Comptia Sec+ (4.0 Operations and Incident Response)

What is a secure baseline?

A well-defined security configuration that all application or system instances should follow, including settings such as firewall rules, patch levels, and operating system file versions.

How are integrity measurements used with secure baselines?

They are performed regularly against documented baselines to identify deviations; a failed integrity check requires correction.

How are security baselines established?

Organizations create foundational baseline policies, often using guidance from application developers, operating system manufacturers, and appliance manufacturers.

How are secure baselines deployed at scale?

They are usually pushed from centrally administered consoles using mechanisms such as Active Directory Group Policy or MDM; automation allows deployment to hundreds or thousands of devices.

Why must secure baselines be maintained and tested?

New vulnerabilities, application updates, and operating systems can require changes, and testing is needed because different baselines can conflict in complex enterprise environments.

Why is system hardening necessary, and where should hardening guidance come from?

Default configurations are not considered secure; hardening guides should be specific to the software or platform and may come from manufacturers, Internet interest groups, or general-purpose guides.

How should mobile devices be hardened?

Keep them updated with bug fixes and security patches, separate company and user data through segmentation, and manage them with a Mobile Device Manager (MDM).

How should workstations be hardened?

Continuously update operating systems, applications, and firmware; automate patches; connect them to policy management such as Active Directory Group Policy; and remove unnecessary software.

How should network infrastructure devices such as switches and routers be hardened?

Configure authentication instead of using defaults and obtain important security updates from the manufacturer, even though these devices may not be updated frequently.

How should cloud infrastructure be hardened?

Secure the cloud management workstation, apply least privilege to services and permissions, use EDR on devices accessing the cloud, and maintain cloud-to-cloud backups.

What are the main hardening steps for servers?

Apply operating system and security updates, enforce password and account limitations, limit network access, and monitor with anti-virus and anti-malware controls.

Why does SCADA/ICS require strong segmentation?

SCADA manages large-scale industrial systems such as power generation, refining, manufacturing, facilities, energy, and logistics, so the notes recommend extensive segmentation with no outside access.

How should embedded systems be hardened?

Patch vulnerabilities when possible and segment and firewall the devices to prevent access by unauthorized users; some embedded systems can be difficult to upgrade.

How should a Real-Time Operating System (RTOS) be hardened?

Isolate it from other areas, run only minimum required services, and use secure communications protected by a host-based firewall.

How should IoT devices be hardened?

Change weak default passwords, deploy updates quickly, and place IoT devices on their own VLAN for segmentation.

What is the purpose of a wireless site survey and heat map?

A site survey samples the wireless spectrum, identifies existing access points and interference, and helps plan coverage; a heat map shows wireless signal strengths, and surveys should be repeated as conditions change.

What does Mobile Device Management (MDM) provide?

Centralized management of company-owned and user-owned mobile devices, including policies for apps, data, cameras, device partitions, screen locks, PINs, and remote control.

How do BYOD, COPE, and CYOD differ?

BYOD means the employee owns the device and must meet company requirements; COPE means the company owns a personally enabled device and retains full control; CYOD is similar to COPE but lets the user choose the device.

What security concerns are associated with cellular, Wi-Fi, and Bluetooth connections?

Cellular can expose traffic and location and gives worldwide device reachability; Wi-Fi can face data capture, on-path attacks, and interference-based DoS; Bluetooth provides short-range PAN connectivity among mobile and peripheral devices.

What three security goals are emphasized when securing a wireless network?

Authenticate users before access, encrypt wireless data for confidentiality, and verify integrity with a Message Integrity Check (MIC).

What is the WPA2 pre-shared key problem described in the notes?

An attacker can capture or derive a PSK hash and brute-force the shared key; weak PSKs are increasingly vulnerable to GPU and cloud cracking, and compromise exposes the shared wireless key without forward secrecy.

How do WPA3, GCMP, and SAE improve wireless security?

