Overview
Security Operations is 28% of the exam, the single heaviest domain, covering the day-to-day work of running security. It has nine objectives. Hardening covers applying security techniques to computing resources, including mobile, embedded and specialized systems. Asset management covers the security implications of hardware, software and data asset management. Vulnerability management covers identifying, analyzing, prioritizing and remediating vulnerabilities. Monitoring covers security alerting and monitoring tools such as SIEM, SNMP and log aggregation. Enterprise capabilities covers modifying firewalls, IDS/IPS, web filters, email security and endpoint tools. Identity and access management covers provisioning, authentication, MFA, SSO, federation and privileged access. Automation covers orchestration for secure operations. Incident response covers the response process and activities. Investigation covers using data sources such as logs.
At nearly a third of the exam, this domain is decisive. The exam rewards practical operational knowledge: hardening, managing vulnerabilities, monitoring and alerting, administering access, and responding to incidents.
How it's tested
Security+ questions in this domain describe a hardening, vulnerability, monitoring, access or incident need and ask which technique, tool or step applies. Security+ questions are vendor-neutral and scenario-based, with some performance-based, so read the situation and choose the security concept, control or response it points to before answering.
-
Harden and manage
A resource or asset need is described, and you choose the hardening technique or management step.
-
Monitor and respond
An alert, vulnerability or incident is described, and you choose the monitoring tool, analysis or response step.
-
Identity and access
An access need is described, and you choose the authentication factor, MFA, SSO or privileged-access control.
During an incident, responders have contained the threat and now need to remove the attacker's tools and malware from affected systems before restoring them. The incident response process has a defined order: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. After containment, eradication removes the malicious artifacts, and only then does recovery restore systems, which is the ordered step the exam expects next.
Domains 9
Official domains from the CompTIA outline, in outline order.
4.1 Apply common security techniques to computing resourcesHardening across systems and specialized devices.
- What it means
- This covers hardening computing resources: secure baselines, hardening targets such as mobile devices, workstations, servers, switches, routers, cloud infrastructure, IoT, embedded and specialized systems, wireless and mobile deployment models such as BYOD, and connection methods.
- What to understand
- Hardening reduces the attack surface by applying secure baselines, disabling unneeded services and ports, enforcing configuration, and securing each type of device including specialized ones. Different device classes need different hardening, and mobile models like BYOD add considerations. Knowing the techniques for each is the operational skill.
- How it shows up
- A resource is described, and you must choose the hardening technique.
- Common confusion
- Overlooking that specialized systems like IoT and embedded devices need tailored hardening, not standard approaches.
4.2 Explain the security implications of proper hardware, software, and data asset managementAcquisition, inventory, and disposal.
- What it means
- This covers asset management security: acquisition and procurement, assignment and accounting through inventory and ownership, and disposal and decommissioning including sanitization, destruction, certification and data retention.
- What to understand
- Knowing what assets you have, who owns them, and securely disposing of them prevents data leakage and unmanaged risk. Proper sanitization or destruction of media before disposal is essential, and accurate inventory underpins vulnerability and patch management. These lifecycle practices have direct security implications.
- How it shows up
- An asset lifecycle need is described, and you must choose the secure management or disposal step.
- Common confusion
- Confusing sanitization with destruction, or overlooking secure disposal as a security control.
4.3 Explain various activities associated with vulnerability managementIdentification, analysis, prioritization and remediation.
- What it means
- This covers the vulnerability management lifecycle: identification through scanning, threat intelligence and penetration testing, analysis including confirming and prioritizing with CVSS and CVE, response and remediation such as patching, insurance, segmentation and exceptions, and validation and reporting.
- What to understand
- Vulnerability management is a cycle: find vulnerabilities, analyze and prioritize them by severity and context, remediate or otherwise treat them, and validate and report. Scanning finds them, CVSS scores severity, and remediation closes them. Understanding the lifecycle and how to prioritize is the tested skill.
- How it shows up
- A vulnerability management need is described, and you must choose the lifecycle activity or prioritization approach.
- Common confusion
- Confusing identification with remediation, or misunderstanding how CVSS prioritizes vulnerabilities.
