CompTIA SY0-701: Endpoint, Mobile & Physical Security — Study Guide

By Laurynas Brazys · 20 July 2026 · #comptia #sy0-701 #certification #exam-prep #study-guide

Part of the CompTIA Security+ SY0-701 — Complete Study Guide. Practice with verified answers in the CompTIA exam hub, or take timed practice tests on ExamRoll.io.

The security of information systems ultimately depends on the security of the physical and endpoint devices that store and process data. A perfectly configured firewall provides little protection when an unencrypted laptop is stolen from an airport lounge, when a technician props open a data center door for convenience, or when an employee side-loads a compromised APK onto a corporate phone.

Mobile Deployment Models and Device Hardening

Mobile device management strategy begins with ownership and control models. In a Bring Your Own Device (BYOD) model, employees use personally owned hardware for work. The organization has limited authority to enforce configuration, so controls focus on containerization — separating corporate data into an encrypted, remotely manageable workspace (such as Android Work Profile or iOS User Enrollment) while leaving personal data untouched. Remote wipe in BYOD is typically limited to the corporate container.

Corporate-Owned, Personally Enabled (COPE) devices are purchased and owned by the organization but allow reasonable personal use. Because the company owns the hardware, it can enforce full device policies: mandatory PIN complexity, disabled developer options, enforced OS versions, application allowlisting, and full-device remote wipe. COPE strikes a balance between user satisfaction and enterprise control.

Corporate-Owned, Business Only (COBO) locks devices to strictly work-related use. Personal apps, cameras, USB transfer, and app stores are disabled. COBO is appropriate for high-security environments such as healthcare, finance, or government where data leakage risk outweighs employee convenience.

Mobile Device Management (MDM) platforms (Jamf, Microsoft Intune, VMware Workspace ONE) enforce policies, push configurations, deploy applications, and enable remote wipe. Mobile Application Management (MAM) focuses specifically on application-level controls without requiring full device enrollment — useful in BYOD scenarios where employees resist full MDM enrollment.

Endpoint Hardening and Configuration Baselines

Endpoint hardening reduces the attack surface of workstations and servers. The CIS Benchmarks provide prescriptive, consensus-based configuration guidance for Windows, Linux, macOS, and major applications. Key hardening measures include disabling unnecessary services and ports, enabling host-based firewalls, configuring automatic updates, enabling full-disk encryption, deploying EDR, and enforcing application allowlisting.

Group Policy in Active Directory environments enforces configuration at scale. A GPO might enforce:

Computer Configuration > Windows Settings > Security Settings:
  - Minimum password length: 14 characters
  - Account lockout threshold: 5 invalid attempts
  - Audit logon events: Success and Failure
  - Disable: Guest account, AutoRun/AutoPlay
  - Enable: Windows Firewall (all profiles)

Patch management is the single highest-return security activity for endpoints. The majority of successful exploits target known vulnerabilities for which patches have been available for months or years. A patch management program defines SLAs by severity (critical patches within 72 hours, high within 14 days, medium within 30 days), tracks compliance, and escalates exceptions.

Physical Security Controls

Physical security is the first line of defense. Mantraps (also called airlocks or access control vestibules) create a two-door entry where the first door must close before the second opens, preventing tailgating. Badge readers, biometric scanners, and PIN pads control access to sensitive areas. CCTV provides deterrence and forensic evidence. Guards provide human judgment that automated systems cannot replicate.

Environmental controls protect against non-adversarial threats. Data centers require precise temperature and humidity management (ASHRAE A1 class: 15–32°C, 20–80% RH), redundant cooling, fire suppression (clean agent systems such as FM-200 or Novec 1230 that do not damage equipment), and raised flooring for cable management and airflow.

Faraday cages block electromagnetic signals, preventing wireless communication into or out of a shielded space. They are used in high-security facilities to prevent RF-based data exfiltration and in forensic investigations to prevent remote wiping of seized devices.

Practical Scenario: Physical Tailgating Leading to Data Theft

A financial services firm’s trading floor had badge-controlled access but no mantrap. An attacker posing as an HVAC technician (wearing a uniform and carrying tools) waited near the entrance and followed a legitimate employee through the door when they badged in — a classic tailgating attack. Once inside, the attacker located an unattended workstation that had been left logged in, inserted a USB drive containing a keylogger and reverse shell payload, and left within four minutes. The keylogger captured trader credentials over the following week, which were used to access the trading platform from an external IP. The physical control failure — no mantrap, no visitor escort policy, no unattended workstation policy — enabled the entire attack chain. A mantrap would have required the attacker to badge independently, and a screen lock policy (idle timeout of 5 minutes) would have prevented access to the unlocked workstation.

← Business Continuity · All domains · Vulnerability Management →

Practice these questions → · Timed practice on ExamRoll.io →