WPA3 uses stronger GCMP protection with AES confidentiality and GMAC integrity, while SAE provides mutual authentication and creates separate shared session keys without sending the key across the network.

What is the difference between Open System, WPA3-Personal, and WPA3-Enterprise wireless modes?

Open System requires no authentication password; WPA3-Personal uses a shared pre-shared key; WPA3-Enterprise authenticates users individually through 802.1X and an authentication server such as RADIUS.

How do RADIUS, IEEE 802.1X, and EAP work together?

RADIUS centralizes AAA authentication; 802.1X provides port-based network access control; EAP supplies the authentication framework. The roles are supplicant client, authenticator access device, and authentication server.

How do input validation and secure cookies improve application security?

Input validation checks actual input against expected formats and normalizes incorrect input; a Secure cookie is sent only over HTTPS, and sensitive information should not be stored in cookies.

What application security controls are described besides input validation and secure cookies?

SAST finds many code flaws but requires verification; code signing verifies developer origin and modification; sandboxing isolates applications from unrelated resources; and application monitoring watches logs, blocked attacks, usage, and anomalies.

What is the acquisition or procurement process in asset management?

A multi-step purchasing process that begins with a user request and budget or approval information, includes supplier terms and conditions, and ends with purchase, invoicing, and payment.

How are asset assignment and classification managed?

A central tracking system associates ownership with a person and classifies the asset, such as hardware as capital expenditure and software as operating expenditure.

What does asset monitoring and enumeration involve?

Inventorying devices, associating support tickets with make and model, listing component parts such as CPU, memory, and storage, and applying asset tags such as barcodes, RFID, or tracking numbers.

What is media sanitization?

The disposal or decommissioning process that completely removes usable data so it cannot be recovered with forensic tools, whether a drive will be reused or a file permanently deleted.

What physical methods can destroy storage media?

Shredding or pulverizing, drilling or hammering through platters, electromagnetic degaussing that destroys magnetic data and renders the drive unusable, and incineration.

What is a certificate of destruction?

Documentation from a destruction service confirming that data or media was destroyed, providing a paper trail of what happened.

What factors are part of a data retention strategy?

How much data is backed up and where, copies and versions, the data lifecycle and purging, regulatory requirements, operational recovery needs, and retention differences by data type or application.

How does vulnerability scanning differ from penetration testing?

Vulnerability scanning is generally minimally invasive and identifies systems, ports, devices, and possible weaknesses; a penetration test actively attempts to exploit vulnerabilities.

What can Static Application Security Testing (SAST) find, and what are its limitations?

It can identify flaws such as buffer overflows and database injections, but it may miss issues such as authentication security or insecure cryptography and can produce false positives that require verification.

What is dynamic analysis or fuzzing?

Sending random or unexpected input to an application to look for abnormal behavior such as crashes, server errors, or exceptions; it is also called fault-injecting, robustness, syntax, or negative testing.

What is package monitoring and why is it important?

It verifies that software packages, especially open-source packages, come from a trusted source and contain no added malware or embedded vulnerabilities before deployment.

What is threat intelligence?

Research about threats, threat actors, their tools, and behavior that helps researchers and security operations teams make better prevention and investment decisions.

How do OSINT and proprietary threat intelligence differ?

OSINT uses publicly available sources such as Internet discussions, social media, government information, maps, financial reports, and databases; proprietary intelligence is compiled by third parties and sold as analytics, correlation, and monitoring services.

How do information-sharing organizations such as the Cyber Threat Alliance (CTA) support threat intelligence?

Members submit formatted threat data, the CTA scores and validates it against other submissions, and members can retrieve validated information for high-quality threat sharing.

What is dark web intelligence?

Monitoring specialized overlay networks for hacking-group activity, tools and techniques, credit card sales, stolen accounts and passwords, and references to company or executive names.

What should rules of engagement define for a penetration test?

The purpose and scope, test type and schedule, IP address ranges, emergency contacts, handling of sensitive information, and in-scope and out-of-scope systems or applications.

