// STATUS — IN PROGRESS · rev 2026-08-24
// IN PLAIN TERMS — Theory that never touches a real system is just vocabulary. These notes are built to a different constraint: every concept is either anchored to something actually deployed in this portfolio, or it is flagged as abstract — so revision and evidence reinforce each other instead of competing. The exam tests whether you understand the concepts; a hiring manager tests whether you can apply them. The same notes serve both.
// Overview — CompTIA Security+ SY0-701 study notes, organised by the five current exam domains and cross-linked to real implementations across the portfolio — FIDO2/PKI and LUKS2 in IRONVEIL, the AdGuard/WireGuard network stack, GrapheneOS compartmentalisation in NULLBYTE, and the grey-box penetration test in SPECTRE — so the theory is anchored to systems actually built and tested. Includes a full examination toolkit: domain coverage matrix, 90-question timed mock, scenario-only exam, per-domain sprint exams, SOC shift scenarios, spaced-repetition schedule, and an expected-value revision priority queue.
Domain Structure — SY0-701
The five domains below are the primary, exam-aligned structure. A set of classic six-area notes (pre-SY0-701 reorganisation) remains as supplementary cross-reference; the five-domain files are the study surface to start with.
| # | Domain | Weight | Scope |
|---|---|---|---|
| 1 | General Security Concepts | 12% | Control categories and types, AAA, Zero Trust planes (PDP/PEP), cryptography primitives, PKI and revocation, change management, deception technology |
| 2 | Threats, Vulnerabilities & Mitigations | 22% | Threat actors and intelligence, attack surfaces, vulnerability classes, social engineering, malware, indicator recognition, mitigation techniques |
| 3 | Security Architecture | 18% | Architecture models, cloud and virtualisation, IoT/OT/ICS, data states and classification, resilience and recovery (RTO/RPO/MTTR/MTBF), secure infrastructure design |
| 4 | Security Operations | 28% | SIEM and alert triage, IAM operations, incident response (NIST SP 800-61 lifecycle), digital forensics, vulnerability management, email authentication, SOAR, network monitoring |
| 5 | Security Program Management & Oversight | 20% | Governance, risk quantification (SLE/ALE/ARO), third-party and supply-chain risk, compliance frameworks, audits and assessments, awareness |
Each domain file follows a consistent four-part structure: definitions with exam-trap callouts, scenario drills, a one-page quick-reference card (terms, acronyms, traps), and a ten-question PBQ-style scenario bank in situation → action → why → portfolio link format.
Portfolio Cross-Reference
The table below maps SY0-701 objectives to real, verified implementations in the portfolio. Nothing aspirational is listed — every row is grounded in on-disk evidence. The cross-reference works two ways: as a study anchor (a concept you have built stays sharper than one you only read) and as interview preparation ("give me an example of X" has a concrete portfolio answer for every row here).
