Main exam topics
Cloud and on-premises systems; virtualization, containers and industrial systems; shared responsibility; secure infrastructure and communications; segmentation and firewalls; protecting data at rest, in transit and in use; encryption, DLP, backups, redundancy and recovery.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Scenario summary
Segmentation separates the public website from payment systems and limits lateral movement. Least privilege restricts access to what is necessary. Validate firewall rules with both positive and negative tests: required traffic should pass, while unauthorized traffic should fail.
Security+ practice scenario · Full concepts below
Architecture makes security part of how systems are built. Separate trust zones, protect data throughout its lifecycle, and design recovery around business requirements rather than assumptions.
Key terms & acronyms
- DMZ / screened subnet
- A separate network zone for public-facing services.
- IaaS
- Cloud infrastructure where the customer typically manages guest operating systems.
- RPO
- Maximum tolerable data loss expressed as time.
- RTO
- Target time to restore a business service.
Concepts at a glance
| Concept | Purpose | Example |
|---|---|---|
| At rest | Stored data | Disk encryption |
| In transit | Data moving over networks | TLS |
| In use | Data being processed | Protected execution environments |
| Offline backup | Disconnected recovery copy | Resists ransomware modification |
In the workplace
A retailer puts its public web server in a screened subnet, keeps payment systems in an isolated zone, permits only required traffic, and regularly tests restores from immutable backups. A 15-minute RPO requires backups or replication that meet that data-loss tolerance.
Common mistakes & scenario tips
Cloud does not mean the provider owns every security task. Read the service’s responsibility model. Redundancy improves availability but is not a substitute for backups when data is corrupted.