What risks and attack methods are involved when exploiting vulnerabilities during a penetration test?

Exploitation can cause denial of service, data loss, or instability, and may use password brute force, social engineering, database injections, buffer overflows, or privilege escalation.

What are initial exploitation, lateral movement, persistence, and pivoting in a penetration test?

Initial exploitation gains entry; lateral movement moves between systems; persistence creates a way back in; pivoting uses a compromised system as a proxy or relay to reach otherwise inaccessible systems.

What is a responsible disclosure or bug bounty program?

A controlled process in which a researcher reports a vulnerability, the manufacturer develops a fix, and the issue is later disclosed; bug bounties reward researchers for documenting vulnerabilities.

What is the difference between a false positive and a false negative in vulnerability analysis?

A false positive reports a vulnerability that does not actually exist; a false negative misses a vulnerability that does exist.

How are CVSS, CVE, and the National Vulnerability Database used?

CVSS assigns a quantitative vulnerability score from 0 to 10; CVE provides identifiers for known vulnerabilities; the NVD synchronizes with CVE and adds search and vulnerability information.

How do vulnerability classification and exposure factor help prioritize findings?

Scanners classify findings by areas such as applications, web applications, and networks, while exposure factor estimates the percentage of value or business activity that could be lost if a vulnerability is exploited.

How do environment, organizational impact, and risk tolerance affect vulnerability priority?

A public cloud database may need different treatment than an isolated lab system; user population, revenue impact, exploit potential, industry consequences, and the organization's acceptable risk all influence patch priority.

Why is patching the most common vulnerability remediation technique?

When a known vulnerability has a patch, installing it is a direct way to prevent many exploits; patches may follow scheduled cycles or arrive urgently for zero-days, and patching is ongoing.

What role can cybersecurity insurance play in vulnerability remediation planning?

It can cover some losses such as lost revenue, data recovery, phishing losses, or privacy lawsuit costs, but it does not cover everything, including some intentional acts or funds transfers.

How does segmentation reduce vulnerability impact?

It limits the scope of an exploit by separating devices into networks or VLANs; systems that cannot be patched may need isolation or air gaps, and internal NGFWs can filter traffic between VLANs.

What are compensating controls and vulnerability exceptions?

Compensating controls provide alternative protection when the optimal control is unavailable, such as disabling a service or limiting access; an exception is a formally approved decision to leave a vulnerability unresolved when circumstances justify it.

How should vulnerability remediation be validated and reported?

Rescan extensively, audit systems to confirm patches deployed, manually verify security when needed, and continuously report vulnerabilities, patched versus unpatched systems, new threats, errors, exceptions, and exemptions.

What is the overall purpose of security monitoring?

Continuously monitor entry points such as logins, public services, data locations, and remote access, react to events, and use dashboards to view system status.

What should be monitored across systems, applications, and infrastructure?

Systems include authentication, services, backups, and versions; applications include availability, response time, data transfer changes, and vendor notices; infrastructure includes remote access and firewall or IPS activity.

What is log aggregation and why is it useful?

A SIEM or SEM consolidates logs from systems such as servers, firewalls, VPN concentrators, SANs, and cloud services into one database for centralized reporting and correlation.

What is the purpose of ongoing security scanning in monitoring?

Actively check systems for operating system and driver versions, installed applications, and anomalies so the organization maintains a useful current inventory of raw security details.

How do reporting and archiving support security monitoring?

Reports turn collected data into actionable status and vulnerability information, while archiving keeps data available over long periods for investigations and legal or organizational retention requirements.

How should security alerts be handled and tuned?

Alerts should provide real-time actionable notification through methods such as text, email, or a SOC console; quarantine can stop spread, and tuning reduces false positives and false negatives over time.

What is Security Content Automation Protocol (SCAP)?

A NIST-managed standard that lets different security tools evaluate and act on common criteria for configuration validation, patch confirmation, breach scanning, monitoring, alerting, and remediation.

