CompTIA Security+ SY0-801 Prep path
CompTIA Security+® SY0-801 objectives, line by line
Every one of the 845 line items in CompTIA's official SY0-801 exam objectives (version 2.0), with the book, chapter and section of the FiftyPage Security+ course that teaches it, and where to go deeper. Use it to plan your study, check your coverage, or jump straight to a topic you missed on a practice exam.
1.0 General Security Concepts (16% of the exam)
1.1 Explain security concepts and controls.
- Defense in depthSecurity Fundamentals, Chapter 3: Defense in depthAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 4: 1.1 Security principles
- Confidentiality, integrity, and availability (CIA)Security Fundamentals, Chapter 1: Three goals: the CIA triadAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 4: 1.1 Security principles
- Authentication, authorization, accounting (AAA)Security Fundamentals, Chapter 1: AAA: authentication, authorization, accountingAlso: Security Fundamentals, Chapter 1: Worked example: reading AAA in a log
- Non-repudiationSecurity Fundamentals, Chapter 1: Non-repudiation: you can't deny itAlso: Cryptography and PKI, Chapter 7: The reverse direction
- Zero Trust principlesSecurity Fundamentals, Chapter 3: Zero trustAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 4: 1.1 Security principles
- Least privilegeSecurity Fundamentals, Chapter 3: Least privilegeAlso: Security Fundamentals, Chapter 3: A narrow admin right
- Control categoriesSecurity Fundamentals, Chapter 2: Four categories: how a control worksAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 4: 1.1 Control categories and types
- Technical/logicalSecurity Fundamentals, Chapter 2: Four categories: how a control works
- Managerial/administrativeSecurity Fundamentals, Chapter 2: Four categories: how a control works
- Physical/environmentalSecurity Fundamentals, Chapter 2: Four categories: how a control works
- OperationalSecurity Fundamentals, Chapter 2: Four categories: how a control works
- Control typesSecurity Fundamentals, Chapter 2: Six types: what a control doesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 4: 1.1 Control categories and types
- PreventiveSecurity Fundamentals, Chapter 2: Six types: what a control does
- DeterringSecurity Fundamentals, Chapter 2: Six types: what a control does
- CorrectiveSecurity Fundamentals, Chapter 2: Six types: what a control does
- DetectiveSecurity Fundamentals, Chapter 2: Six types: what a control does
- CompensatingSecurity Fundamentals, Chapter 2: Six types: what a control doesAlso: Security Fundamentals, Chapter 2: Worked example: the sorting drill
- DirectiveSecurity Fundamentals, Chapter 2: Six types: what a control does
1.2 Given a scenario, demonstrate the impact of change management processes on security.
- Business processes impacting security operationsVulnerability, Asset and Change Management, Chapter 10: Why fixes need a processAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 4: 1.2 Change management
- Change advisory board (CAB)Vulnerability, Asset and Change Management, Chapter 10: The people
- Approval processVulnerability, Asset and Change Management, Chapter 10: The people
- OwnershipVulnerability, Asset and Change Management, Chapter 10: The people
- StakeholdersVulnerability, Asset and Change Management, Chapter 10: The people
- Impact analysisVulnerability, Asset and Change Management, Chapter 10: Impact analysis and dependencies
- Test resultsVulnerability, Asset and Change Management, Chapter 10: Test results, downtime and restarts
- Backout planningVulnerability, Asset and Change Management, Chapter 10: Backout or fail forward
- Fail forwardVulnerability, Asset and Change Management, Chapter 10: Backout or fail forward
- Maintenance windowVulnerability, Asset and Change Management, Chapter 10: Maintenance windows
- Standard operating procedures (SOPs)Vulnerability, Asset and Change Management, Chapter 10: The people
- Technical implicationsVulnerability, Asset and Change Management, Chapter 10: Staying inside the change
- Allow lists/deny listsVulnerability, Asset and Change Management, Chapter 10: Staying inside the changeAlso: Endpoint and Application Security, Chapter 6: Deny lists and allow lists
- Restricted activitiesVulnerability, Asset and Change Management, Chapter 10: Staying inside the change
- DowntimeVulnerability, Asset and Change Management, Chapter 10: Test results, downtime and restarts
- Service restartVulnerability, Asset and Change Management, Chapter 10: Test results, downtime and restarts
- Application restartVulnerability, Asset and Change Management, Chapter 10: Test results, downtime and restarts
- Legacy applicationsVulnerability, Asset and Change Management, Chapter 10: Impact analysis and dependencies
- DependenciesVulnerability, Asset and Change Management, Chapter 10: Impact analysis and dependencies
- DocumentationVulnerability, Asset and Change Management, Chapter 10: After the change: diagrams and records
- Updating diagramsVulnerability, Asset and Change Management, Chapter 10: After the change: diagrams and records
- Updating policies/proceduresGovernance, Risk and Compliance, Chapter 1: The life of a documentAlso: Vulnerability, Asset and Change Management, Chapter 10: After the change: diagrams and records
- Version controlVulnerability, Asset and Change Management, Chapter 10: Version control for configuration
