Study Hub
Course lessons and cheatsheets for every SY0-701 domain. Read a section, then practice it with a domain quiz.
Full Course
Every official exam objective explained in depth, with definitions, comparisons, worked examples, exam tips, and common traps.
1.0 General Security Concepts
12%4 objectives · 26 lessons
2.0 Threats, Vulnerabilities, and Mitigations
22%5 objectives · 34 lessons
3.0 Security Architecture
18%4 objectives · 27 lessons
4.0 Security Operations
28%9 objectives · 41 lessons
5.0 Security Program Management and Oversight
20%6 objectives · 36 lessons
Quick Cheatsheets
CIA Triad + Non-repudiation
Confidentiality — only authorized parties can read data (encryption, access controls). Integrity — data is unaltered and trustworthy (hashing, digital signatures, version control). Availability — systems are up when needed (redundancy, backups, HA).
Non-repudiation: a sender cannot deny an action — achieved with digital signatures (signed with the sender's private key, verified with their public key).
AAA
| Step | Question it answers | Example |
|---|---|---|
| Authentication | Who are you? | Password + TOTP code |
| Authorization | What may you do? | RBAC role grants file access |
| Accounting | What did you do? | Audit logs, session records |
Authenticating systems (not just people) uses certificates, e.g. 802.1X with device certs.
Security Control Categories & Types
| Category | Meaning | Examples |
|---|---|---|
| Technical | Implemented by systems | Firewalls, encryption, ACLs |
| Managerial | Policies & oversight | Risk assessments, policies |
| Operational | Performed by people | Guard patrols, awareness training |
| Physical | Tangible protections | Fences, locks, bollards |
| Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop it happening | Disable ports, ACLs |
| Deterrent | Discourage attempts | Warning signs, lighting |
| Detective | Identify & log | IDS, CCTV review, SIEM alerts |
| Corrective | Fix after the fact | Restore backups, patches |
| Compensating | Alternate when primary is impossible | Segmentation for unpatchable legacy |
| Directive | Mandate behavior | AUP, standard procedures |
Zero Trust
Never trust, always verify — no implicit trust from network location.
Control plane: adaptive identity, threat scope reduction, policy-driven access control, the Policy Engine (decides) and Policy Administrator (establishes sessions).
Data plane: implicit trust zones, subject/system, and the Policy Enforcement Point (enforces the decision).
Change Management
Business processes: approval, ownership, stakeholders, impact analysis, test results, backout plan, maintenance window, standard operating procedures.
Technical implications: allow/deny lists, restricted activities, downtime, service/application restarts, legacy applications, dependencies. Always update documentation and use version control.
Cryptography Essentials
| Tool | What it gives you | Notes |
|---|---|---|
| Symmetric (AES) | Fast bulk encryption | One shared key |
| Asymmetric (RSA/ECC) | Key exchange, signatures | Public + private key pair |
| Hashing (SHA-256) | Integrity | One-way; salt passwords |
| Digital signature | Integrity + non-repudiation | Hash encrypted with private key |
| Key stretching | Slow brute force | PBKDF2, bcrypt |
PKI: CA issues certs (after a CSR); revocation via CRL or OCSP. Key escrow stores keys with a third party. TPM = per-device key storage; HSM = enterprise key appliance.
Obfuscation: tokenization (replace with token), masking (hide characters), steganography (hide inside media). Blockchain: open public ledger.
Deception & Disruption
Honeypot — decoy system; honeynet — decoy network; honeyfile — bait file; honeytoken — bait credential/API key. All are detective/deterrent tools to study attackers safely.