CompTIA Security+ Exam SY0-701 Review

Appendix A: Mapping Course Content to CompTIA Security+

Achieving CompTIA Security+ certification requires candidates to pass Exam SY0-701. This document details where the exam objectives for Exam SY0-701 are covered within the course.

1.0 General Security Concepts

1.1 Compare and contrast various types of security controls.

  • Covered in Categories:

    • Technical

    • Managerial

    • Operational

    • Physical

  • Control types:

    • Preventive

    • Deterrent

    • Detective

    • Corrective

    • Compensating

    • Directive

1.2 Summarize fundamental security concepts.

  • Covered in:

    • Confidentiality, Integrity, and Availability (CIA)

    • Non-repudiation

    • Authentication, Authorization, and Accounting

    • Authenticating people

    • Authenticating systems

    • Authorization models

  • Additional concepts covered include:

    • Gap analysis

    • Zero Trust Control Plane

    • Adaptive identity

    • Threat scope reduction

    • Policy-driven access control

    • Policy Administrator

    • Policy Engine

    • Data Plane

    • Implicit trust zones

    • Subject/System Policy Enforcement Point

  • Physical security elements:

    • Bollards

    • Access control vestibule

    • Fencing

    • Video surveillance

    • Security guard presence

    • Access badge systems

    • Lighting and sensors (Infrared, Pressure, Microwave, Ultrasonic)

  • Deception and disruption technology:

    • Honeypot

    • Honeynet

    • Honeyfile

    • Honeytoken

1.3 Explain the importance of change management processes and the impact on security.

  • Covered in:

    • Business processes impacting security operation including:

    • Approval process

    • Ownership and stakeholders

    • Impact analysis

    • Test results and backout plans

    • Maintenance windows

    • Standard operating procedures

  • Technical implications:

    • Allow lists and deny lists

    • Restricted activities

    • Downtime (Service and application restarts)

    • Legacy applications and dependencies

  • Documentation considerations:

    • Updating diagrams, policies, and procedures

    • Version control practices

1.4 Explain the importance of using appropriate cryptographic solutions.

  • Covered in:

    • Public key infrastructure (PKI)

    • Public key

    • Private key

    • Key escrow

    • Types of encryption:

    • Full-disk

    • Partition

    • File

    • Volume

    • Database

    • Record

    • Transport/communication

    • Asymmetric

    • Symmetric

    • Key exchange algorithms

    • Key lengths

  • Tools for encryption:

    • Trusted Platform Module (TPM)

    • Hardware Security Module (HSM)

    • Key management systems

    • Secure enclave technology

  • Data obfuscation techniques:

    • Steganography

    • Tokenization

    • Data masking

  • Hashing techniques covered:

    • Salting

    • Digital signatures

    • Key stretching

    • Blockchain concepts

    • Open public ledger

  • Certificates:

    • Certificate authorities

    • Certificate revocation lists (CRLs)

    • Online Certificate Status Protocol (OCSP)

    • Self-signed

    • Third-party trust model

    • Certificate signing requests (CSR) generation

    • Wildcard certificates

2.0 Threats, Vulnerabilities, and Mitigations

2.1 Compare and contrast common threat actors and motivations.

  • Covered in:

    • Types of threat actors:

    • Nation-state

    • Unskilled attackers

    • Hacktivists

    • Insider threats

    • Organized crime

    • Shadow IT

    • Attributes of actors:

    • Internal vs. external

    • Resources and funding

    • Level of sophistication and capability

    • Motivations for attacks including:

    • Data exfiltration

    • Espionage

    • Service disruption

    • Blackmail

    • Financial gain

    • Philosophical/political beliefs

    • Ethical considerations

    • Revenge and disruption chaos

    • Warfare

2.2 Explain common threat vectors and attack surfaces.

  • Covered in:

    • Message-based threat vectors:

    • Email

    • Short Message Service (SMS)

    • Instant messaging (IM)

    • Image-based threat vectors

    • File-based threat vectors

    • Voice call threats

    • Removable device risks

  • Vulnerable software issues:

    • Client-based vs. agentless vulnerabilities

    • Unsupported systems and applications

  • Unsecure network issues:

    • Wireless, wired, and Bluetooth vulnerabilities

    • Open service ports

    • Default credentials challenges

    • Supply chain vulnerabilities:

    • Managed service providers (MSPs)

    • Vendors and suppliers

    • Human vectors/social engineering threats:

    • Phishing, vishing, smishing

    • Misinformation and impersonation tactics including:

      • Business Email Compromise (BEC)

      • Pretexting

      • Watering hole attacks

      • Brand impersonation

      • Typosquatting

2.3 Explain various types of vulnerabilities.

  • Covered in:

    • Application vulnerabilities including:

    • Memory injection

    • Buffer overflow

    • Race conditions

    • Time-of-check (TOC) vs. Time-of-use (TOU)

