Security+ Domain 4 Study Guide: Security Operations (SY0-701)
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Security Operations is 28% of the Security+ SY0-701 exam and has 9 objectives. This study guide lists each objective with its official title, summarizes the concepts you need in tables, flags the exam traps that cost points, and gives three original practice questions with explanations for every option. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
Domain 4 at a Glance
Security Operations is 28% of the Security+ SY0-701 exam. It has 9 objectives, listed below with their official titles. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
| Objective | Official title |
|---|---|
| 4.1 | Given a scenario, apply common security techniques to computing resources. |
| 4.2 | Explain the security implications of proper hardware, software, and data asset management. |
| 4.3 | Explain various activities associated with vulnerability management. |
| 4.4 | Explain security alerting and monitoring concepts and tools. |
| 4.5 | Given a scenario, modify enterprise capabilities to enhance security. |
| 4.6 | Given a scenario, implement and maintain identity and access management. |
| 4.7 | Explain the importance of automation and orchestration related to secure operations. |
| 4.8 | Explain appropriate incident response activities. |
| 4.9 | Given a scenario, use data sources to support an investigation. |
Baselines, Hardening and Application Security
| Topic | What to know |
|---|---|
| Secure baselines | Establish, deploy and maintain an approved configuration |
| Hardening targets | Mobile devices, workstations, servers, switches, routers, cloud, ICS, embedded systems |
| Wireless | WPA3, RADIUS-based authentication, site surveys |
| Mobile deployment models | BYOD, COPE and CYOD, managed with MDM |
| Application security | Input validation, secure cookies, static analysis, code signing, sandboxing |
The Secure cookie attribute sends a cookie only over HTTPS. HttpOnly blocks script access to it.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Asset Management and Vulnerability Management
| Phase | What happens |
|---|---|
| Identify | Vulnerability scans, application testing, threat feeds, OSINT, penetration tests, bug bounties and audits |
| Analyze | Confirm findings (false positives and negatives), score with CVSS, weigh exposure and risk tolerance |
| Respond | Patch, segment, add compensating controls or document an exception |
| Validate and report | Rescan, audit, verify the fix and report the results |
Asset lifecycle: acquire, assign and account, monitor and track, then dispose. Disposal uses sanitization or destruction with certification, and respects data retention rules.
Monitoring and Enterprise Capabilities
| Capability | Purpose |
|---|---|
| SIEM and log aggregation | Collect and correlate logs for detection |
| SCAP and benchmarks | Standardize checks against secure configurations |
| Firewall rules, IDS and IPS | Control and inspect traffic |
| Web and DNS filtering | Block malicious or inappropriate destinations |
| Email security: SPF, DKIM, DMARC | Verify senders and reduce spoofing |
| File integrity monitoring and DLP | Detect changes and stop data leaving |
| NAC, EDR and XDR | Check devices before access and detect threats on endpoints |
Identity and Access Management
| Topic | What to know |
|---|---|
| Provisioning and deprovisioning | Create access on joining and remove it on leaving or role change |
| Federation and SSO | LDAP, OAuth and SAML let one login serve several systems |
| Access control models | MAC, DAC, role-based, rule-based, attribute-based, time-of-day restrictions |
| MFA factors | Something you know, have, are and somewhere you are |
| Privileged access management | Just-in-time permissions, password vaulting and ephemeral credentials |
OAuth delegates limited access without sharing the password. SAML carries federated sign-in assertions.
Automation, Incident Response and Investigation
Incident response phases: preparation, detection, analysis, containment, eradication, recovery and lessons learned. Containment limits the spread, eradication removes the cause including malware and persistence, and recovery restores normal service.
Automation and orchestration help with user provisioning, guard rails, ticketing and escalation, and CI/CD, but add complexity, cost and a possible single point of failure.
For investigations, know your data sources: firewall, application, endpoint, operating system and network logs, metadata, vulnerability scans, dashboards and packet captures.
Common Exam Traps
These mix-ups cost points in this domain.
Containment versus eradication
Containment isolates the problem. Eradication removes malware and persistence. Recovery restores service.
False positive versus false negative
A false positive is an alert for a problem that does not exist. A false negative is a real problem that went unreported.
OAuth versus SAML
OAuth is delegated authorization. SAML is federated authentication and single sign-on.
