Evidence labels show where each concept’s recorded learning comes from: classroom sessions, Study Buddy sessions, supplementary Study Guide explanations or a mix. Reviewed revision may go further, so you can study ahead. Available questions do not imply complete topic or exam coverage.
Official syllabus references
CompTIA Security+
Exam version SY0-701 · All 28 numbered objectives represented; detailed bullets and revision content remain partial.
2.3 · Vulnerability types
4.3 · Vulnerability management
Related groups: 2.0 · Threats, vulnerabilities and mitigations; 4.0 · Security operations. Topic organisation is editorial; consult the official specification for full detail.
CREST CPSA
Specification 2.5 · All official groups represented; only selected verified skill IDs are catalogued. Detailed skills and revision content remain partial.
Related groups: E · Microsoft Windows assessment; F · Unix assessment. Topic organisation is editorial; consult the official specification for full detail.
Researching Whether a Known Vulnerability Applies
Evidence: Mixed
Revision: Available · 3 questions · 1 flashcard
Exam relevance
Learning-only · no verified exam mapping
Reviewed revision scope
Classroom (Session 6): the tutor explained that the services and versions identified by a scan can be researched online for known vulnerabilities.
Supplementary: CVE records, the NVD and vendor security advisories are research sources; an exploit-database entry does not prove that a particular system is vulnerable.
Supplementary: a detected version is a lead and a matching CVE is a hypothesis; product names, affected version ranges, configuration and backported patches must be checked before recording a vulnerability as confirmed, rejected or uncertain.
Any specific vulnerability or CVE from the demonstration
Running exploit code
Assessing real systems
Unverified exam objectives
Recorded evidence
Classroom (Session 6): the tutor explained that the services and versions identified by a scan can be researched online for known vulnerabilities.
Supplementary: CVE records, the NVD and vendor security advisories are research sources; an exploit-database entry does not prove that a particular system is vulnerable.
Supplementary: a detected version is a lead and a matching CVE is a hypothesis; product names, affected version ranges, configuration and backported patches must be checked before recording a vulnerability as confirmed, rejected or uncertain.
Session 6: Networking Fundamentals — Part 2 — Classroom session record · Sections 2–8: Kali Linux with NAT and host-only adapters; Metasploitable with a host-only adapter only; the msfadmin login; ifconfig on both machines; the attacking and victim roles; nmap -sV against the Metasploitable lab address; researching detected versions for known vulnerabilities
Service Discovery and Vulnerability Research — Supplementary Study Guide explanation · Ports and services; Discovery, research and exploitation; Service and version detection with Nmap; From version to vulnerability: a research workflow; Where to research; Why a match is not confirmation
Not established by the recorded evidence
Any specific vulnerability or CVE from the demonstration
Running exploit code
Assessing real systems
Unverified exam objectives
Reviewed 2026-09-25. Reviewed against the Session 6 Learning Log and the Service Discovery and Vulnerability Research lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary, and revision scope is the reviewed evidence scope. No practical competence, completed lab or exam alignment is implied.
Vulnerabilities, Exposure and Vulnerability Information
Evidence: Mixed
Revision: Available · 4 questions · 2 flashcards
Exam relevance
Learning-only · no verified exam mapping
Reviewed revision scope
Classroom (Session 2): Shodan indexes internet-connected devices and services and shows that they are exposed; appearing in its results is not evidence that a device has been compromised.
Classroom (Session 2): the National Vulnerability Database, maintained by NIST, provides information about publicly disclosed vulnerabilities.
Classroom (Session 2): a zero-day vulnerability was described in class as a weakness that is unknown to the vendor or does not yet have an available fix when it becomes exploitable.
Supplementary: a vulnerability is a weakness and exposure is how far a system or service can be seen or reached; a CVE ID names a disclosed vulnerability, CVSS rates its technical severity and the NVD adds analysis.
Supplementary: in professional usage a zero-day is a vulnerability the vendor does not yet know about; a disclosed flaw that is still unfixed is a known, unpatched vulnerability, and a zero-day exploit is the means of using a zero-day.
Classroom (Session 2): Shodan indexes internet-connected devices and services and shows that they are exposed; appearing in its results is not evidence that a device has been compromised.