1.3 Explain the importance of using appropriate cryptographic solutions.
- Public key infrastructure (PKI)Cryptography and PKI, Chapter 8: The missing piece: whose key is this?Also: Cryptography and PKI, Chapter 9: The certificate lifecycle; CompTIA Security+ SY0-801 Exam Prep, Chapter 4: 1.3 Cryptography
- Public keyCryptography and PKI, Chapter 5: Two keys that belong togetherAlso: Cryptography and PKI, Chapter 5: Encrypting for someone: use their public key
- Private keyCryptography and PKI, Chapter 5: Two keys that belong togetherAlso: Cryptography and PKI, Chapter 5: RSA by hand with openssl
- Key escrowCryptography and PKI, Chapter 9: Key escrow
- CertificatesCryptography and PKI, Chapter 8: What is in a certificate (X.509)
- Certificate authoritiesCryptography and PKI, Chapter 8: Certificate authorities and the chain of trustAlso: Cryptography and PKI, Chapter 13: Step 2: the root CA
- Certificate revocation lists (CRLs)Cryptography and PKI, Chapter 9: Revocation: killing a certificate earlyAlso: Cryptography and PKI, Chapter 13: Step 5: revoke a certificate
- Online Certificate Status Protocol (OCSP)Cryptography and PKI, Chapter 9: OCSP: checking one certificate live
- Self-signedCryptography and PKI, Chapter 8: Self-signed certificates
- Third-partyCryptography and PKI, Chapter 8: Certificate authorities and the chain of trust
- Root of trustCryptography and PKI, Chapter 8: Certificate authorities and the chain of trustAlso: Cryptography and PKI, Chapter 11: Where keys live: TPM, HSM and key managers
- Certificate signing request (CSR) generationCryptography and PKI, Chapter 9: The CSR: asking for a certificateAlso: Cryptography and PKI, Chapter 13: Step 4: issue the intranet certificate
- WildcardCryptography and PKI, Chapter 8: Wildcard certificates
- EncryptionCryptography and PKI, Chapter 1: Two families of encryptionAlso: Cryptography and PKI, Chapter 1: The four parts
- ProtocolsCryptography and PKI, Chapter 10: TLS ties it all togetherAlso: Cryptography and PKI, Chapter 10: The TLS 1.3 handshake
- SymmetricCryptography and PKI, Chapter 4: One key, both waysAlso: Cryptography and PKI, Chapter 4: AES, the standard symmetric cipher
- AsymmetricCryptography and PKI, Chapter 5: Two keys that belong togetherAlso: Cryptography and PKI, Chapter 5: Why you don't encrypt big files with RSA
- LevelCryptography and PKI, Chapter 11: The levels, outside inAlso: Cryptography and PKI, Chapter 11: Choosing the level
- Full diskCryptography and PKI, Chapter 11: The levels, outside in
- PartitionCryptography and PKI, Chapter 11: The levels, outside in
- FileCryptography and PKI, Chapter 11: The levels, outside in
- VolumeCryptography and PKI, Chapter 11: The levels, outside in
- DatabaseCryptography and PKI, Chapter 11: The levels, outside inAlso: Cryptography and PKI, Chapter 11: Worked example: protecting the order database three ways
- RecordCryptography and PKI, Chapter 11: Record-level encryption in PythonAlso: Cryptography and PKI, Chapter 11: The levels, outside in
- Transport/communicationCryptography and PKI, Chapter 10: TLS ties it all togetherAlso: Cryptography and PKI, Chapter 10: Watching a real handshake
- Key exchangeCryptography and PKI, Chapter 6: Agreeing a secret in publicAlso: Cryptography and PKI, Chapter 6: Ephemeral keys and forward secrecy
