Skip to content

Menu

ExamPassoLog in

CompTIA Security+: Security Operations Concepts

Importance ★★★★★ · 28% (estimate)

Overview

This is the largest domain on the exam. It covers the daily work of keeping systems secure: managing identities and access, hardening and monitoring systems, handling vulnerabilities, using security tools, and responding to incidents.

Multifactor authentication combines different factor types: something you know, something you have, and something you are. Single sign-on lets a user log in once for many applications, and OAuth lets an app access data without the user's password. Least privilege gives only the access needed. RBAC grants access by job role, MAC uses labels and clearances that users cannot change, and privileged access management controls and records admin access.

A SIEM collects and correlates logs to raise alerts; a false positive is an alert for something harmless. DLP stops sensitive data from leaving, NAC checks device health before network access, EDR monitors endpoints and can isolate them, and a WAF blocks web attacks such as SQL injection and XSS. WPA3 is the strongest Wi-Fi security, and enterprise mode uses 802.1X with a RADIUS server for per-user logins. MDM manages and wipes mobile devices, and sandboxes run suspicious code in isolation.

Vulnerability scan results must be validated; a CVE ID names a known vulnerability, and a CVSS score of 9.0 to 10.0 is critical. The incident response process is preparation, detection, analysis, containment, eradication, recovery, and lessons learned. In forensics, chain of custody records who handled evidence, the most volatile data such as RAM is collected first, and a legal hold preserves data for a lawsuit. Old drives with sensitive data are best physically destroyed, and an asset inventory tracks what the organization owns.

Key concepts

  • MFA factors

    Something you know (password), something you have (phone, token), something you are (fingerprint). MFA needs two different types.

    Memory tipPassword + question is not MFA

  • Access control models

    RBAC uses job roles, MAC uses labels set by the system, and DAC lets the data owner decide.

    Memory tipLabels = MAC

  • Security tools

    SIEM correlates logs, DLP stops data leaving, NAC checks devices before access, EDR watches endpoints, and a WAF protects web apps.

    Memory tipData leaving = DLP

  • Wireless security

    WPA3 is the current standard. Enterprise mode uses 802.1X and RADIUS for per-user logins.

    Memory tipPer-user Wi-Fi = Enterprise

  • Incident response phases

    Preparation, detection, analysis, containment, eradication, recovery, lessons learned.

    Memory tipIsolate the host = containment

  • Forensics basics

    Chain of custody tracks evidence handling, order of volatility collects RAM before disk, and a legal hold preserves data for litigation.

    Memory tipMost volatile first

  • CVE and CVSS

    A CVE ID names a known vulnerability. CVSS rates severity from 0 to 10; 9.0 to 10.0 is critical.

    Memory tip9.8 = critical

    Source: FIRST, CVSS v3.1 specification · as of 2019

Often tested

  • A false negative (a missed attack) is usually worse than a false positive.
  • SSH (port 22) replaces Telnet.
  • Deleting files does not securely erase a drive.

3 sample questions

Verified practice questions from this unit.

Practice questionReviewedSecurity+ (SY0-701) › Security Operations★★★★★

Question 1. Which of these is an example of multifactor authentication?

  1. ① A username plus a password
  2. ② A password plus a security question
  3. ③ Two different passwords
  4. ④ A password plus a code from a phone authenticator app
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ④ A password plus a code from a phone authenticator app

Key point: MFA = two or more different factor types

Multifactor authentication combines different types of factors: something you know (password), something you have (phone, token), and something you are (fingerprint).

Wrong choices

  • A password plus a security question: Both are something you know, so this is one factor type used twice.
  • Two different passwords: Both are something you know.
  • A username plus a password: A username is not an authentication factor.
Practice questionReviewedSecurity+ (SY0-701) › Security Operations★★★★★

Question 2. A fingerprint scan is which authentication factor?

  1. ① Something you have
  2. ② Something you know
  3. ③ Somewhere you are
  4. ④ Something you are
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ④ Something you are

Key point: Biometrics = something you are

Biometrics such as fingerprints, face, and iris are something you are.

Wrong choices

  • Something you know: Passwords and PINs are something you know.
  • Something you have: Phones, smart cards, and tokens are something you have.
  • Somewhere you are: Location is a separate attribute, not a fingerprint.
Practice questionReviewedSecurity+ (SY0-701) › Security Operations★★★★★

Question 3. Giving each user only the access they need to do their job is the principle of:

  1. ① Job rotation
  2. ② Implicit trust
  3. ③ Least privilege
  4. ④ Separation of duties
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Least privilege

Key point: Only what you need = least privilege

Least privilege limits each account to the minimum access required. It reduces damage if an account is misused or compromised.

Wrong choices

  • Separation of duties: Separation of duties splits critical tasks among different people.
  • Implicit trust: Implicit trust is what zero trust avoids.
  • Job rotation: Job rotation moves people between roles over time.
Practice 5 questions from this unit →

AI-written · Verified · Written by AI. Only units that passed a separate AI check (re-reading facts and numbers) are published. Tell us if you find a mistake.