Skip to content

Security+ (SY0-701) — Coverage Map

This page is Step 2 of the repo's how to prepare a certification method: the contract between you and the exam. The official objectives document lists everything CompTIA can ask; this map lists everything this hub teaches. Lining the two up tells you, before you study, what is covered, what is thin, and what is missing.

The rows are the section headings that exist in this hub's five domain pages — nothing more. The official objective numbers are not reproduced here (the hub does not carry CompTIA's numbering, and this page will not invent it), so the first column is yours to fill.

How to fill it in:

  1. Download the official SY0-701 exam objectives PDF — the steps are in exam & objectives → how to get the official exam objectives.
  2. Walk the PDF objective by objective. For each one, find the matching row below and write the official number (as printed in the PDF) in the first column. One objective may span several rows, and one row may cover several objectives — record all of them.
  3. Any objective with no matching row goes in the gaps table at the end, marked "gap", with a note on where you will learn it.
  4. Then score every row 0–3 (the scale is in Step 3 of the method) and tick Practised? only after you have done the hands-on item for that topic.

The Domain 3 and Domain 4 pages number their sections 3.1 … 3.4 and 4.1 … 4.12 in the style of CompTIA's objective areas. Treat those as the hub's section numbers: confirm each against the PDF before copying it into the first column. Domain weights in the group headings are the ones the hub records from CompTIA's page (verify on CompTIA — weightings change per exam version).

How to use

  • Before studying: fill the first column and the self-score column; the zeros and ones are your syllabus. Study the weight-heavy domains first (4 → 2 → 5 → 3 → 1), unless a lower-weight domain is a prerequisite — Domain 1 is the vocabulary, so the hub's plan starts there.
  • During the study loop: after each domain page, revisit its rows — raise the score, tick Practised?, and use Notes for the weak-area log entry (what you got wrong, fixed?).
  • Before booking: the readiness gate (Step 6 of the method) needs every row at 2 or 3 and the gaps table empty or answered.
  • Where a row has a ↳, it is a subsection of the row above it; score it separately only if the PDF treats it as its own objective.
  • Rows link straight to the section, so this page doubles as the hub's fastest index.

Coverage map

Domain 1 — General Security Concepts (12%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 1. Security controls D1 → section __ ☐
____ ↳ Control categories (the nature of the control) D1 → subsection __ ☐
____ ↳ Control types (the function of the control) D1 → subsection __ ☐
____ 2. The CIA triad and non-repudiation D1 → section __ ☐
____ 3. Authentication, Authorization, and Accounting (AAA) D1 → section __ ☐
____ 4. Gap analysis D1 → section __ ☐
____ 5. Zero Trust D1 → section __ ☐
____ 6. Physical security D1 → section __ ☐
____ 7. Deception and disruption technology D1 → section __ ☐
____ 8. Change management D1 → section __ ☐
____ 9. Cryptographic solutions D1 → section __ ☐
____ ↳ Symmetric vs. asymmetric encryption D1 → subsection __ ☐
____ ↳ Levels at which encryption is applied D1 → subsection __ ☐
____ ↳ Keys and key management D1 → subsection __ ☐
____ ↳ Hashing, salting, and digital signatures D1 → subsection __ ☐
____ ↳ Public Key Infrastructure (PKI) D1 → subsection __ ☐
____ ↳ Other cryptographic concepts D1 → subsection __ ☐

Domain 2 — Threats, Vulnerabilities, and Mitigations (22%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 1. Threat actors and motivations D2 → section __ ☐
____ 2. Threat vectors and attack surfaces D2 → section __ ☐
____ 3. Social engineering D2 → section __ ☐
____ 4. Vulnerabilities D2 → section __ ☐
____ 5. Malicious activity and indicators D2 → section __ ☐
____ ↳ Malware types D2 → subsection __ ☐
____ ↳ Attacks by category D2 → subsection __ ☐
____ ↳ Indicators of compromise (IoCs) D2 → subsection __ ☐
____ 6. Mitigation techniques D2 → section __ ☐

