Automation, Orchestration, SCAP, and Security Tooling

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Automation, Orchestration, SCAP, and Security Tooling

Key Takeaways Explain This Topic AI

Automation performs repeatable single actions; orchestration coordinates multiple tools and steps into a workflow.

Security tooling includes vulnerability scanners, EDR/XDR, SIEM, SOAR, configuration assessment, ticketing, CSPM, and secrets scanners.

SOAR runs playbooks across tools; SCAP standardizes vulnerability and configuration assessment with machine-readable content.

High-impact automated actions need guardrails: approval gates, logging, and a rollback/reversal path.

Automation only helps when inputs (especially inventory) are trustworthy and outcomes are verified.

Last updated: June 2026

Security operations face more events, vulnerabilities, and configuration checks than people can process manually with consistent speed. Automation and orchestration perform repeatable actions and connect tools into workflows. They do not replace judgment — they make well-defined decisions faster and more consistently.

Automation vs Orchestration

Concept Meaning Example

Automation One tool performs a task without manual repetition Disable a local account after an approved termination event

Orchestration Multiple tools coordinated in a workflow SIEM alert opens a ticket, enriches the asset, queries EDR, and requests isolation approval

Playbook / runbook Documented workflow with triggers and actions Phishing response, malware containment, vulnerable-asset escalation

Benefits and Risks of Automation (SY0-701 objective 4.7)

Security+ lists explicit pros and cons you may be asked to identify:

Benefits Risks / cautions
Efficiency, time savings, scaling force Complexity and technical debt
Enforcing baselines and consistency Single point of failure if the engine breaks
Reaction time and standardization Acting on bad data (ongoing supportability)
Workforce retention (less drudgery) Cost of skilled engineers to maintain it
Secure scaling and reduced reaction time Reduced oversight if approvals are bypassed
Common Security Tooling

Tool type Operational purpose
Vulnerability scanner Finds known weaknesses and missing patches
Configuration assessment Checks systems against secure baselines
EDR / XDR Monitors endpoint behavior, supports containment
SIEM Collects and correlates logs for detection and reporting
SOAR Runs playbooks across tools and teams
Ticketing system Tracks assignment, approval, evidence, due dates
CSPM Detects risky cloud configurations and compliance gaps
Secrets scanner Finds exposed credentials in code or repositories
SCAP

The Security Content Automation Protocol (SCAP) is a NIST suite of standards that lets tools assess vulnerabilities and configurations consistently using machine-readable content. Component standards Security+ may name include CVE (vulnerability identifiers), CCE (configuration identifiers), CPE (platform/product naming), XCCDF (checklist/benchmark language), and OVAL (assessment logic).

SCAP idea Operational value
Standard identifiers (CVE/CCE/CPE) Tools refer to flaws and checks the same way
Machine-readable content (XCCDF/OVAL) Automated, repeatable baseline assessment
Repeatable evaluation Reduces manual interpretation differences
Reporting output Compares systems against expected requirements

SCAP does not fix anything — it standardizes how tools check and report on known conditions. A practical way to remember the components: CVE names the flaw , CCE names the misconfiguration , CPE names the product , XCCDF expresses the checklist , and OVAL expresses the test logic that decides pass or fail. Because the content is machine-readable, two different scanners running the same XCCDF benchmark against the same host should reach the same verdict, which is the entire point — repeatable, comparable assessment across a fleet and across vendors. SCAP content is what powers automated CIS Benchmark and DISA STIG compliance scans.

Scenario: Automated Vulnerability Escalation

Step Automated or manual Guardrail
Create ticket with owner and due date Automated Owner pulled from inventory
Enrich with exposure and classification Automated Inventory record must be current
Check KEV/threat-intel for exploitation Automated Source and timestamp recorded
Notify the application team Automated Includes remediation deadline
Apply patch to production Manual approval Change ticket and rollback required
Verify fix with rescan Automated Ticket stays open until evidence attached
Automation Decision Rules

Action Approach
Low-risk enrichment Fully automate
Ticket creation and routing Automate with owner-data validation
Block a known-malicious hash Automate if tested and reversible
Isolate a user laptop Automate for high-confidence malware, notify analyst
Disable an executive account Require human approval unless policy dictates auto-action
Production firewall change Require change approval and rollback plan
Common Traps

Automating from bad inventory and routing work to the wrong owner.

Letting automation close tickets without verification evidence.

Running containment with no exception or rollback path.

Treating SCAP as a remediation tool instead of an assessment standard.

Building playbooks that cannot handle missing data or tool outages.

Exam Focus

The best SY0-701 automation answer reduces repetitive work while preserving control over high-impact actions: enrichment, ticketing, standardized assessment, approval gates, logging, and verification. Be wary of answers that automate destructive or business-disruptive actions without guardrails.

Expect a question that asks for a benefit of automation — efficiency, consistent baseline enforcement, faster reaction time, secure scaling, and analyst retention are all valid — and a parallel question that asks for a risk , where the right answers are complexity, technical debt, a single point of failure, ongoing maintenance cost, and the danger of acting on bad data. The recurring scenario pairs SOAR with a containment action: automatic isolation of a high-confidence malware host is appropriate, but automatically disabling an executive's account or pushing an unreviewed production firewall change should pause for human approval.

Match the level of automation to the blast radius of the action.