What are security benchmarks?

Minimum best-practice security configurations for technologies such as operating systems, cloud services, and mobile devices; the notes cite Center for Internet Security (CIS) benchmarks as a common example.

What is the difference between agent-based and agentless compliance checks?

Agents stay installed, provide richer real-time monitoring, and require maintenance; agentless checks run on demand without a permanent installation but cannot alert when they are not running.

What does a SIEM provide?

Collection and aggregation of security logs and alerts, real-time information, long-term storage, reporting, correlation of diverse data, and forensic analysis after an event.

What is Data Loss Prevention (DLP)?

A set of controls designed to stop sensitive information such as Social Security numbers, credit card numbers, or medical records from leaking through endpoints, cloud systems, email, storage, or collaboration tools.

How do SNMP, SNMP traps, and NetFlow differ?

SNMP polls device MIB data and OIDs over UDP 161; SNMP traps send threshold-triggered notifications over UDP 162; NetFlow summarizes network traffic flows from a probe to a collector for reporting.

What is the difference between a traditional network firewall and a next-generation firewall (NGFW)?

Traditional firewalls commonly filter by protocol and port, while an NGFW operates at the application layer with capabilities such as application identification, stateful multilayer inspection, and deep packet inspection.

How are firewall rules processed, and what is an implicit deny?

Rules usually follow a top-to-bottom logical path with more specific rules near the top; an implicit deny blocks traffic at the bottom even when the administrator did not explicitly add the deny rule.

What is a screened subnet?

An additional security layer between the Internet and private resources that allows public access to public-facing resources while keeping private data inaccessible.

How do signature-based and anomaly-based IPS rules differ?

Signature-based detection looks for a known matching pattern, while anomaly-based detection builds a normal baseline and flags unusual traffic; policies can block, allow, or alert on the traffic.

What do content filtering, URL filtering, and agent-based web filtering do?

They control access based on content, URL, or category; an endpoint agent can enforce filtering wherever the user is and is usually centrally managed and updated.

What is a proxy, and how do explicit, transparent, and forward proxies relate?

A proxy receives user requests and sends them on the user's behalf, supporting caching, access control, URL filtering, and scanning; explicit proxies require application awareness, transparent proxies do not, and a forward proxy centrally controls internal users' Internet access.

How do reputation filtering and DNS filtering block harmful destinations?

Reputation systems assign risk levels to URLs and map them to actions; DNS filtering uses threat intelligence so harmful domains are not resolved to IP addresses.

What security functions does Active Directory provide?

A primarily Windows-based directory of computers, accounts, shares, printers, groups, and other resources that centralizes authentication and access control and supports tasks such as password resets and account changes.

How do Group Policy and SELinux support operating system security?

Group Policy centrally configures users and computers, including scripts, network settings, and security parameters; SELinux adds mandatory access control to Linux and limits application access using least privilege.

Why are protocol and port selection important for secure communication?

Protocols such as Telnet, FTP, SMTP, and IMAP can send data in cleartext; secure alternatives or encryption should be selected, and a port number alone does not guarantee security, so security should be verified when necessary.

How can transport methods protect application traffic?

WPA3 encrypts wireless user data, and a VPN creates an encrypted tunnel so traffic is protected even when the application itself does not provide adequate encryption.

What is the role of a mail gateway?

It evaluates inbound email sources and can block messages at the gateway before they reach users; it may be deployed on-site or in the cloud.

How does Sender Policy Framework (SPF) validate email?

The domain owner publishes authorized sending mail servers in a DNS TXT record, and receiving servers check whether an incoming message came from an authorized host.

How does DomainKeys Identified Mail (DKIM) validate email?

The sending mail server digitally signs outgoing messages, publishes the public key in a DKIM DNS TXT record, and receiving servers validate the signature.

What does DMARC add to SPF and DKIM?