    • Malicious update processes

    • Operating system (OS)-based vulnerabilities

    • Web-based vulnerabilities including:

    • Structured Query Language injection (SQLi)

    • Cross-site scripting (XSS)

    • Hardware vulnerabilities including:

    • Firmware exploitation

    • End-of-life and legacy hardware risks

    • Virtualization vulnerabilities:

    • Virtual machine (VM) escape

    • Resource reuse issues

    • Cloud-specific vulnerabilities

    • Supply chain vulnerabilities in service and hardware

    • Cryptographic vulnerabilities

    • Misconfiguration issues

    • Mobile device vulnerabilities:

    • Side loading

    • Jailbreaking

    • Zero-day vulnerabilities

2.4 Given a scenario, analyze indicators of malicious activity.

  • Covered in:

    • Malware attacks

    • Types include ransomware, trojans, worms, spyware, bloatware, viruses, keyloggers, logic bombs, and rootkits

    • Physical threats

    • Network attacks:

    • Distributed Denial-of-Service (DDoS)

    • Amplified attacks

    • Reflected attacks (DNS)

    • Wireless and on-path attacks

    • Credential replay

    • Malicious code issues

    • Application attacks including injection methods, buffer overflows, replay tactics, privilege escalations, forgery, and directory traversal

    • Cryptographic attacks such as downgrades, collisions, birthday paradox

    • Password attacks including spraying and brute force techniques

  • Key indicators of malicious activity:

    • Account lockouts

    • Concurrent session usages

    • Blocked content

    • Impossible travel scenarios

    • Resource consumption indicators

    • Resource inaccessibility issues

    • Out-of-cycle logging

    • Published/documented log issues

    • Missing logs

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

  • Covered in:

    • Segmentation, access control, and application allow listing:

    • Access control lists (ACL) and permission settings

    • Isolation techniques

    • Patching processes

    • Encryption methods

    • Monitoring practices and least privilege principles

    • Configuration enforcement strategies

    • Decommissioning methodologies

    • Hardening techniques including:

    • Encryption

    • Installation of endpoint protection

    • Host-based firewalls and intrusion prevention systems (HIPS)

    • Disabling unnecessary ports/protocols and changing default passwords

    • Removal of unnecessary software

3.0 Security Architecture

3.1 Compare and contrast security implications of different architecture models.

  • Covered in:

    • Architecture and infrastructure concepts including:

    • Cloud responsibilities

    • Responsibility matrix, hybrid considerations, third-party vendor implications

    • Infrastructure as code (IaC)

    • Serverless and microservices approaches

    • Network infrastructure risks

    • Physical isolation (air-gapped models)

    • Logical segmentation and Software-Defined Networking (SDN)

    • On-premises considerations

    • Centralized vs. decentralized models

    • Containerization and virtualization implications

    • Internet of Things (IoT) and Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA) models

    • Real-time Operating System (RTOS) and embedded systems

    • High availability features

  • Security considerations for availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, recovery, patch availability, and inability to patch

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

  • Covered in:

    • Infrastructure considerations involving device placement, security zones, attack surface awareness, connectivity, and failure modes:

    • Fail-open and fail-closed mechanisms

    • Device attributes (active vs. passive, inline vs. tap/monitor)

    • Security appliances including:

    • Jump servers

    • Proxy servers

    • Intrusion prevention systems (IPS) and intrusion detection systems (IDS)

    • Load balancers

    • Security protocols including:

    • Port security and 802.1X

    • Extensible Authentication Protocol (EAP)

    • Firewall types (Web application firewalls, unified threat management systems, next-generation firewalls)

    • Layer 4 and Layer 7 considerations

3.3 Compare and contrast concepts and strategies to protect data.

  • Covered in:

    • Data types classification:

    • Regulated, trade secrets, intellectual property, legal information, financial information

    • Human-readable vs. non-human-readable

    • Data classifications:

    • Sensitive, confidential, public, restricted, private, critical

    • General data considerations:

    • Data states (at rest, in transit, in use)

    • Data sovereignty and geolocation issues

    • Methods to secure data:

    • Geographic restrictions, encryption methods, hashing, masking, tokenization, obfuscation, segmentation, permission restrictions

3.4 Explain the importance of resilience and recovery in security architecture.

  • Covered in:

    • High availability measures, considering load balancing vs. clustering

    • Site considerations including hot, cold, and warm site definitions

    • Geographic dispersion strategies

    • Platform diversity promoting resilience

    • Multi-cloud systems and continuity of operations approaches

    • Capacity planning for personnel, technology, and infrastructure

    • Testing methodologies involving tabletop exercises, failovers, and simulations

    • Backup strategies including on-site/off-site management, frequency of backups, encryption of backups, snapshots, recovery methodologies, replication, and journaling processes