4.4 Explain security alerting and monitoring concepts and toolsSIEM, log aggregation and monitoring tools.
- What it means
- This covers security alerting and monitoring: monitoring computing resources, activities such as log aggregation, alerting, scanning, reporting and alert tuning, and tools including SIEM, antivirus, data loss prevention, SNMP traps, NetFlow and vulnerability scanners.
- What to understand
- Monitoring collects and analyzes security data to detect and alert on threats. A SIEM aggregates and correlates logs from many sources to surface incidents, and alert tuning reduces noise. Knowing which tool provides which visibility, especially the role of SIEM, is central to detection.
- How it shows up
- A visibility or alerting need is described, and you must choose the monitoring tool or concept.
- Common confusion
- Confusing a SIEM with a single monitoring tool; a SIEM aggregates and correlates data from many sources.
4.5 Modify enterprise capabilities to enhance securityFirewalls, IDS/IPS, web and email security, and endpoint tools.
- What it means
- This covers modifying enterprise security capabilities: firewall rules and configuration, IDS and IPS, web filters, operating system security such as group policy, DNS filtering, email security including DMARC, DKIM and SPF, file integrity monitoring, data loss prevention, network access control and endpoint detection and response.
- What to understand
- Enterprise defenses are tuned and configured to enhance security: firewalls and IPS filter traffic, web and DNS filtering block malicious destinations, email authentication (SPF, DKIM, DMARC) fights spoofing, and EDR protects endpoints. Knowing what each capability does and how to configure it is the operational skill.
- How it shows up
- A protection need is described, and you must choose the enterprise capability to modify.
- Common confusion
- Confusing email security mechanisms such as SPF, DKIM and DMARC, or an IDS with an IPS.
4.6 Implement and maintain identity and access managementProvisioning, authentication, MFA, SSO and privileged access.
- What it means
- This covers identity and access management: provisioning and deprovisioning accounts, identity proofing, federation, single sign-on technologies such as LDAP, OAuth and SAML, interoperability, attestation, access controls such as role-based and attribute-based, multifactor authentication factors and implementations, password concepts, and privileged access management tools.
- What to understand
- IAM governs who can access what: accounts are provisioned and removed, authentication verifies identity (strengthened by MFA factors: something you know, have and are), SSO and federation enable access across systems, access control models grant permissions, and privileged access management protects high-risk accounts. These concepts are heavily tested.
- How it shows up
- An access or authentication need is described, and you must choose the IAM concept, factor or control.
- Common confusion
- Confusing the MFA factor categories, or SSO protocols such as SAML, OAuth and LDAP.
4.7 Explain the importance of automation and orchestration related to secure operationsScripting, orchestration and their benefits.
- What it means
- This covers automation and orchestration for secure operations: use cases such as user and resource provisioning, guardrails, security groups, ticket creation and escalation, and the benefits and considerations including efficiency, consistency, reduced reaction time, and complexity or cost trade-offs.
- What to understand
- Automation performs security tasks programmatically, and orchestration coordinates them across tools, improving speed, consistency and scale while reducing human error. It must be weighed against complexity and maintenance cost. Understanding where automation helps secure operations and its trade-offs is the expected knowledge.
- How it shows up
- An operations need is described, and you must identify the automation or orchestration benefit or use case.
- Common confusion
- Treating automation as only speed, overlooking consistency, or ignoring its complexity trade-offs.
4.8 Explain appropriate incident response activitiesThe incident response process and activities.
- What it means
- This covers incident response: the process (preparation, detection, analysis, containment, eradication, recovery, lessons learned), training, testing such as tabletop exercises and simulations, root cause analysis, threat hunting, and digital forensics including legal hold and chain of custody.
- What to understand
- Incident response follows a defined order: prepare, detect and analyze, contain, eradicate, recover, and learn lessons. Containment limits damage, eradication removes the threat, and recovery restores service, in that order. Forensics preserves evidence with chain of custody. Knowing the process and its order is a core, tested skill.
- How it shows up
- An incident situation is described, and you must choose the correct response phase or activity.