| SY0-701 concept | Portfolio implementation | Project |
|---|---|---|
| MFA / phishing-resistant auth (FIDO2, CTAP2) | Nitrokey 3A NFC, firmware 1.8.3, touch-only FIDO2, no clientPin enrolled to LUKS2 | IRONVEIL |
| Cryptography at rest (AES-XTS, Argon2id KDF) | LUKS2 aes-xts-plain64/512-bit; Slot 0 Argon2id (memory-hard passphrase), Slots 1+2 PBKDF2/SHA-512 FIDO2 | IRONVEIL |
| Key stretching / memory-hard KDF | Argon2id passphrase keyslot — parallelisation-resistant against GPU/ASIC bruteforce | IRONVEIL |
| Ephemeral keys / perfect forward secrecy | WireGuard Curve25519 ephemeral session keys — PFS by design | IRONVEIL |
| Secure remote access | dracut-sshd v0.7.1-5.fc44 pre-boot SSH unlock; systemd-networkd + fido2 modules in initramfs | IRONVEIL |
| DNS security / filtering | AdGuard Home bound *:53; Quad9 DoH upstream https://dns10.quad9.net/dns-query; no plaintext DNS egress | IRONVEIL |
| Network segmentation / tunnelling | WireGuard full-tunnel routing; all external traffic encrypted pre-egress | IRONVEIL |
| Zero Trust applied to a device | Nine independently-encrypted profiles; per-profile FBE keys derived from lockscreen credential | NULLBYTE |
| Mobile device security / verified boot | GrapheneOS Android 16 on Pixel 10 Pro Fold; Titan M2 root of trust; boot integrity verified at every power cycle | NULLBYTE |
| Hardware root of trust / attestation | Tensor G5 security core + Titan M2 + Trusty TEE stack; bootloader relocked; boot-key hash published as an annotated placeholder — full fingerprint withheld | NULLBYTE |
| Compartmentalisation / blast radius | Nine profiles (Nexus, Plague, Ghost, Abyss, Void, Facade, Shade, Vault, Joker); no cross-profile state; per-profile FBE isolation | NULLBYTE |
| Vulnerability scanning and enumeration | nmap full-port SYN + service/version, Gobuster, Nikto, WhatWeb workflow | SPECTRE |
| Penetration-testing methodology | PTES phase model, grey-box engagement, scope-halt discipline (LinPEAS halted at boundary) | SPECTRE |
| Evidence integrity / chain of custody | SHA-256 artefact hashing across 24 evidence files; dual session logs; scope-halt documented | SPECTRE |
| Secure configuration / hardening baselines | CIS Apache HTTP Server 2.4 Benchmark v1.4.0; CIS PostgreSQL 16 Level 1 Benchmark v2.0.0 | SPECTRE |
| Attack finding — directory indexing exposure | CWE-548 primary finding (web root Index of /, HTTP 200) | SPECTRE |
| ML-based detection / adversarial ML | Causal vs correlational phishing detection over 88,647 emails; DoWhy-refuted constructs | MIRAGE |
| Imbalanced-class detection methodology | Macro-F1 as primary metric; class-weighted loss — the IDS analogue (rare-class recall over accuracy) | ORACLE |
| Supply-chain / provenance trade-off | Auditable from-scratch TerraCNN (93.97%/F1 0.9390) vs opaque pretrained ResNet-18 (99.11%/F1 0.9916) | ORACLE |
| Detection engineering / SIEM | Wazuh ATT&CK detection scenarios mapped from gauntlet offensive techniques (GAUNTLET_BRIDGE, in build) | GAUNTLET |
Exam Preparation Toolkit
Coverage across all five domains reached DEEP at assessment (2026-06-11); all objectives are covered, with subsequent precision-pass fills on D1 (salt/pepper, ephemeral keys), D2 (memory-injection, path traversal/LFI-RFI), D3 (IaC/serverless/microservices, appliance placement), D4 (mobile hardening targets, wireless WPA3/SAE, flow telemetry), and D5 (responsible disclosure, due care vs due diligence). The constraint is timed recall, not content — the toolkit below is built to address that.
