Due Diligence, Questionnaires, and Monitoring

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Due Diligence, Questionnaires, and Monitoring

Key Takeaways Explain This Topic AI

Due diligence is a risk-based investigation done before granting access or sharing data — depth must scale with the vendor's inherent risk.

Questionnaires (SIG, CAIQ) are useful only when answers are validated against independent evidence such as SOC 2 Type II reports or configuration samples.

Right-to-audit clauses and independent attestations (SOC 2, ISO 27001, PCI AOC) provide stronger assurance than self-attested questionnaires.

Continuous monitoring tracks control drift, breach history, financial health, ownership changes, subprocessor additions, and SLA misses.

A vendor risk register records each finding with risk, owner, due date, and status (open, compensating control, accepted).

Last updated: June 2026

Due Diligence Is Risk-Based, Not One-Size-Fits-All

Due diligence is the investigation performed before trusting a third party with credentials, facilities, or data. It is not a single form — it asks, "What happens if this vendor fails, is breached, mishandles data, or cannot perform?" The answer drives an inherent risk rating that scales the review. A furniture supplier and a cloud provider storing customer records do not get the same scrutiny.

The first step is scoping . Common intake questions:

What business process will the vendor support, and is it business-critical?

What data types will it access, process, store, or transmit (PII, PHI, cardholder data)?

Will it hold network, cloud, API, or privileged access?

Will it use subprocessors (fourth parties)?

Which countries or regions will host or process the data ( data sovereignty )?

Do regulatory or contractual obligations (HIPAA, PCI DSS, GDPR) apply?

Scoping answers feed a tier: a high-risk vendor gets deep evidence review and frequent monitoring; a low-risk supplier may get a short questionnaire.

The goal of scoping is to set an inherent risk rating that drives the depth of due diligence. A vendor that stores protected health information and holds privileged production access is high-inherent-risk and earns an independent audit review, a right-to-audit clause, and quarterly monitoring. A vendor that ships branded coffee mugs is low risk and may pass with a one-page questionnaire. Spending equal effort on both wastes the budget that should protect the data that matters — and on the exam, the correct answer matches the rigor of the review to the sensitivity of the data and the level of access being granted.

Questionnaires and the Evidence Behind Them

Standardized questionnaires speed comparison: the SIG (Standardized Information Gathering) questionnaire and the Cloud Security Alliance CAIQ (Consensus Assessments Initiative Questionnaire) are common. But a questionnaire is self-attested — it proves intent, not operation. Strong programs validate answers against independent evidence.

• Topic Example question Evidence that actually supports it
• Access control Is MFA required for admin access? IdP export of admin accounts + enforcement config
• Encryption Encrypted in transit and at rest? Architecture diagram + crypto standard
• Incident response How fast are incidents reported? Tested IR plan + contract notification clause
• Vulnerability mgmt How are critical vulns fixed? Scan summary + remediation SLA + rescan
• Continuity Can service survive disruption? BCP test report + RTO/RPO
• Privacy How are deletion/retention requests handled? Retention schedule + DSAR workflow
• Subprocessors Which fourth parties support this? Subprocessor list + change-notification clause
• Independent assurance beats self-attestation

SOC 2 Type II — tests whether controls operated over a period (3–12 months); a Type I only describes design at a point in time.

ISO/IEC 27001 — certified ISMS scope.

PCI DSS AOC (Attestation of Compliance) — for cardholder data.

A right-to-audit clause lets you verify directly when reports fall short.

When reviewing a SOC 2, do not stop at the opinion page. Read the scope (which systems and trust-service criteria are covered), the report period , the auditor's opinion type (unqualified is clean; qualified means exceptions), and the complementary user-entity controls — the things you must do for the vendor's controls to work. A clean report with a scope that excludes the very system holding your data proves nothing. This is why the exam distinguishes a self-attested questionnaire answer from an independent attestation: the questionnaire states intent, the attestation tests reality.

Continuous Monitoring Scenario

A retailer uses a third-party marketing-analytics platform. During due diligence the vendor states it stores no payment data — only pseudonymous customer IDs, email addresses, campaign events, and consent flags — so it is approved as medium risk .

Six months later the vendor announces an integration that enriches profiles through a new subprocessor . That is a material change : it may alter data sharing and privacy exposure. The retailer updates the vendor risk record, reviews the new subprocessor, confirms consent language still matches actual processing, and requires a contract amendment before enabling the feature.

Monitoring is broader than technical controls. Mature TPRM watches SLA misses, breach notifications, audit-report exceptions, negative news, financial distress, ownership/merger changes, expiring attestations, and missed remediation dates . Many programs subscribe to a security-ratings feed for an external signal.

Vendor Risk Register

• Finding Risk Owner Due date Status
• No tested incident-notification Delayed breach reporting Vendor security lead 2026-07-15 Open
• SOC 2 has a backup exception Recovery uncertainty Procurement manager 2026-06-30 Compensating control
• Subprocessor list changed New fourth-party privacy risk Privacy office 2026-06-20 Under review
• Common Traps

Asking every vendor identical questions regardless of risk tier.

Accepting "yes" answers with no evidence for high-risk services.

Reviewing a vendor once and never re-assessing.

Ignoring material changes (new data types, regions, subprocessors).

Treating a SOC 2 or ISO cert as proof that every contract requirement is met.

The risk register is the heartbeat of monitoring. Every finding needs an owner , a due date , and a status , and the program lead reviews aging items so nothing sits open indefinitely. When a risk cannot be fixed by the deadline, the right move is a documented compensating control plus a formal risk acceptance signed at the appropriate level — never a silent expiry. On the exam, when a material change appears (a new subprocessor, a new region, a fresh breach disclosure), the best answer triggers a re-assessment and contract amendment, not an immediate technical reflex like deleting logs or disabling consent records.