    • Power management considerations including generators and uninterruptible power supplies (UPS)

4.0 Security Operations

4.1 Given a scenario, apply common security techniques to computing resources.

  • Covered in:

    • Secure baselines covering establishment, deployment, and maintenance

    • Hardening targets including mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS/SCADA, embedded systems, real-time operating systems, and IoT devices

    • Installation considerations for wireless devices and conducting site surveys and heat maps

    • Mobile solutions involving mobile device management (MDM), and deployment models for Bring Your Own Device (BYOD), Corporate-owned Personally Enabled (COPE), and Choose Your Own Device (CYOD)

    • Connection methods including cellular, Wi-Fi, and Bluetooth

    • Wireless security settings employing WPA3, AAA, and remote authentication using RADIUS, cryptographic protocols, and authentication protocols

    • Application security measures:

    • Input validation

    • Secure cookies

    • Static code analysis

    • Code signing

    • Sandboxing practices

    • Monitoring considerations

4.2 Explain the security implications of proper hardware, software, and data asset management.

  • Covered in:

    • Acquisition and procurement processes

    • Assignment and accounting of ownership and classification

    • Monitoring and asset tracking including inventory and enumeration techniques

    • Disposal processes, including sanitization, destruction, certification, and data retention policies

4.3 Explain various activities associated with vulnerability management.

  • Covered in:

    • Identification methods including vulnerability scans, application security checks, static analysis, dynamic analysis, package monitoring, threat feed engagement, open-source intelligence (OSINT) assessments, proprietary/third-party reliance, information-sharing organizations, and dark web monitoring

    • Penetration testing approaches including responsible disclosure programs and bug bounty programs

    • System/process audits for credibility

    • Analysis processes identifying confirmation status, false positives/negatives, prioritization methods through the Common Vulnerability Scoring System (CVSS), Common Vulnerability Enumeration (CVE), and vulnerability classification with exposure factor, environmental variables, and risk tolerance considerations

    • Vulnerability response and remediation tactics including patching, insurance decisions, segmentation, implementing compensating controls, and assessing exceptions and exemptions

    • Validation of remediation through rescanning, auditing, and verification protocols

    • Reporting metrics and considerations for transparency

4.4 Explain security alerting and monitoring concepts and tools.

  • Covered in:

    • Monitoring practices across computing resources, including systems, applications, and infrastructure

    • Key activities include log aggregation, alerting mechanisms, scanning protocols, reporting standards, archiving data, validating alerts, and quarantine procedures

    • Tuning alerts for effectiveness

    • Tools utilized for security include:

    • Security Content Automation Protocol (SCAP) standards

    • Benchmarks

    • Agents (both agent-based and agentless approaches)

    • Security Information and Event Management (SIEM) systems

    • Antivirus solutions

    • Data Loss Prevention (DLP) strategies

    • Simple Network Management Protocol (SNMP) traps

    • NetFlow and vulnerability scanners

4.5 Given a scenario, modify enterprise capabilities to enhance security.

  • Covered in:

    • Firewall rule configurations including access lists, ports, and protocols in screened subnets

    • IDS/IPS trends with signatures and anomaly detection

    • Web filtering techniques through agent-based and centralized proxy systems, including URL scanning and content categorization

    • Operating system security through Group Policy and SELinux modifications

    • Implementation of secure protocols emphasizing protocol and port selections alongside transport methods

    • DNS filtering, email security methods utilizing DMARC, DKIM, SPF specifications, and gateway management

    • File integrity monitoring and DLP strategies for data protection

    • Network access control (NAC) provisions and endpoint detection/response (EDR) practices

    • User behavior analytics for trend detection and anomalies

4.6 Given a scenario, implement and maintain identity and access management.

  • Covered in:

    • Provisioning/de-provisioning user accounts practices

    • Permission assignments and their implications

    • Identity proofing and federation processes, including standards like Single Sign-On (SSO) and protocols like Lightweight Directory Access Protocol (LDAP), Open Authorization (OAuth), and Security Assertions Markup Language (SAML)

    • Interoperability and attestation in identity management

    • Access control methods:

    • Mandatory, discretionary, role-based, rule-based, and attribute-based control models with time-of-day restrictions

    • Least privilege principles in access management

    • Multifactor authentication implementations covering biometrics, hard/soft authentication tokens, security keys, as well as methods assessing something known, possessed, or inherent

    • Password management techniques and best practices, including recommendations on length, complexity, reuse, expiration, age, and utilization of password managers

    • Privileged access management tools covering just-in-time permissions, password vaulting, and ephemeral credentials

4.7 Explain the importance of automation and orchestration related to secure operations.

  • Covered in:

    • Use cases involving automation and scripting for user provisioning, resource provisioning, guard rails, security groups, ticket creation, and escalation processes

