CompTIA Security+ SY0-701

A bilingual, hands-on study environment for CompTIA Security+ SY0-701, combining structured objectives, realistic scenarios and an AI-assisted cybersecurity trainer.

---

Quick Navigation

• Synthetic evidence datasets — logs, PCAP, alerts, timelines and fictional IOCs with bilingual exercises and an explicit license: catalog.
• What this is — The idea behind the trainer and how it's put together.
• Features — Checklists, glossary, exam simulator, AI trainer.
• Prerequisites — What you need installed before you start.
• Gemini API key — How to get the free key the AI features use.
• Environment variables — The .env file the app reads.
• Installation — Step-by-step for Linux, macOS and Windows.
• Container — A hardened Docker image for self-hosting.
• Scripts — The npm commands and what each one does.
• Architecture — Where the code lives in the repo.
• Troubleshooting — Fixes for the two errors you're most likely to hit.
• Licence — GPL-3.0 for the code; CompTIA marks belong to their owners.

[!TIP] Found a mistake in a question or translation, or have a feature idea? Open an issue on GitHub — bilingual, self-hosted and privacy-first is the only real requirement.

---

What this is

A single self-hosted web app for preparing the CompTIA Security+ SY0-701 exam. It runs entirely on your own machine or server: the React frontend is served by a small Express backend that also acts as a proxy to the Google Gemini API, so your API key stays server-side and is never shipped to the browser.

Everything in the app is bilingual. Italian is the source of truth (src/data.ts) and English is a keyed overlay (src/data.en.ts) that falls back to Italian for anything not yet translated, wired together by src/localizedData.ts — all five domains' subtopics and quiz questions are fully available in both languages.

The philosophy, shared with the rest of these repositories:

• Self-hosted — no third-party account for the app itself; clone it and run it.
• Privacy-first — your Gemini key lives in a local .env and is used only by your own server; nothing about your study data leaves your machine.
• Free and open-source, under the GNU GPL-3.0 licence.

Features

• Interactive SY0-701 checklist — track your progress across all 5 official domains (General Security Concepts; Threats, Vulnerabilities & Mitigations; Security Architecture; Security Operations; Security Program Management & Oversight).
• Comprehensive SY0-701 glossary — instant search with filters by domain and category (acronyms, controls, attacks, metrics/formulas, governance), an A–Z index and bookmarks.
• AI Senior Cybersecurity Trainer — backed by the Google Gemini API for step-by-step explanations, concept comparisons and exam-metric clarifications (ALE, SLE, ARO, RTO, RPO, and more).
• End-of-module summaries — every domain guide closes with its key points, the domain's acronyms, the correct reading of the frequent mistakes and a self-assessment you tick, kept in the browser and in the progress backup.
• High-stakes exam simulator — scenario-based, Analysis/Application-level questions with detailed rationale and distractor analysis.
• AI remediation generator — after a practice set, the AI dynamically generates targeted questions on the topics where you were weakest.
• Privacy-first smart review — per-question mastery stays in the browser; mistakes return immediately and correct answers reappear on a 1–3–7–14–30 day schedule.
• Full English / Italian localisation — every subtopic and quiz question in both languages, switchable in-app.
• On-demand labs — local Docker sessions with automatic expiry, re-entry, clean reset and resource caps. See costs and usage.
• Configurable exam mode — 1–90 MCQs/PBQs, exact domain counts, optional timer, answer navigation and flags, deferred explanations and domain/objective reports. See exam simulator.
• Offline study (PWA) — after one online visit, wait for “Ready to study offline”: guides, glossary, quizzes and practice scenarios work without a network in both languages, with progress saved in this browser. AI needs Internet; updates wait until you choose to restart. See offline study.
• Hands-on labs — exercises to run on your own machine, with rules of engagement, a risk level and a tested cleanup: see . The first one inspects this app's own security headers and rate limit.

Prerequisites

• Node.js 22.13 or higher — LTS 24.x recommended (the version in .nvmrc). Node 18 and 20 are end-of-life and no longer supported by the test and lint toolchain.
• npm 10.x or higher (bundled with Node.js).
• Git — to clone the repository.