- Common confusion
- Confusing the order of the incident response phases, such as recovering before eradicating.
4.9 Use data sources to support an investigationLogs and other investigative data.
- What it means
- This covers using data sources in an investigation: log data such as firewall, application, endpoint, OS and IPS/IDS logs, and other sources including vulnerability scans, packet captures, dashboards and automated reports, to support analysis and investigation.
- What to understand
- Investigations rely on data: the right log or capture reveals what happened, when and how. Knowing which data source answers which question, such as firewall logs for blocked connections or endpoint logs for host activity, is the investigative skill. Correlating sources builds the picture.
- How it shows up
- An investigation need is described, and you must choose the data source that provides the answer.
- Common confusion
- Confusing which data source contains the needed evidence, such as firewall versus endpoint logs.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Hardening
Reducing the attack surface.
- Remember
- Baselines, disable services, enforce config.
- Tested as
- Hardening questions.
- Trap
- Using one approach for all device types.
-
Secure disposal
Sanitization and destruction of media.
- Remember
- Prevents data leakage at end of life.
- Tested as
- Asset questions.
- Trap
- Confusing sanitization with destruction.
-
Vulnerability management lifecycle
Identify, analyze, prioritize, remediate, validate.
- Remember
- A continuous cycle.
- Tested as
- Vulnerability questions.
- Trap
- Confusing the stages.
-
CVSS and CVE
Severity scoring and vulnerability identifiers.
- Remember
- Prioritize by severity and context.
- Tested as
- Vulnerability questions.
- Trap
- Misusing CVSS for prioritization.
-
SIEM
Aggregates and correlates logs.
- Remember
- Surfaces incidents across sources.
- Tested as
- Monitoring questions.
- Trap
- Treating it as one tool's log.
-
Email authentication
SPF, DKIM and DMARC.
- Remember
- Fight spoofing and phishing.
- Tested as
- Capability questions.
- Trap
- Confusing the three.
-
IDS vs. IPS
Detects versus detects and blocks.
- Remember
- An IPS can stop traffic.
- Tested as
- Capability questions.
- Trap
- Confusing the two.
-
MFA factors
Something you know, have, are.
- Remember
- Combine different factor types.
- Tested as
- IAM questions.
- Trap
- Confusing the factor categories.
-
SSO and federation
Single sign-on across systems via SAML, OAuth.
- Remember
- Reuse identity across domains.
- Tested as
- IAM questions.
- Trap
- Confusing the protocols.
-
Privileged access management
Protects high-risk admin accounts.
- Remember
- Just-in-time and vaulting.
- Tested as
- IAM questions.
- Trap
- Leaving privileged access standing.
-
Incident response order
Prepare, detect, contain, eradicate, recover, learn.
- Remember
- Follow the order.
- Tested as
- IR questions.
- Trap
- Recovering before eradicating.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
IDS vs. IPS
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| IDS | Detects and alerts | Passive monitoring | Expecting it to block |
| IPS | Detects and blocks | Active prevention | Confusing with IDS |
SPF vs. DKIM vs. DMARC
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SPF | Authorizes sending servers | Which servers may send | Confusing with DKIM |
| DKIM | Signs messages cryptographically | Integrity and authenticity | Confusing with SPF |
| DMARC | Policy using SPF and DKIM | What to do on failure | Confusing with the others |
Incident response phases
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Containment | Limit the damage | After detection | Skipping to recovery |
| Eradication | Remove the threat | Before recovery | Recovering first |
| Recovery | Restore systems | After eradication | Restoring before eradicating |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Recover before eradicate
- What candidates pick
- Restore systems to production immediately after containing an incident.
- Why it looks right
- Restoring service is urgent.
- Why it's wrong
- The threat must be eradicated before recovery, or restored systems are reinfected; the order is contain, eradicate, then recover.
Clue to watch for The attacker's tools are still present on the systems.
-
IDS blocks the attack
- What candidates pick
- Expect an IDS to automatically block malicious traffic.
- Why it looks right
- Both detect threats.
- Why it's wrong
- An IDS detects and alerts only; an IPS detects and actively blocks.
Clue to watch for The requirement is to stop, not just detect, the traffic.