    • Continuous integration and testing methodologies using integrations and Application Programming Interfaces (APIs)

    • Benefits derived from automation such as efficiency, time-saving, enforcement of baselines, standard infrastructure configurations, scaling securely, enhanced employee retention, and quicker reaction times

    • Other considerations involving complexity management, cost implications, single points of failure, technical debt concerns, and ongoing supportability requirements

4.8 Explain appropriate incident response activities.

  • Covered in:

    • Incident response processes covering preparation, detection, analysis, containment strategies, eradication methods, recovery actions, and lessons learned post-incident

    • Importance of training and regular testing including tabletop exercises and simulations

    • Conducting root cause analysis and proactive threat hunting approaches to improve security posture

4.9 Given a scenario, use data sources to support an investigation.

  • Covered in:

    • Usage of log data from sources like firewall logs, application logs, endpoint logs, OS-specific security logs, and IPS/IDS logs, alongside network logs and metadata provisions

    • Data sources integrated into investigations such as vulnerability scans, automated reports, dashboards, and packet captures

5.0 Security Program Management and Oversight

5.1 Summarize elements of effective security governance.

  • Covered in:

    • Guidelines governing policy creation such as acceptable use policies (AUP), information security policies, business continuity, disaster recovery plans, incident response strategies, software development lifecycle (SDLC) practices, and change management controls

    • Standards governing areas including password policies, access control measures, physical security considerations, and encryption practices

    • Procedures associated with change management, onboarding/offboarding processes, and playbooks for incident management

    • External considerations to governance including regulatory requirements at local, regional, national, and global levels

    • Importance of monitoring and revision in governance practices

    • Types of governance structures including boards, committees, and government entities, with emphasis on centralized versus decentralized models

    • Roles and responsibilities related to systems and data including owners, controllers, processors, custodians/stewards

5.2 Explain elements of the risk management process.

  • Covered in:

    • Risk identification processes as applied to various contexts

    • Risk assessment techniques including ad hoc, recurring, one-time, and continuous methods

    • Risk analysis methodologies encompassing qualitative and quantitative assessments, emphasizing Single Loss Expectancy (SLE), Annualized Loss Expectancy (ALE), Annualized Rate of Occurrence (ARO), probability assessments, and impact determination

    • Use of a risk register to record key risk indicators, owners, and thresholds

    • Risk tolerance definitions encompassing risk appetite aligned to expansionary, conservative, or neutral strategies

    • Risk management strategies including transfer, acceptance, exemptions, exceptions, avoidance, and mitigation processes

    • Risk reporting practices for transparency on risks to stakeholders

    • Business impact analysis components including Recovery Time Objective (RTO), Recovery Point Objective (RPO), Mean Time to Repair (MTTR), and Mean Time Between Failures (MTBF)

5.3 Explain the processes associated with third-party risk assessment and management.

  • Covered in:

    • Vendor assessment methodologies including penetration testing, right-to-audit clauses, and evidence gathering of internal audits

    • Independent assessments and supply chain analysis for third-party compliance and security

    • Vendor selection criteria ensuring due diligence and managing conflict of interest issues

    • Agreement types including Service-level Agreement (SLA), Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Master Service Agreement (MSA), Work Order (WO), and Business Partner Agreement (BPA)

    • Continuous vendor monitoring approaches for compliance and security

    • Utilization of questionnaires as part of third-party assessments

    • Rules of engagement for vendor interactions and security evaluations

5.4 Summarize elements of effective security compliance.

  • Covered in:

    • Compliance reporting methods including internal and external reporting mechanisms

    • Understanding consequences of non-compliance including fines, sanctions, reputational damage, loss of licenses, and contractual impacts

    • Compliance monitoring strategies including due diligence, care, attestation, and automation approaches

    • Privacy implications with legal considerations at local, regional, national, and global levels relating to data subjects, controllers, and processors

    • Data inventory, retention policies, and the right to be forgotten practices

5.5 Explain types and purposes of audits and assessments.

  • Covered in:

    • Attestation as a form of evaluation for internal compliance, including audit committees and self-assessment processes

    • External regulatory examinations and assessments, including independent third-party audits

    • Penetration testing methodologies including physical, offensive, defensive, integrated approaches, and environmental considerations

    • Defining known, partially known, and unknown environments for testing

    • Tactics for reconnaissance and testing, utilizing passive and active approaches

5.6 Given a scenario, implement security awareness practices.

  • Covered in:

    • Phishing campaigns and methods for recognizing phishing attempts

    • Responding to reported suspicious messages and anomalous behaviors

    • User guidance and training including policy handbooks, situational awareness, insider threat awareness, password management, removable media controls, social engineering tactics, and operational security practices for hybrid and remote work environments

    • Reporting and monitoring of security awareness practices including initial and recurring evaluations

    • Incorporating development and execution strategies for security awareness programs