CompTIA Security+ (SY0-701)
FHG University prepares you for this exam on the Identity & AI Security track. Here are the modules mapped to its published objectives, and the opening of one to read now.
Examination preparation — these exams are set and awarded by their issuers. FHG prepares you for them and cannot grant them.
The modules mapped to it
21 modules · about 36 h 10 min estimated in all
The Zero Trust Roadmap for M365 Identity Management
Turns Zero Trust from a slogan into a sequenced Microsoft 365 rollout: what NIST SP 800-207, Microsoft and CISA each actually say, how to baseline a tenant with evidence, and a four-phase plan of Conditional Access, device, privilege and risk controls with exit criteria. Every change is staged through emergency access accounts, report-only evidence and a written rollback, updated for mandatory MFA and the October 2026 move of risk policies into Conditional Access.
What Zero Trust Actually Says, and Who Said It
The situation. A manager asks you to "do Zero Trust" in the company's Microsoft 365 tenant. Before you change a setting, you need to know what the term commits you to, because three different sources get quoted interchangeably and they say different things.
- NIST SP 800-207, Zero Trust Architecture (August 2020) is the architecture reference. It defines Zero Trust through seven tenets, which in short are: every data source and service is a resource; all communication is secured regardless of network location; access is granted per session; access is decided by dynamic policy using the identity, the requesting device and other attributes; the enterprise monitors the security posture of every asset it owns or that connects; authentication and authorization are dynamic and enforced before access; and the enterprise collects as much telemetry as it can and uses it to improve. It also names the logical components: the policy engine (makes the decision), the policy administrator (carries the decision out by opening or closing the path, for example issuing or refusing a session token), and the policy enforcement point (sits in the access path and allows, monitors or ends the connection). Engine plus administrator together form the policy decision point.
- Microsoft's three guiding principles are verify explicitly, use least privilege access and assume breach. They are a useful summary, and SC-900 expects you to know them, but they are Microsoft's framing, not NIST's. Attributing them to SP 800-207 is a common error in interviews and in study notes.
- CISA's Zero Trust Maturity Model, Version 2.0 (April 2023) is the measuring stick: five pillars (Identity, Devices, Networks, Applications and Workloads, Data), three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, Governance) and four maturity stages (Traditional, Initial, Advanced, Optimal).
For a worked example of the architecture, NIST's National Cybersecurity Center of Excellence published SP 1800-35, Implementing a Zero Trust Architecture, as a final guide on 11 June 2025. It documents 19 example implementations built with 24 participating vendors, and it maps the capabilities to the NIST Cybersecurity Framework and SP 800-53. It is the place to look when someone asks what a real deployment involved.
How the pieces land in Microsoft 365. Microsoft Entra ID is where most access decisions start, which is what SC-900 means by "identity as the primary security perimeter." Conditional Access evaluates signals (user, group, location, device state, application, risk) after the first authentication factor and decides whether to issue a token and with what conditions. That evaluation plays the policy engine and administrator roles. Enforcement happens in more than one place: Entra ID refuses or limits the token, and the resource (Exchange Online, SharePoint, an app behind an app proxy) honors or rejects the token it is shown. Continuous access evaluation lets supported resources react to critical events, such as a disabled account, before a token would normally expire. Saying "Conditional Access is the whole Zero Trust stack" overstates it; saying "Conditional Access is the decision point for identity-based access, and the token and the resource enforce it" is accurate.
The limit. None of these documents is a product checklist, and none can be "finished." CISA's model describes a direction of travel. A tenant can be Advanced on identity and Traditional on data at the same time, and that is a normal, reportable state.
Members · the rest of this module
You’ve read 1 of 9 sections.
Members read the rest of this module and every module listed above, in their track’s order, and each one they finish is logged in hours with a content outline. $25 a month, cancel any time.
Already a member? Sign in, then pick up from your dashboard.
Add FHG to how you study. Keep every hour on record.
Members keep a record of the modules they finish and the study time each one takes.
CompTIA Security+ renews through continuing education. If you already hold it, completing a section here that is matched to it issues a completion certificate with its hours and a content outline, which you can submit to CompTIA. CompTIA decides what it accepts.
Preparation means the material maps to the published objectives. It is not a promise of a pass, and CompTIA sets, administers and awards the exam.