- AlgorithmsCryptography and PKI, Chapter 4: AES, the standard symmetric cipherAlso: Cryptography and PKI, Chapter 5: ECC: the same security with much shorter keys; Cryptography and PKI, Chapter 14: Choosing a cryptographic tool
- Key lengthCryptography and PKI, Chapter 4: Why key length makes brute force hopelessAlso: Cryptography and PKI, Chapter 5: How long should a key be?; Cryptography and PKI, Chapter 14: Key length guide (as of October 2026)
- Digital signaturesCryptography and PKI, Chapter 7: How signing actually worksAlso: Cryptography and PKI, Chapter 7: Sign and verify with openssl
- SaltingCryptography and PKI, Chapter 3: Salting: a unique twist per passwordAlso: Cryptography and PKI, Chapter 3: Watch a weak password fall
- ToolsCryptography and PKI, Chapter 14: Choosing a cryptographic toolAlso: Cryptography and PKI, Chapter 11: Where keys live: TPM, HSM and key managers; Cryptography and PKI, Chapter 14: openssl commands used in this book
- ObfuscationCryptography and PKI, Chapter 1: Encryption is not encoding
- Hashing algorithmsCryptography and PKI, Chapter 2: What a hash isAlso: Cryptography and PKI, Chapter 2: Why MD5 and SHA-1 are retired
2.0 Threats, Vulnerabilities, and Mitigations (24% of the exam)
2.1 Explain characteristics of threats and vulnerabilities.
- ThreatsSecurity Fundamentals, Chapter 4: Threats, actors and why they matterAlso: Security Fundamentals, Chapter 5: What threat intelligence is; CompTIA Security+ SY0-801 Exam Prep, Chapter 5: 2.1 and 2.2 Threats and actors
- Threat feedsSecurity Fundamentals, Chapter 5: Intelligence sourcesAlso: Security Fundamentals, Chapter 5: STIX and TAXII; Security Fundamentals, Chapter 5: Reading the feed with jq
- LikelihoodSecurity Fundamentals, Chapter 5: Likelihood and impactAlso: Security Fundamentals, Chapter 5: Ranking the risks
- ImpactSecurity Fundamentals, Chapter 5: Likelihood and impactAlso: Security Fundamentals, Chapter 5: Ranking the risks
- Intelligence sourcesSecurity Fundamentals, Chapter 5: Intelligence sourcesAlso: Security Fundamentals, Chapter 5: What threat intelligence is
- Life cycleSecurity Fundamentals, Chapter 5: What threat intelligence is
- VulnerabilitiesSecurity Fundamentals, Chapter 6: Vulnerabilities need namesAlso: Security Fundamentals, Chapter 6: CVSS: rating severity
- ScoringSecurity Fundamentals, Chapter 6: CVSS: rating severityAlso: Security Fundamentals, Chapter 6: Severity is not priority
- Common Vulnerability Scoring System (CVSS)Security Fundamentals, Chapter 6: CVSS: rating severityAlso: Security Fundamentals, Chapter 6: Scoring a vector; Security Fundamentals, Chapter 6: CVSS 4.0
- PrioritizationSecurity Fundamentals, Chapter 6: Severity is not priorityAlso: Vulnerability, Asset and Change Management, Chapter 9: Ranking with context; Vulnerability, Asset and Change Management, Chapter 9: A ranking script
- Vulnerability typesVulnerability, Asset and Change Management, Chapter 4: Bugs that become vulnerabilitiesAlso: Vulnerability, Asset and Change Management, Chapter 3: Four ways a system falls behind
- Common Vulnerabilities and Exposures (CVE)Security Fundamentals, Chapter 6: Reading a CVE recordAlso: Security Fundamentals, Chapter 6: Vulnerabilities need names