Domain 3 — Security Architecture (18%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 3.1 Architecture models and their security implications D3 → section __ ☐
____ ↳ Cloud and the shared responsibility model D3 → subsection __ ☐
____ ↳ IaC, serverless, microservices D3 → subsection __ ☐
____ ↳ On-prem, virtualization, containerization D3 → subsection __ ☐
____ ↳ Network infrastructure: physical vs. software-defined D3 → subsection __ ☐
____ ↳ Centralized vs. decentralized D3 → subsection __ ☐
____ ↳ IoT, ICS/SCADA, RTOS, embedded D3 → subsection __ ☐
____ ↳ High availability as a model property D3 → subsection __ ☐
____ ↳ Considerations that drive the choice D3 → subsection __ ☐
____ 3.2 Enterprise infrastructure security principles D3 → section __ ☐
____ ↳ Device placement, security zones, and attack surface D3 → subsection __ ☐
____ ↳ Failure modes: fail-open vs. fail-closed D3 → subsection __ ☐
____ ↳ Device attributes: active/passive, inline/tap D3 → subsection __ ☐
____ ↳ Network appliances D3 → subsection __ ☐
____ ↳ Port security: 802.1X and EAP D3 → subsection __ ☐
____ ↳ Firewall types D3 → subsection __ ☐
____ ↳ Secure communication and access D3 → subsection __ ☐
____ 3.3 Data protection D3 → section __ ☐
____ ↳ Data types and classifications D3 → subsection __ ☐
____ ↳ Data states D3 → subsection __ ☐
____ ↳ Geographic and sovereignty considerations D3 → subsection __ ☐
____ ↳ Methods to secure data D3 → subsection __ ☐
____ 3.4 Resilience and recovery D3 → section __ ☐
____ ↳ High availability, load balancing, and clustering D3 → subsection __ ☐
____ ↳ Site considerations: hot, warm, cold D3 → subsection __ ☐
____ ↳ Diversity and distribution D3 → subsection __ ☐
____ ↳ Backups and power D3 → subsection __ ☐

Domain 4 — Security Operations (28%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 4.1 Secure baselines and hardening D4 → section __ ☐
____ 4.2 Secure mobile solutions D4 → section __ ☐
____ ↳ Deployment models D4 → subsection __ ☐
____ 4.3 Wireless security D4 → section __ ☐
____ 4.4 Application security D4 → section __ ☐
____ 4.5 Asset management D4 → section __ ☐
____ 4.6 Vulnerability management D4 → section __ ☐
____ 4.7 Security monitoring and alerting D4 → section __ ☐
____ 4.8 Enterprise security capabilities D4 → section __ ☐
____ 4.9 Identity and Access Management (IAM) D4 → section __ ☐
____ ↳ Lifecycle and core concepts D4 → subsection __ ☐
____ ↳ Federation and single sign-on (SSO) D4 → subsection __ ☐
____ ↳ Access-control models D4 → subsection __ ☐
____ ↳ Multi-factor authentication (MFA) D4 → subsection __ ☐
____ ↳ Privileged Access Management (PAM) D4 → subsection __ ☐
____ 4.10 Automation and orchestration (SOAR) D4 → section __ ☐
____ 4.11 Incident response D4 → section __ ☐
____ 4.12 Digital forensics and evidence D4 → section __ ☐
____ ↳ Log data sources for investigation D4 → subsection __ ☐

Domain 5 — Security Program Management and Oversight (20%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 1. Security governance D5 → section __ ☐
____ ↳ The document hierarchy D5 → subsection __ ☐
____ ↳ External considerations D5 → subsection __ ☐
____ ↳ Monitoring and revision D5 → subsection __ ☐
____ ↳ Governance structures D5 → subsection __ ☐
____ ↳ Data roles and responsibilities D5 → subsection __ ☐
____ 2. Risk management D5 → section __ ☐
____ ↳ The risk-management lifecycle D5 → subsection __ ☐
____ ↳ Risk identification and assessment frequency D5 → subsection __ ☐
____ ↳ Risk analysis: qualitative vs quantitative D5 → subsection __ ☐
____ ↳ Tracking and owning risk D5 → subsection __ ☐
____ ↳ Risk response strategies D5 → subsection __ ☐
____ ↳ Risk reporting D5 → subsection __ ☐
____ ↳ Business impact analysis (BIA) D5 → subsection __ ☐
____ 3. Third-party (vendor) risk management D5 → section __ ☐
____ ↳ Vendor assessment and selection D5 → subsection __ ☐
____ ↳ Agreement types (memorise the acronyms) D5 → subsection __ ☐
____ ↳ Ongoing vendor monitoring D5 → subsection __ ☐
____ 4. Compliance D5 → section __ ☐
____ ↳ Compliance reporting and consequences D5 → subsection __ ☐
____ ↳ Compliance monitoring D5 → subsection __ ☐
____ ↳ Privacy D5 → subsection __ ☐
____ 5. Audits and assessments D5 → section __ ☐
____ ↳ Attestation, internal, and external D5 → subsection __ ☐
____ ↳ Penetration testing D5 → subsection __ ☐
____ 6. Security awareness D5 → section __ ☐

Cross-cutting exam skills

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Performance-based questions (PBQs) — what they are and how to pace them Exam & objectives __ ☐
____ Mixed practice set (all five domains) Practice questions __ ☐
____ Last-week recall: cheat sheet, acronyms Cheat sheet __ ☐

Gaps you found

One row per official objective that has no matching row above. Decide where you will learn it (another page in this repo, the exam body's own material, a lab) and add that source to your plan.

Official objective What is missing Where you will learn it

Sources