Classroom (Session 2): the National Vulnerability Database, maintained by NIST, provides information about publicly disclosed vulnerabilities.
Classroom (Session 2): a zero-day vulnerability was described in class as a weakness that is unknown to the vendor or does not yet have an available fix when it becomes exploitable.
Supplementary: a vulnerability is a weakness and exposure is how far a system or service can be seen or reached; a CVE ID names a disclosed vulnerability, CVSS rates its technical severity and the NVD adds analysis.
Supplementary: in professional usage a zero-day is a vulnerability the vendor does not yet know about; a disclosed flaw that is still unfixed is a known, unpatched vulnerability, and a zero-day exploit is the means of using a zero-day.
Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
Vulnerabilities and Exposure — Supplementary Study Guide explanation · Weakness and reachability are different questions; Exposure: what can others see and reach?; Zero-day vulnerabilities; Looking up known vulnerabilities: the NVD; Breached data and exposed credentials; Staying informed
Not established by the recorded evidence
Running scans or searches against real systems
Accessing or testing exposed devices
Unverified exam objectives
Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.
Vulnerable Software and Vulnerability Scanning
Evidence: Mixed
Revision: Available · 6 questions · 2 flashcards
Exam relevance
Learning-only · no verified exam mapping
Reviewed revision scope
Classroom (Session 8): the vulnerable software vectors covered were faults in code, faults in design, delayed patching, difficult patching, and unsupported or legacy systems and applications, with compensating controls for unsupported and legacy systems.
Classroom (Session 8): two ways of deploying vulnerability scanning were compared, one with software installed on the endpoint and one agentless.
Supplementary: agent-based scanning installs a small software component on each endpoint, giving deeper local visibility and coverage of devices that are only intermittently connected, at the cost of deploying and maintaining the agents.
Supplementary: agentless scanning installs no dedicated scanner agent and examines the target remotely through existing mechanisms such as SSH, WinRM or WMI, SNMP, APIs or authenticated remote access; it is easier to deploy centrally, but its visibility depends on network reachability and credentials.
Supplementary: an agent is a small background monitoring or management component, whereas a thick client is a full locally installed application that does substantial processing locally.
Supplementary: an unsupported system no longer receives security fixes from its vendor; when a legacy server cannot be patched or replaced, compensating controls such as network segmentation, firewall restrictions, least privilege, restricted access, and monitoring and logging are used.
Which reading of syllabus wording about client-based software is intended
Unverified exam objectives
Recorded evidence
Classroom (Session 8): the vulnerable software vectors covered were faults in code, faults in design, delayed patching, difficult patching, and unsupported or legacy systems and applications, with compensating controls for unsupported and legacy systems.
Classroom (Session 8): two ways of deploying vulnerability scanning were compared, one with software installed on the endpoint and one agentless.
Supplementary: agent-based scanning installs a small software component on each endpoint, giving deeper local visibility and coverage of devices that are only intermittently connected, at the cost of deploying and maintaining the agents.
Supplementary: agentless scanning installs no dedicated scanner agent and examines the target remotely through existing mechanisms such as SSH, WinRM or WMI, SNMP, APIs or authenticated remote access; it is easier to deploy centrally, but its visibility depends on network reachability and credentials.
Supplementary: an agent is a small background monitoring or management component, whereas a thick client is a full locally installed application that does substantial processing locally.
Supplementary: an unsupported system no longer receives security fixes from its vendor; when a legacy server cannot be patched or replaced, compensating controls such as network segmentation, firewall restrictions, least privilege, restricted access, and monitoring and logging are used.
Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
Attack Surfaces and Attack Vectors — Supplementary Study Guide explanation · Surface and vector; The surface depends on what you are assessing; Mapping an attack surface: a water and power company; Where IT meets operational technology; A vector is a route and a weakness makes it usable; Vulnerable software vectors; Compensating controls for systems that cannot be patched; Agent-based and agentless scanning; Network vectors; Message-based vectors; The supply chain as an attack surface; A real example: Stuxnet; Reducing the attack surface
Not established by the recorded evidence
Configuring or running a vulnerability scanner
Naming or comparing scanning products
Which reading of syllabus wording about client-based software is intended
Unverified exam objectives
Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Attack Surfaces and Attack Vectors lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.