2.2 Describe common threat actors and motivations.
- Threat actorsSecurity Fundamentals, Chapter 4: The seven actorsAlso: Security Fundamentals, Chapter 4: Threats, actors and why they matter
- Crime syndicate/organized crimeSecurity Fundamentals, Chapter 4: The seven actorsAlso: Security Fundamentals, Chapter 11: MITRE ATT&CK
- TerroristSecurity Fundamentals, Chapter 4: The seven actors
- Unskilled attackerSecurity Fundamentals, Chapter 4: The seven actors
- HacktivistSecurity Fundamentals, Chapter 4: The seven actors
- InsiderSecurity Fundamentals, Chapter 4: The seven actors
- Accidental/unintentionalSecurity Fundamentals, Chapter 4: The seven actors
- CompetitorSecurity Fundamentals, Chapter 4: The seven actors
- State-sponsoredSecurity Fundamentals, Chapter 4: The seven actorsAlso: Security Fundamentals, Chapter 4: Real groups in MITRE's data
- MotivationsSecurity Fundamentals, Chapter 4: MotivationsAlso: Security Fundamentals, Chapter 4: Threats, actors and why they matter
- FinancialSecurity Fundamentals, Chapter 4: Motivations
- InfluenceSecurity Fundamentals, Chapter 4: Motivations
- Intellectual propertySecurity Fundamentals, Chapter 4: MotivationsAlso: Security Fundamentals, Chapter 4: The seven actors
- NotorietySecurity Fundamentals, Chapter 4: Motivations
- EspionageSecurity Fundamentals, Chapter 4: Motivations
- Fear/chaosSecurity Fundamentals, Chapter 4: MotivationsAlso: Security Fundamentals, Chapter 4: The seven actors
- ExtortionSecurity Fundamentals, Chapter 4: Motivations
- General curiositySecurity Fundamentals, Chapter 4: Motivations
- RevengeSecurity Fundamentals, Chapter 4: Motivations
- IdeologicalSecurity Fundamentals, Chapter 4: Motivations
- PoliticalSecurity Fundamentals, Chapter 4: Motivations
- EthicalSecurity Fundamentals, Chapter 4: Motivations
- Attributes of actorsSecurity Fundamentals, Chapter 4: Threats, actors and why they matter
- Internal/externalSecurity Fundamentals, Chapter 4: Threats, actors and why they matterAlso: Security Fundamentals, Chapter 4: The seven actors
- Resources/fundingSecurity Fundamentals, Chapter 4: Threats, actors and why they matterAlso: Security Fundamentals, Chapter 4: The seven actors; Security Fundamentals, Chapter 4: Real groups in MITRE's data
- Level of sophistication/capabilitySecurity Fundamentals, Chapter 4: Threats, actors and why they matterAlso: Security Fundamentals, Chapter 4: The seven actors
2.3 Describe threat vectors and sources.
- Advanced persistent threat (APT)Security Fundamentals, Chapter 9: APTsAlso: Security Fundamentals, Chapter 11: The Cyber Kill Chain; Security Fundamentals, Chapter 11: MITRE ATT&CK
- Message-basedSecurity Fundamentals, Chapter 7: Message vectorsAlso: Security Fundamentals, Chapter 7: Vectors and the attack surface
- EmailSecurity Fundamentals, Chapter 7: Message vectorsAlso: Attacks and Indicators, Chapter 4: The phishing family; Attacks and Indicators, Chapter 4: Taking a phishing email apart
- Short Message Service (SMS)Security Fundamentals, Chapter 7: Message vectorsAlso: Attacks and Indicators, Chapter 4: The phishing family
- Rich Communication Services (RCS)Security Fundamentals, Chapter 7: Message vectors
- Instant messagingSecurity Fundamentals, Chapter 7: Message vectors
- Collaboration toolsSecurity Fundamentals, Chapter 7: Message vectors
- Image-basedSecurity Fundamentals, Chapter 7: QR codes
- Quick response (QR) codesSecurity Fundamentals, Chapter 7: QR codesAlso: Attacks and Indicators, Chapter 4: The phishing family
- Embedded contentSecurity Fundamentals, Chapter 7: QR codes
- Completely Automated Public Turing test to tell Computers and Humans Apart(CAPTCHA)Security Fundamentals, Chapter 8: CAPTCHA