Gemini API key

The AI trainer and the remediation generator use the official @google/genai SDK and need a free GEMINI_API_KEY:

1. Go to Google AI Studio: https://aistudio.google.com/
2. Sign in with your Google account.
3. Click "Get API key".
4. Click "Create API key" (pick an existing or new Google Cloud project).
5. Copy the generated string (e.g. AIzaSy...) — it goes into your .env file.

Environment variables

Copy .env.example to a new file called .env in the project root:

# Required — Google Gemini AI trainer & remediation engine
GEMINI_API_KEY="Paste_Your_Gemini_API_Key_Here"

# Optional — application base URL
APP_URL="http://localhost:3000"

# Optional — cost and resilience limits for the AI endpoints
AI_DAILY_LIMIT=500        # total AI calls per UTC day, all users together; 0 turns the AI off
GEMINI_TIMEOUT_MS=30000   # a Gemini call taking longer is abandoned and answered with 504
TRUST_PROXY=1             # reverse proxies in front of Node; 0 if browsers connect directly
AI_ACCESS_TOKEN=          # optional: the AI answers only visitors who enter this code

# Optional — network interface (default 0.0.0.0, every interface)
HOST=127.0.0.1            # reachable only from this computer: for labs and local demos

AI_DAILY_LIMIT complements the per-IP rate limit (30 requests every 15 minutes): on a public deployment it caps what many different addresses can spend together. The counter lives in the server process, so with several instances the effective cap is the limit multiplied by the number of instances.

TRUST_PROXY tells the rate limit where to read the client address. Keep 1 behind one reverse proxy (Cloud Run, Vercel, Render, a single nginx). Set 0 when browsers reach Node directly: otherwise a client can send a made-up X-Forwarded-For header and get a fresh quota on every request.

AI_ACCESS_TOKEN protects the Gemini budget of a public site: visitors can study freely, but the AI Trainer and the adaptive remediation ask for the code first. Generate a long random one, for example with openssl rand -base64 24, and share it only with the people who should use the AI. The browser keeps it for the current tab only.

[!WARNING] Never commit your .env to a public repository — it holds a private API credential.

Installation

🐧 Linux (Ubuntu, Debian, Fedora, Arch)

# 1. Install prerequisites
# Ubuntu / Debian:
sudo apt update && sudo apt install -y curl git
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt install -y nodejs
# Fedora / RHEL:   sudo dnf install -y git nodejs
# Arch:            sudo pacman -S git nodejs npm

# 2. Verify
node -v   # v22.13.x or higher (v24.x recommended)
npm -v    # v10.x.x or higher

# 3. Clone, install, configure
git clone https://github.com/chiaraberti13/CompTIA-Security-SY0-701.git
cd CompTIA-Security-SY0-701
npm install
cp .env.example .env
nano .env          # paste your GEMINI_API_KEY

# 4. Run
npm run dev        # development, hot reload → http://localhost:3000
# or
npm run build && npm start   # production

🍎 macOS (Intel & Apple Silicon)

# 1. Install prerequisites (Homebrew)
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
brew install node git

# 2. Clone, install, configure
cd ~/Documents
git clone https://github.com/chiaraberti13/CompTIA-Security-SY0-701.git
cd CompTIA-Security-SY0-701
npm install
cp .env.example .env
nano .env          # paste your GEMINI_API_KEY (CTRL+O, ENTER, CTRL+X)

# 3. Run
npm run dev                    # → http://localhost:3000
# or
npm run build && npm start

🪟 Windows (PowerShell / CMD / WSL2)

Native (PowerShell as Administrator):

# 1. Install prerequisites
winget install OpenJS.NodeJS.LTS
winget install Git.Git
# (restart the terminal afterwards)

# 2. Clone, install, configure
cd $HOME\Documents
git clone https://github.com/chiaraberti13/CompTIA-Security-SY0-701.git
cd CompTIA-Security-SY0-701
npm install
Copy-Item .env.example .env
notepad .env       # paste your GEMINI_API_KEY, then save

# 3. Run
npm run dev                    # → http://localhost:3000
# or
npm run build ; npm start

WSL2: open your WSL shell (e.g. Ubuntu) and follow the Linux steps above — the app maps to http://localhost:3000 in your Windows browser automatically.