| Asset | Description |
|---|---|
EXAM_READINESS.md | Honest per-domain coverage matrix with recommended focus hours; objective-by-objective gap assessment |
REVISION_PRIORITY.md | Expected-value ranked drill queue — specific high-yield topics ordered by domain weight × point-loss probability |
STUDY_SCHEDULE.md | Six-week spaced-repetition plan to exam day, with a readiness gate and weekly re-touch cycles |
PORTFOLIO_MAP.md | Every objective with direct portfolio evidence; the study-and-interview cross-reference |
ACRONYMS.md | A–Z acronym reference with definitions, domain, and "confused-with" pairs |
MEMORY_AIDS.md | Original mnemonics for the most-confused concepts: IR phases, risk formulas, crypto families, control types |
DOMAIN_CROSSREF.md | Cross-domain connection map — how each concept spans D1–D5 and the exam bridges where questions live |
LAST_MINUTE_GUIDE.md | Final-hour one-pager: highest-probability material per domain, traps, and definitions |
practice-exams/exam-01.md | 90-question weighted mock + full answer key; use with run-exam.sh for real timing |
practice-exams/exam-03.md | 40 scenario-only questions (harder; 15 portfolio-linked) |
practice-exams/exam-04.md | 25 adversarial trap-targeted questions with "why candidates get this wrong" notes |
practice-exams/exam-05.md | 20 cross-domain integration questions (every question spans two or more domains) |
practice-exams/exam-06.md | 10 performance-based (PBQ) simulations: ordering, matching, config, log analysis, risk calculation |
practice-exams/sprint-d1.md … sprint-d5.md | Per-domain sprint exams — 10 hardest questions each, for targeted weak-domain recovery |
practice-exams/run-exam.sh | Timed runner — presents questions, scores by domain |
practice-exams/error-log.md | Miss tracker: log misses, find the pattern, redrill the pattern |
scenarios/soc-scenarios.md | 25 SOC shift scenarios — 5 per domain, in situation → decision → correct action → why format |
Revision Priority — Highest Expected Value
Domain weights: D4 28% · D2 22% · D5 20% · D3 18% · D1 12%. The table below lists the topics where domain weight meets point-loss probability. Items 1–5 concentrate the marks; if revision time collapses, cover those and stop.
| Priority | Domain | Target | Why it ranks |
|---|---|---|---|
| 1 | D4 (28%) | Email authentication — SPF / DKIM / DMARC roles and dependency order | Highest-weight domain; the single most trap-dense item — distractors swap which record does what |
| 2 | D4 (28%) | NIST IR phase ordering — Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident | Mechanical mark in the highest-weight domain; "what is the next phase" stems are guaranteed appearances |
| 3 | D5 (20%) | Risk arithmetic — SLE = AV × EF; ALE = SLE × ARO | Pure mechanical marks; appears almost every sitting; a rusty formula is a certain loss |
| 4 | D2 (22%) | Indicator recognition — "which attack is this?" (2.4 scenarios) | Favourite stem style in the second-heaviest domain; high question volume |
| 5 | D3 (18%) | Recovery metrics — RTO / RPO / MTTR / MTBF and the shared-responsibility split | Mechanical marks; RTO-vs-RPO is the classic confuser; shared responsibility is a guaranteed cloud question |
| 6 | D1 (12%) | PKI revocation (CRL / OCSP / OCSP stapling) and Zero Trust planes (PEP / PDP / PA) | The two classic D1 point-losers — trap-dense terminology the exam reliably exploits |
| 7 | D5 (20%) | Data-role distinctions — owner / controller / processor / custodian; agreement types — SLA / BPA / MOU / MSA / NDA | Mechanical, confusable, frequently tested; cheap marks once the lines are crisp |
Reproducible Study Commands
All paths are relative to the sec-plus-notes repository root.
# Timed 90-question mock (simulates exam cadence)
bash practice-exams/run-exam.sh practice-exams/exam-01.md
# Scenario-only harder exam (40 questions)
bash practice-exams/run-exam.sh practice-exams/exam-03.md
# Per-domain sprint (replace d4 with d1–d5)
bash practice-exams/run-exam.sh practice-exams/sprint-d4.md
# Performance-based PBQ simulations (ordering, config, risk calc)
bash practice-exams/run-exam.sh practice-exams/exam-06.mdEach run produces a per-domain score breakdown. Log every miss to practice-exams/error-log.md and re-drill the pattern, not just the question.
Known Gaps
Notes reflect general Security+ knowledge anchored to SY0-701 objectives. Always confirm exam-specific objective wording and any changed details against current official CompTIA materials before relying on them for the exam.
Part of the rootdrifter security portfolio — see the live platform at rootdrifter.io. Study notes for a candidate preparing CompTIA Security+ (SY0-701).