- Attachment-basedSecurity Fundamentals, Chapter 7: MacrosAlso: Security Fundamentals, Chapter 7: RTF and PDF; Security Fundamentals, Chapter 7: File extensions
- Embedded macrosSecurity Fundamentals, Chapter 7: Macros
- Rich Text Format (RTF) documentsSecurity Fundamentals, Chapter 7: RTF and PDF
- Portable Document Formats (PDFs)Security Fundamentals, Chapter 7: RTF and PDF
- Browser-basedSecurity Fundamentals, Chapter 8: Sessions: logging in onceAlso: Security Fundamentals, Chapter 8: Passwords as a vector
- ExtensionsAttacks and Indicators, Chapter 3: Spyware, adware and keyloggers
- JavaScriptAttacks and Indicators, Chapter 8: Cross-site scripting (XSS)Also: Security Fundamentals, Chapter 7: RTF and PDF
- Password managersSecurity Fundamentals, Chapter 8: Passwords as a vector
- CookiesSecurity Fundamentals, Chapter 8: Sessions: logging in onceAlso: Security Fundamentals, Chapter 8: Worked example: hijacking Priya's session
- Session tokensSecurity Fundamentals, Chapter 8: Sessions: logging in onceAlso: Security Fundamentals, Chapter 8: Worked example: hijacking Priya's session
- Network-basedSecurity Fundamentals, Chapter 9: What can the internet reach?Also: Network Security, Chapter 1: Attack surface
- Infrastructure devicesNetwork Security, Chapter 1: Attack surfaceAlso: Network Security, Chapter 1: Device placement
- Virtualized devicesVirtualization and Cloud Basics, Chapter 1: Gains and risksAlso: Virtualization and Cloud Basics, Chapter 1: What the hypervisor shares out
- Session keysSecurity Fundamentals, Chapter 8: Session keysAlso: Security Fundamentals, Chapter 8: A café Wi-Fi lab
- Remote accessSecurity Fundamentals, Chapter 9: Remote access as a vector
- Remote desktopSecurity Fundamentals, Chapter 9: Remote access as a vector
- Virtual Network Computing (VNC)Security Fundamentals, Chapter 9: Remote access as a vector
- Virtual private network (VPN)Security Fundamentals, Chapter 9: Remote access as a vectorAlso: Network Security, Chapter 1: Measuring the surface with nmap
- Endpoint-basedEndpoint and Application Security, Chapter 1: Endpoints and their attack surface
- Mobile devicesEndpoint and Application Security, Chapter 7: Phones are endpoints tooAlso: Endpoint and Application Security, Chapter 7: Who owns the phone
- WorkstationsEndpoint and Application Security, Chapter 1: Endpoints and their attack surfaceAlso: Endpoint and Application Security, Chapter 1: Windows and macOS laptops
- ServersEndpoint and Application Security, Chapter 1: What the server exposesAlso: Endpoint and Application Security, Chapter 1: Endpoints and their attack surface
- TabletsEndpoint and Application Security, Chapter 7: Phones are endpoints too
- Trusted devicesEndpoint and Application Security, Chapter 7: Checking complianceAlso: Endpoint and Application Security, Chapter 7: Enrollment
- Built-in toolsSecurity Fundamentals, Chapter 9: Living off the land
- Living-off-the-land toolsSecurity Fundamentals, Chapter 9: Living off the landAlso: Attacks and Indicators, Chapter 3: Fileless malware
- Supply chain-basedSecurity Fundamentals, Chapter 9: Trusted partners: the supply chainAlso: Security Fundamentals, Chapter 9: Checking a supplier's download
- Third-party providersSecurity Fundamentals, Chapter 9: Trusted partners: the supply chain
- Managed service providersSecurity Fundamentals, Chapter 9: Trusted partners: the supply chainAlso: Security Fundamentals, Chapter 9: Checking a supplier's download
- Logistic providersSecurity Fundamentals, Chapter 9: Trusted partners: the supply chain
- Software as a service (SaaS) providersSecurity Fundamentals, Chapter 9: Trusted partners: the supply chainAlso: Virtualization and Cloud Basics, Chapter 5: The service models