Wiping SSDs
Deleting files or a quick format does not sanitize a drive. Use secure erase or cryptographic erase to reuse it.
Try It: Three Domain 4 Practice Questions
Answer these before you read the key. They are original questions written to the published objectives, and none are real exam questions.
Question 1. A web developer wants to ensure a session cookie is never transmitted over an unencrypted HTTP connection. Which of the following cookie attributes should be set?
- A. HttpOnly
- B. SameSite
- C. Secure
- D. Domain
Question 2. An SSD that held confidential data will be reassigned to a different department. Which of the following methods BEST sanitizes the drive while allowing it to be reused?
- A. Run the vendor secure erase or a cryptographic erase
- B. Delete all files, then empty the recycle bin on the host
- C. Perform a quick format of the volume with a new file system
- D. Degauss the drive with a strong electromagnetic degausser
Question 3. After isolating an infected host, a responder removes the malware, deletes attacker persistence mechanisms, and closes the exploited vulnerability. Which incident response phase is this?
- A. Containment
- B. Recovery
- C. Eradication
- D. Analysis
Answer Key and Explanations
Question 1: C. Secure (objective 4.1)
The Secure attribute tells the browser to send the cookie only over HTTPS.
- A. HttpOnly. HttpOnly blocks JavaScript access to the cookie but does not force HTTPS transport.
- B. SameSite. SameSite limits cross-site sending of the cookie, which mainly helps against CSRF.
- D. Domain. Domain controls which hosts receive the cookie and does not require encryption.
Question 2: A. Run the vendor secure erase or a cryptographic erase (objective 4.2)
Secure erase or cryptographic erase removes data at the device level and leaves the drive usable.
- B. Delete all files, then empty the recycle bin on the host. Deleting files only removes references, so data remains recoverable.
- C. Perform a quick format of the volume with a new file system. A quick format rebuilds file system structures but leaves most data intact.
- D. Degauss the drive with a strong electromagnetic degausser. Degaussing is ineffective on flash storage and is intended for magnetic media.
Question 3: C. Eradication (objective 4.8)
Eradication removes the cause of the incident, including malware and persistence.
- A. Containment. Containment limits spread and was already done by isolating the host.
- B. Recovery. Recovery restores systems to normal service and monitors them afterward.
- D. Analysis. Analysis determines scope and impact and does not remove the threat.
How to Study Domain 4
Domain 4 carries 28% of the exam. See our objectives explained for all five domains, the study plan for how to split your days by weight, and the commonly confused terms cheat sheet for the pairs that appear here.
Walk an incident through all seven phases
Invent a ransomware incident and name the action and evidence at each phase.
Give Domain 4 the most days
At 28% it is the biggest domain, so it should get the largest share of your study plan.
Retry misses on different days
A widely cited review of learning techniques rated practice testing and spaced practice as high utility. Return to the questions you miss a few days later instead of rereading the same pages.
Practice With DD Academy
DD Academy has Security+ flashcards and practice questions for every objective in Domain 4, plus an AI tutor that explains why each option is right or wrong. It is free to start on iPhone and the web.
The bottom line
Know the 9 Domain 4 objectives, learn the concept tables until you can explain each term without notes, watch for the traps listed above and keep practicing with scenario questions across all five domains.
Frequently asked questions
What percentage of Security+ is Domain 4?
Security Operations is 28% of SY0-701 according to CompTIA, the largest domain. On SY0-801 it is 27%.
How many objectives are in Domain 4?
Nine on SY0-701, the most of any domain: 4.1 through 4.9, covering computing resource security, asset management, vulnerability management, monitoring, enterprise capabilities, IAM, automation, incident response and investigation data sources.
What are the phases of incident response?
Preparation, detection, analysis, containment, eradication, recovery and lessons learned.
What is the difference between OAuth and SAML?
OAuth delegates limited access to an application without sharing the user's password. SAML carries federated authentication assertions so one sign-in can serve several systems.
How do you sanitize an SSD so it can be reused?
Use the vendor's secure erase or a cryptographic erase. Deleting files or quick formatting does not remove the data, and degaussing does not work on SSDs.
How does SY0-801 change Domain 4?
SY0-801 consolidates mitigation topics into objective 4.1, makes vulnerability management and automation scenario-based, and has eight objectives in this domain instead of nine.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
