Core concepts
- CIA triad: Confidentiality (no unauthorised disclosure), Integrity (no unauthorised change), Availability (accessible when needed). Non-repudiation and authenticity are related add-ons.
- Control types: technical, managerial, operational, physical. Control functions: preventive, detective, corrective, deterrent, compensating, directive.
- Zero Trust: no implicit trust by network location; authenticate, authorise, and continuously validate every request. Least privilege and defence in depth throughout.
- AAA: Authentication (prove identity), Authorization (what you may do), Accounting (what you did). MFA factors: something you know / have / are, plus somewhere you are and something you do.
Threats, vulnerabilities, and mitigations
- Social engineering: phishing, spear phishing, whaling, vishing, smishing, pretexting, BEC. Levers: authority, urgency, scarcity, social proof, familiarity, fear.
- Malware: virus, worm, trojan, ransomware, rootkit, spyware, keylogger, logic bomb, bloatware. Fileless malware lives in memory / legitimate tools.
- App attacks: SQL injection (fix with parameterised queries), XSS (output encoding), CSRF (anti-forgery tokens), buffer overflow, privilege escalation, replay.
- Password attacks: brute force, dictionary, spraying (one password, many accounts), credential stuffing (reused breach data), rainbow tables (offline hash reversal — defeated by salting).
Security architecture
- Segmentation: screened subnet (DMZ) for internet-facing hosts, VLANs, microsegmentation, air gap for the most sensitive systems.
- Boundary devices: stateful firewall (L3/L4), next-gen firewall and WAF (L7, blocks injection/XSS), IDS (alert) vs IPS (block), proxy, UTM.
- Data protection: encryption (reversible), hashing (one-way, integrity), tokenisation (irreversible surrogate via vault), masking, data classification and DLP.
- Resilience: eliminate single points of failure with clustering and load balancing; plan RTO/RPO; use redundant power, sites, and connections.
Security operations
- Hardening: disable unused services and ports, remove default accounts and credentials, apply a secure baseline, patch.
- Monitoring: SIEM aggregates and correlates logs; SOAR automates response; detection can be signature-based or anomaly-based (behavioural baseline).
- Incident response lifecycle: preparation → detection and analysis → containment, eradication, and recovery → lessons learned.
- Digital forensics: preserve order of volatility, keep an unbroken chain of custody, work from forensic images with verified hashes; legal hold prevents data destruction.
Security program management and oversight
- Risk handling: mitigate (reduce), transfer (insurance/contract), avoid (stop the activity), accept (document residual risk). Risk register tracks it all with an owner.
- BIA metrics: RTO (max downtime), RPO (max data loss), MTTR (mean time to repair), MTBF (mean time between failures).
- Agreements: SLA (measurable performance + remedies), MOU/MOA (intent, non-binding), BPA (business partnership terms), NDA (confidentiality), MSA.
- Governance and compliance: policies, standards, procedures, guidelines; frameworks (NIST CSF, ISO 27001); regulations (GDPR, HIPAA, PCI DSS, SOX); third-party / supply-chain risk due diligence; recurring security awareness training.
Test yourself on SY0-701
Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then drill the rest.
Also free: 15 SY0-701 sample questions with answers and the SY0-701 study guide.