- External media-basedSecurity Fundamentals, Chapter 10: Malicious USB devicesAlso: Attacks and Indicators, Chapter 11: Removable media, situational awareness and OPSEC
- Malicious Universal Serial Bus (USB)Security Fundamentals, Chapter 10: Malicious USB devices
- Human-basedSecurity Fundamentals, Chapter 10: Impersonation
- ImpersonationSecurity Fundamentals, Chapter 10: ImpersonationAlso: Attacks and Indicators, Chapter 4: Business email compromise
- ContractorSecurity Fundamentals, Chapter 4: The seven actors
- VisitorSecurity Fundamentals, Chapter 10: Impersonation
- BiometricIdentity and Access Management, Chapter 3: Biometrics
- Watering holeSecurity Fundamentals, Chapter 10: Watering holes
- Internet of Things (IoT)-basedSecurity Fundamentals, Chapter 10: IoT and OT devices
- CamerasSecurity Fundamentals, Chapter 10: IoT and OT devices
- SensorsSecurity Fundamentals, Chapter 10: IoT and OT devices
- PrintersSecurity Fundamentals, Chapter 10: IoT and OT devices
- Operational technology (OT)-basedSecurity Fundamentals, Chapter 10: IoT and OT devices
- Physical-basedSecurity Fundamentals, Chapter 10: Access vestibulesAlso: Security Fundamentals, Chapter 10: Impersonation
- Lock and keySecurity Fundamentals, Chapter 10: Access vestibules
- Access vestibuleSecurity Fundamentals, Chapter 10: Access vestibules
- Access passesSecurity Fundamentals, Chapter 10: Access vestibules
- Signal-basedSecurity Fundamentals, Chapter 10: Bluetooth and NFCAlso: Network Security, Chapter 11: Radio doesn't stop at the wall
- BluetoothSecurity Fundamentals, Chapter 10: Bluetooth and NFC
- Radio frequency (RF)Security Fundamentals, Chapter 10: Bluetooth and NFC
- Near-field communications (NFC)Security Fundamentals, Chapter 10: Bluetooth and NFC
2.4 Explain types of vulnerabilities and attack surfaces.
- Unsupported productsVulnerability, Asset and Change Management, Chapter 3: Unsupported systemsAlso: Vulnerability, Asset and Change Management, Chapter 3: Four ways a system falls behind
- Unpatched systemsVulnerability, Asset and Change Management, Chapter 3: Unpatched systemsAlso: Vulnerability, Asset and Change Management, Chapter 3: Four ways a system falls behind
- Obsolete systemsVulnerability, Asset and Change Management, Chapter 3: Obsolete and unmanaged systems
- Unmanaged systemsVulnerability, Asset and Change Management, Chapter 3: Obsolete and unmanaged systemsAlso: Vulnerability, Asset and Change Management, Chapter 1: Asset tracking
- Ports and servicesNetwork Security, Chapter 1: Measuring the surface with nmapAlso: Endpoint and Application Security, Chapter 1: What the server exposes; Network Security, Chapter 1: Attack surface
- ApplicationsVulnerability, Asset and Change Management, Chapter 4: Bugs that become vulnerabilitiesAlso: Vulnerability, Asset and Change Management, Chapter 8: Source code review
- Race conditionsVulnerability, Asset and Change Management, Chapter 4: Race conditions
- Time-of-check (TOC)Vulnerability, Asset and Change Management, Chapter 4: Time-of-check to time-of-use
- Time-of-use (TOU)Vulnerability, Asset and Change Management, Chapter 4: Time-of-check to time-of-use
- Malicious updateVulnerability, Asset and Change Management, Chapter 4: Malicious updatesAlso: Security Fundamentals, Chapter 9: Checking a supplier's download
- CodeVulnerability, Asset and Change Management, Chapter 4: Bugs that become vulnerabilitiesAlso: Vulnerability, Asset and Change Management, Chapter 8: Source code review
- Hardcoded secretsVulnerability, Asset and Change Management, Chapter 4: Hardcoded secretsAlso: Cryptography and PKI, Chapter 12: Keys and secrets left in code
- Unsafe exception handlingVulnerability, Asset and Change Management, Chapter 4: Exception handling