DMARC lets the domain owner publish a DNS TXT policy telling receivers what to do with messages that fail SPF or DKIM, such as accept, send to spam, or reject, and it provides compliance reports.

What is File Integrity Monitoring (FIM)?

Monitoring important operating system and application files to detect changes, especially files that should never change; examples in the notes include Windows SFC and Linux Tripwire.

How can DLP protect data in use, in motion, and at rest, and what is USB blocking?

Endpoint DLP can protect data in use, network DLP protects data in motion, and server controls protect data at rest; workstation DLP can also allow or deny removable USB storage actions.

How can cloud-based and email DLP prevent data loss?

Cloud DLP can inspect network traffic, block defined data strings, restrict cloud-storage transfers, and stop malware; email DLP can inspect inbound and outbound messages for threats, impostors, sensitive data, or suspicious transfers.

How does edge control differ from access control at the endpoint?

Edge control is primarily managed at the Internet boundary with relatively stable firewall rules; access control can apply anywhere and change dynamically based on user, group, location, application, and other conditions.

What is a posture assessment, and how do persistent, dissolvable, and agentless methods differ?

A posture assessment checks device health before network access; persistent agents remain installed, dissolvable agents run only during the check, and agentless NAC can perform checks through systems such as Active Directory during login or logoff.

What happens when a device fails a posture assessment?

It can be placed on a quarantine network with only enough access to correct the problem, administrators can be notified, and the device is checked again after remediation.

How do EDR, XDR, and user behavior analytics differ?

EDR detects, investigates, and responds to endpoint threats; XDR expands detection across endpoint, network, and cloud data; user behavior analytics builds normal-activity baselines and uses rules, pattern matching, and statistics to spot unusual behavior.

What is the main goal of Identity and Access Management (IAM)?

Give the right permissions to the right people or entities at the right time by managing digital identities, access control, authentication, authorization, governance, and lifecycle events.

When do provisioning and de-provisioning occur, and what do they manage?

They create or remove accounts during events such as hiring, transfers, promotions, and separation, managing identity attributes, groups, and permissions while limiting initial access.

How should IAM permissions be assigned?

Give each entity only the permissions needed for the job, commonly through groups, keep private user data separated, and avoid privileged operating-system access on normal user accounts.

What are resolution, validation, and verification or attestation in identity proofing?

Resolution determines who the system believes the user is; validation gathers information such as passwords or security questions; verification or attestation confirms identity through evidence such as a passport, in-person meeting, or automated verification.

What is Single Sign-On (SSO)?

A user authenticates once and gains access to assigned resources without repeated logins for a defined period, provided the underlying authentication infrastructure supports SSO.

What are LDAP and the X.500 Directory Information Tree?

LDAP is a lightweight protocol for reading and updating directory information over IP; X.500 directories use a hierarchy with container objects such as countries and organizations and leaf objects such as users, computers, printers, and files.

What is SAML?

Security Assertion Markup Language is an open standard for authentication and authorization that can let a user authenticate through a third party to gain access; the notes note that it was not originally designed for mobile apps.

What is the difference between OAuth and OpenID Connect?

OAuth is an authorization framework that determines what resources applications may access; it is not an authentication protocol, while OpenID Connect can provide the single sign-on authentication function.

What are federation and IAM interoperability?

Federation establishes trust so different organizations can authenticate and authorize partners, suppliers, customers, or other users; interoperability is the ability of different authentication technologies and APIs to work together in the environment.

What do authorization and least privilege mean in access control?

Authorization determines and enforces the rights a user may exercise, while least privilege limits users and applications to only the permissions required to accomplish their objective.

How do Mandatory Access Control (MAC) and Discretionary Access Control (DAC) differ?

MAC uses administrator-defined security labels and users cannot change access; DAC lets the owner of an object decide and modify who can access it, making it flexible but weaker.

How do role-based and rule-based access control differ?

RBAC grants rights according to organizational roles, often through groups; rule-based access uses system-enforced conditions associated with an object, such as time limits or allowed browser types.