I went through the official SY0-701 objectives document looking for the authentication protocols, expecting the usual lineup. Kerberos is not in it.
No objective mentions it, and neither does any sub-bullet. The acronym list at the back runs to 322 entries and includes things as obscure as Work Order and Gnu Privacy Guard, so I checked there as well, on the assumption that a protocol that old and that widely deployed had to be sitting somewhere in the document. It is not. The word appears nowhere.
That surprised me enough to go through the rest of the authentication material line by line, comparing every protocol I had been taught to expect against what the document actually lists. So what is really in there?
What the document says
Objective 4.6, identity and access management. Under single sign-on there are exactly three entries, and they are LDAP (Lightweight Directory Access Protocol), OAuth (Open Authorization) and SAML (Security Assertions Markup Language). Nothing else sits under that heading.
Objective 3.2, securing enterprise infrastructure. Port security has two sub-bullets, 802.1X and Extensible Authentication Protocol. They sit together because they work together.
Objective 4.1, common security techniques. Wireless security settings list WPA3, then AAA and Remote Authentication Dial-In User Service, then cryptographic protocols and authentication protocols.
So RADIUS is there. Once, in a wireless context. TACACS+ turns up only in the acronym list, never attached to an objective. Kerberos is absent.
The caveat, before anyone books an exam on this
CompTIA prints a disclaimer near the front saying the example lists are not exhaustive and that other technologies may appear on the exam. That disclaimer is real and you should take it seriously.
So is this a permission slip to skip Kerberos forever on the strength of a ctrl+F? No.
What it gives you is a map of where the weight sits. That is a different thing, and confusing the two is how people end up with a very confident and very wrong study plan.
Why your study material disagrees
Security+ has been through a lot of versions. Study material gets inherited and lightly reworded, then resold. A large amount of the authentication content floating around was written for older objectives, or borrowed wholesale from networking courses where the RADIUS versus TACACS+ comparison genuinely is a headline topic.
That is how you end up three days out from your exam memorising ticket-granting-ticket flow diagrams. The exam you booked lists LDAP, OAuth and SAML. You are revising for a different one.
I have watched people do this with ports too. How many do you actually need? Somebody learns sixty of them because a video said to, when the objectives name a handful.
What to study instead, and the shape of the question
The SSO three. The trap here is treating OAuth as authentication. Look at what the letters actually stand for: open authorization. SAML is the one carrying an authentication assertion, and LDAP is the directory you query. A scenario about letting a partner company's staff in without creating accounts for them is pointing at federation and SAML. A scenario about an app acting on a user's behalf without ever holding their password is pointing at OAuth. Same family, different jobs.
802.1X and EAP. Learn them as a pair, because the objectives list them as one. 802.1X is the framework that decides whether a port opens. EAP carries the actual authentication conversation inside that framework. Question shape: a device plugs into a wall jack and lands nowhere until it proves who it is.
RADIUS. It is filed under wireless settings, alongside WPA3. Learn it in that context.
The technique, which is the part worth keeping
Download the objectives PDF. It is free, it sits on CompTIA's own site, and almost nobody studying for this exam has actually opened it.
Then search the document before you commit a week to anything. A term that appears in an objective is core. One that shows up only in the acronym list needs nothing beyond knowing what it stands for. Anything missing from the document altogether? That goes in your last-week pile.
This works in both directions, which is the useful part, because it also catches things you were about to skip. Attestation sits in 4.6 and I would bet most candidates could not define it.
The one thing the document cannot tell you
Objectives are a list of topics. Nothing more. They cannot show you what a performance-based question feels like when the clock is running and you are being asked to configure something rather than recognise a term.
That format is worth meeting before exam day rather than during it. Professor Messer's free series is the standard no-cost path for the content, and Jason Dion's practice sets are the usual paid one. For the PBQ format specifically I built a free firewall one that needs no account, at secplusmastery.com/security-plus-pbq. Full disclosure, that one is mine.
Go and read the objectives document. It takes an hour and it will probably delete something from your study plan.
Top comments (0)