- Operating system (OS)-basedVulnerability, Asset and Change Management, Chapter 3: Unpatched systemsAlso: Endpoint and Application Security, Chapter 1: A secure baseline
- VirtualizationVirtualization and Cloud Basics, Chapter 1: Gains and risksAlso: Virtualization and Cloud Basics, Chapter 5: Shared responsibility
- Zero-dayVulnerability, Asset and Change Management, Chapter 4: Zero-days
- Cryptographic vulnerabilitiesCryptography and PKI, Chapter 12: Good crypto, used badlyAlso: Cryptography and PKI, Chapter 12: Retired algorithms; Cryptography and PKI, Chapter 12: Expired and mismanaged certificates
- Unmanaged/stale credentialsIdentity and Access Management, Chapter 1: Stale credentialsAlso: Identity and Access Management, Chapter 1: Deprovisioning: the leaver
- Rogue devicesVulnerability, Asset and Change Management, Chapter 2: Rogue devicesAlso: Vulnerability, Asset and Change Management, Chapter 2: Discovery with nmap
- Shadow ITVulnerability, Asset and Change Management, Chapter 3: Shadow IT
- Wireless and low-powered communicationsNetwork Security, Chapter 11: Radio doesn't stop at the wallAlso: Security Fundamentals, Chapter 10: Bluetooth and NFC
- Large language models (LLMs)Vulnerability, Asset and Change Management, Chapter 5: Large language modelsAlso: Security Monitoring and Automation, Chapter 11: AI tools are attack surface
- Identity providersVulnerability, Asset and Change Management, Chapter 5: Identity providers
- Mobile devicesEndpoint and Application Security, Chapter 7: Phones are endpoints tooAlso: Endpoint and Application Security, Chapter 7: Checking compliance
- MisconfigurationVulnerability, Asset and Change Management, Chapter 3: MisconfigurationAlso: Vulnerability, Asset and Change Management, Chapter 8: Cloud security posture management
- Public repositoriesVulnerability, Asset and Change Management, Chapter 5: Public repositories
- Public object storageVulnerability, Asset and Change Management, Chapter 5: Object storageAlso: Vulnerability, Asset and Change Management, Chapter 8: Checking cloud settings as code
2.5 Given a scenario, analyze indicators of malicious activity.
- Malware attacksAttacks and Indicators, Chapter 2: Malware and how it gets in
- RansomwareAttacks and Indicators, Chapter 2: RansomwareAlso: Attacks and Indicators, Chapter 2: Worked example: the Friday invoice
- TrojanAttacks and Indicators, Chapter 2: Trojans
- WormAttacks and Indicators, Chapter 2: Worms
- SpywareAttacks and Indicators, Chapter 3: Spyware, adware and keyloggers
- AdwareAttacks and Indicators, Chapter 3: Spyware, adware and keyloggers
- VirusAttacks and Indicators, Chapter 2: VirusesAlso: Attacks and Indicators, Chapter 2: Checking files against known-bad hashes
- RootkitAttacks and Indicators, Chapter 3: Rootkits
- KeyloggerAttacks and Indicators, Chapter 3: Spyware, adware and keyloggers
- Logic bombAttacks and Indicators, Chapter 3: Logic bombs
- Fileless malwareAttacks and Indicators, Chapter 3: Fileless malwareAlso: Attacks and Indicators, Chapter 3: Worked example: a slow laptop at the front desk
- Physical attacksAttacks and Indicators, Chapter 5: When the attacker is in the room
- TailgatingAttacks and Indicators, Chapter 5: TailgatingAlso: Security Fundamentals, Chapter 10: Access vestibules
- Shoulder surfingAttacks and Indicators, Chapter 5: Shoulder surfing
- SkimmingAttacks and Indicators, Chapter 5: Skimming
- Forced entryAttacks and Indicators, Chapter 5: When the attacker is in the room
- Network attacksAttacks and Indicators, Chapter 6: SniffingAlso: Attacks and Indicators, Chapter 6: Spoofing
- Distributed denial of service (DDoS)Attacks and Indicators, Chapter 7: Denial of serviceAlso: Attacks and Indicators, Chapter 7: Reflection and amplification; Attacks and Indicators, Chapter 7: Worked example: the shop goes slow on launch day