-
SIEM is one log
- What candidates pick
- Treat a SIEM as the log of a single device.
- Why it looks right
- It shows logs.
- Why it's wrong
- A SIEM aggregates and correlates logs from many sources to surface incidents across the environment.
Clue to watch for The need is correlated visibility across many systems.
-
One MFA category twice
- What candidates pick
- Combine two passwords and call it multifactor authentication.
- Why it looks right
- Two credentials seem like two factors.
- Why it's wrong
- MFA requires factors from different categories, such as something you know plus something you have; two passwords are the same factor type.
Clue to watch for The factors must be of different types.
-
Standing privileged access
- What candidates pick
- Leave administrators with permanent standing privileged access.
- Why it looks right
- They need admin rights.
- Why it's wrong
- Privileged access management limits risk with just-in-time elevation and vaulting rather than permanent standing access.
Clue to watch for High-risk admin access should be minimized and controlled.
Answer framework
For any Domain 4 scenario, use these steps to find the answer Security+ expects.
- Identify which operational area the need falls in: hardening, assets, vulnerability management, monitoring, capabilities, IAM, automation, incident response or investigation.
- For hardening and assets, apply secure baselines and tailored techniques, and manage the asset lifecycle including secure disposal.
- For vulnerabilities and monitoring, follow the lifecycle, prioritize with CVSS, and use SIEM and the right tools to detect and alert.
- For IAM, apply least privilege, combine MFA factors from different categories, use SSO and federation, and protect privileged access.
- For incidents, follow the response order (prepare, detect, contain, eradicate, recover, learn) and use the right data sources to investigate. Where two options seem to fit, pick the one that most precisely matches the scenario's requirement.
Practice question
Want more like this? The Security+ practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Give this domain the most study time by far, because at 28% it is nearly a third of the exam and the single most decisive area. It is broad, so work through each of the nine objectives deliberately. Start with the high-frequency areas: hardening techniques, the vulnerability management lifecycle with CVSS prioritization, and monitoring with the central role of SIEM.
Then master identity and access management, which is heavily tested: the MFA factor categories (something you know, have, are), SSO and federation protocols, access control models, and privileged access management. Learn the enterprise capabilities, keeping IDS versus IPS and SPF, DKIM and DMARC distinct. Fix the incident response phase order cold, since the exam tests it directly, and learn which data sources answer which investigative questions.
Because this domain is operational, scenario practice and relating each concept to real tasks are the most effective study. Because Security+ rewards applied understanding across a broad field, use scenario practice questions and relate each concept to a real situation rather than only memorizing lists, and review missed practice questions by domain to find weak spots. Afterwards, move to Domain 5, Security Program Management and Oversight.
FAQ
How much of Security+ is Domain 4?
Security Operations is 28% of the exam, the single heaviest domain, covering the day-to-day work of running security, so it is the most important area to master.
What is the order of the incident response process?
Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. The threat is contained, then eradicated, then systems are recovered, and the order matters on the exam.
What is a SIEM?
A security information and event management system that aggregates and correlates log data from many sources to detect, alert on and investigate security incidents across the environment, rather than being a single device's log.
What makes authentication multifactor?
Using factors from different categories: something you know (password), something you have (a token), or something you are (biometrics). Two factors of the same type, such as two passwords, are not multifactor.
What is the difference between SPF, DKIM and DMARC?
SPF authorizes which servers may send mail for a domain, DKIM cryptographically signs messages for integrity and authenticity, and DMARC uses SPF and DKIM results to set a policy for handling messages that fail, together fighting spoofing.
What is privileged access management?
Controls that protect high-risk administrative accounts, such as just-in-time elevation, credential vaulting and session monitoring, rather than leaving administrators with permanent standing access.
How does Domain 4 connect to the rest of the exam?
Security Operations runs and defends the architecture of Domain 3 against the threats of Domain 2, applying the concepts of Domain 1, within the governance and risk management of Domain 5.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have covered hardening, vulnerability management, monitoring, IAM, automation and incident response. Test whether you can apply security operations under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Security+ AI tutor Get any concept explained your way