Container

The Dockerfile builds a production image meant for self-hosting:

• multi-stage: the build tools stay in the first stage; the image ships only dist/, with the server bundled together with the libraries it uses;
• distroless runtime (gcr.io/distroless/cc-debian12) with the Node.js binary of the build stage, so Node stays on the latest Node 24 security release: no shell, no package manager, about 225 MB;
• non-root user (nonroot, uid 65532), files owned by root, so the app cannot modify its own code;
• base images pinned by digest and updated by Dependabot;
• a HEALTHCHECK on /healthz and a clean exit on docker stop.

docker build -t comptia-sy0701 .
docker run --rm -p 3000:3000 \
  --read-only --cap-drop=ALL --security-opt=no-new-privileges \
  -e GEMINI_API_KEY=your-key \
  comptia-sy0701

--read-only makes the whole filesystem read-only, --cap-drop=ALL removes every Linux capability and no-new-privileges blocks privilege escalation: the app works with all three, and CI checks it on every change. The environment variables are the ones listed in Environment variables; pass them with -e or --env-file, never bake them into the image.

Scripts

Script	What it does
npm run dev	Express + Vite middleware in development, hot reload on http://localhost:3000.
npm run build	Builds the React frontend (Vite) and bundles the Express backend (esbuild) into dist/server.cjs.
npm start	Runs the compiled production server (node dist/server.cjs).
npm run typecheck	TypeScript type-check (tsc --noEmit).
npm run lint	ESLint over the source (TypeScript + React Hooks rules).
npm test	Vitest suite: dataset integrity, quiz logic and i18n coverage.
npm run check	Typecheck + lint + tests, the same gate CI runs.
npm run maturity-dashboard	Regenerates docs/maturity-dashboard.md: project health across coverage, freshness, links, accessibility, security and translations. A test fails CI when it is stale.
npm run smoke	After npm run build: starts dist/server.cjs in production mode and checks the app shell, security headers, SPA fallback and API input validation. Also run by CI.
npm run lab:session -- help	Manages local on-demand Docker sessions with expiry, reset and resource caps; IT/EN help.
npm run lab:verify	Requires Docker and the comptia-labs image: verifies real isolation, limits, reset and expiry.
npm run e2e:offline	After npm run build: checks offline reloads, both languages, saved quiz progress and explicit updates in Chromium at desktop and phone width. Included in the full CI end-to-end suite.

Architecture

Integrated full-stack layout — one Express server serves the frontend and proxies Gemini:

├── server.ts                 # Start-up: reads the environment, Vite in dev, listen, graceful shutdown
├── server/
│   ├── app.ts                # createApp(): security headers, /healthz, rate limit, AI routes, static files
│   └── aiGuard.ts            # Daily AI budget and safe reading of numeric limits
├── src/
│   ├── App.tsx               # Main React component (Studio, Glossary, Quiz, AI)
│   ├── components/           # Domain guide, glossary, "Your data" (export/import/delete)
│   ├── main.tsx              # React 19 entry point
│   ├── data.ts               # Italian source of truth — 5 domains & question bank
│   ├── data.en.ts            # English overlay, lazily loaded (falls back to Italian)
│   ├── localizedData.ts      # Merges the two languages, namespaces question ids
│   ├── domainGuides.ts       # Reasoned guide per domain (IT/EN)
│   ├── questionObjectives.ts # Links every question to its SY0-701 objectives
│   ├── subgroups.ts          # checklistKey → thematic subgroup map
│   ├── quiz.ts               # Pure quiz logic (shuffle, threshold, history, spaced review)
│   ├── progressBackup.ts     # Backup format and sanitisers for the saved progress
│   ├── remediation.ts        # Validation of AI-generated questions
│   ├── storage.ts            # Guarded localStorage helpers
│   ├── i18n.tsx              # UI-string localisation & language switch
│   ├── types.ts              # TypeScript interfaces
│   └── index.css             # Tailwind CSS v4 styles
├── tests/                    # Vitest: data integrity, IT/EN parity, API, components, logic
├── e2e/                      # Playwright + axe at phone and desktop width
├── scripts/                  # Smoke test and coverage-matrix generator
├── docs/coverage-matrix.md   # Generated: questions per objective
├── docs/maturity-dashboard.md # Generated: project health across six dimensions
├── docs/errata.md            # Content errors already fixed
├── docs/quality-baseline.md  # Measured baseline: questions, tests, audit, Lighthouse
├── docs/content-templates.md # How each kind of content is written, and its test
├── docs/style-guide.md       # Tone, terminology, acronyms and approved translations
├── docs/gap-analysis.md      # Concepts without an example, figures without a source
├── labs/                     # Hands-on labs: rules of engagement, template, exercises
├── public/favicon.svg        # App icon
├── .github/workflows/        # ci.yml (checks, smoke, e2e) and security.yml (gitleaks, audit, CodeQL)
├── .env.example              # Environment variables template
├── eslint.config.js          # ESLint flat config
├── package.json              # Dependencies & scripts
├── vite.config.ts            # Vite configuration (dataset/vendor chunk splitting)
└── tsconfig.json             # TypeScript configuration

Troubleshooting

AI error: "GEMINI_API_KEY is not configured" Missing .env or invalid key. Make sure .env exists in the project root with a valid key from Google AI Studio, then restart the server (npm run dev).

Error: listen EADDRINUSE: address already in use :::3000 Port 3000 is taken. Free it:

• Linux / macOS: npx kill-port 3000
• Windows PowerShell: Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess | Stop-Process

Licence

The code in this repository is distributed under the GNU GPL-3.0 licence — see LICENSE for the full text. You're free to use, study, modify and redistribute it, including commercially, as long as the copyright notice is kept; it's provided as-is, with no warranty.

The bundled fonts, Inter and JetBrains Mono, are under the SIL Open Font License 1.1: their notices and licence ship with the app in public/licenses/. The licences of every dependency are in the SBOM the Security workflow builds, and pull requests are checked against an allow-list of licences compatible with GPL-3.0.

This project is an independent, educational study aid. CompTIA and Security+ are registered trademarks of CompTIA, Inc.; this project is not affiliated with or endorsed by CompTIA, and all such trademarks belong to their respective owners.

A note on the study content

The study materials in this platform (checklists, glossary, questions and explanations) are original, personal study notes written to help build understanding of the concepts. They are not official CompTIA material, they do not reproduce real exam questions, and they are not intended as an "exam dump": passing the exam requires genuine understanding of the topics, not memorized items.

The content is aligned with the official SY0-701 objectives to the best of the author's knowledge, but it may contain inaccuracies and may fall behind updates to the exam syllabus. Always verify against official CompTIA sources:

• the current exam objectives and their version number;
• voucher price, exam duration and number of questions;
• renewal (CEU), retake and certification-expiry policies;
• test dates and delivery options (test centre or online proctoring).

Where these notes and CompTIA's official documentation disagree, the official documentation always prevails.

How every official objective is covered (number of questions by cognitive level and guided exercises) is published in docs/coverage-matrix.md, generated from the dataset and checked by CI. The closest NIST CSF 2.0 functions, CIS Controls v8 and MITRE ATT&CK tactics for each objective are in docs/framework-mapping.md.

Substantive content errors already fixed (a wrong definition, a mismatched port, an answer that contradicted the explanation) are listed in docs/errata.md, with the commit of each fix. To report a new one, open an issue.

---

---

Release versionate · Versioned releases

Content review and spelling

• Live deployment, PR previews and checks
• Dominio 1 / Domain 1: rapporto di revisione
• Controllo ortografico IT/EN / IT/EN spelling

Blue Team and Red Team: open the study paths panel. Labs and learning checks.