incident-response phases as a sequence: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.
An analyst confirms malware is running on a user workstation connected to the corporate network. What should be done first?
Contain it - isolate the host from the network. Every other option is defensible later: reimaging is eradication and recovery, notifying management is part of the communication plan, and analysing the sample is valuable intelligence. But containment comes first because the immediate priority is limiting the blast radius. Reordering these is the single most common Security+ mistake.
During which incident-response phase would an organisation update its playbooks based on what went wrong?
Lessons learned, the final phase. Note the loop: the output of lessons learned feeds back into preparation, which is why preparation is listed first rather than treated as a one-off. Questions sometimes ask which phase benefits from lessons learned, and the answer is preparation.
Which log source would best establish whether a specific user account authenticated to a server at a given time?
The server's security or authentication logs, aggregated in a SIEM if one is deployed. Match the log to the question: firewall logs show traffic allowed or denied, DNS logs show name resolution and can reveal command-and-control lookups, and application logs show in-application behaviour. Choosing the wrong source is a common trap.
A vulnerability scan reports a critical finding, but investigation shows the affected service is not installed. What is this?
A false positive. Keep the four outcomes straight: a true positive is a real finding correctly reported, a false positive is a reported finding that is not real, a false negative is a real issue the scan missed, and a true negative is correctly reporting nothing. False negatives are the dangerous ones and the exam likes to ask why.
Practice this now
How to choose between two correct answers
This is the skill the exam is actually measuring, and it is learnable. When two options are both true, work through a fixed set of tie-breakers rather than re-reading the options hoping one will look better.
- ✓Find the constraint. Scenarios usually contain a limiting clause - cannot be patched, must not affect availability, with no additional budget. The best answer respects it; the merely correct one ignores it.
- ✓Check the ordering. If the question says first, immediately or next, you are being asked about sequence, and the technically strongest action is often the wrong one for that moment.
- ✓Match the scope. A question about one workstation does not want an enterprise-wide policy change, and a question about organisational risk does not want a single host fix.
- ✓Prefer the least disruptive action that satisfies the requirement. Security+ consistently rewards proportionate responses.
- ✓Identify who is asking. A question framed around the board or a regulator wants governance language; one framed around an analyst on shift wants an operational step.