- Protocol downgradeAttacks and Indicators, Chapter 7: Downgrade attacks
- RogueNetwork Security, Chapter 11: Radio doesn't stop at the wallAlso: Vulnerability, Asset and Change Management, Chapter 2: Rogue devices
- SniffingAttacks and Indicators, Chapter 6: Sniffing
- SpoofingAttacks and Indicators, Chapter 6: Spoofing
- On-pathAttacks and Indicators, Chapter 6: On-path attacks and ARP poisoning
- Domain Name System (DNS) attacksAttacks and Indicators, Chapter 6: Fake DNS answers and cache poisoning
- Cache poisoningAttacks and Indicators, Chapter 6: Fake DNS answers and cache poisoning
- Social engineering attacksAttacks and Indicators, Chapter 4: Attacking the person, not the computerAlso: Attacks and Indicators, Chapter 4: The phishing family
- SmishingAttacks and Indicators, Chapter 4: The phishing family
- VishingAttacks and Indicators, Chapter 4: The phishing family
- PhishingAttacks and Indicators, Chapter 4: The phishing familyAlso: Attacks and Indicators, Chapter 4: Taking a phishing email apart; Attacks and Indicators, Chapter 4: Worked example: the café's new bank account
- WhalingAttacks and Indicators, Chapter 4: The phishing family
- Spear phishingAttacks and Indicators, Chapter 4: The phishing family
- QuishingAttacks and Indicators, Chapter 4: The phishing familyAlso: Security Fundamentals, Chapter 7: QR codes
- ImpersonationSecurity Fundamentals, Chapter 10: ImpersonationAlso: Attacks and Indicators, Chapter 4: Business email compromise
- DeepfakeAttacks and Indicators, Chapter 4: Deepfakes
- Indicators of compromiseAttacks and Indicators, Chapter 1: Every attack leaves tracesAlso: Attacks and Indicators, Chapter 1: Four places to look; Attacks and Indicators, Chapter 10: A method, not a hunch
- HashAttacks and Indicators, Chapter 2: Checking files against known-bad hashesAlso: Security Fundamentals, Chapter 5: What threat intelligence is
- Internet Protocol (IP) addressSecurity Fundamentals, Chapter 5: What threat intelligence isAlso: Security Fundamentals, Chapter 5: Reading the feed with jq; Attacks and Indicators, Chapter 6: The traces they leave
- DomainSecurity Fundamentals, Chapter 5: What threat intelligence isAlso: Security Fundamentals, Chapter 5: Reading the feed with jq
- Malicious processesAttacks and Indicators, Chapter 1: Four places to lookAlso: Incident Response and Resilience, Chapter 4: Eradication: remove the cause; Attacks and Indicators, Chapter 3: Worked example: a slow laptop at the front desk
- File system artifactsAttacks and Indicators, Chapter 1: Four places to lookAlso: Attacks and Indicators, Chapter 2: Ransomware
- TimestampAttacks and Indicators, Chapter 1: Four places to look
- Log manipulationAttacks and Indicators, Chapter 1: A clue, not proofAlso: Attacks and Indicators, Chapter 10: A method, not a hunch
- Excessive resource consumptionAttacks and Indicators, Chapter 1: Four places to lookAlso: Attacks and Indicators, Chapter 1: A clue, not proof
- Plaintext stringsAttacks and Indicators, Chapter 1: Four places to look
- Account lockoutAttacks and Indicators, Chapter 1: A clue, not proofAlso: Attacks and Indicators, Chapter 9: Brute force
- Impossible travelAttacks and Indicators, Chapter 1: Impossible travelAlso: Attacks and Indicators, Chapter 1: Worked example: Monday's sign-in review
- Concurrent sessionsAttacks and Indicators, Chapter 1: Concurrent sessionsAlso: Attacks and Indicators, Chapter 1: Worked example: Monday's sign-in review
- Application attacksAttacks and Indicators, Chapter 8: When input becomes code
- InjectionAttacks and Indicators, Chapter 8: SQL injectionAlso: Attacks and Indicators, Chapter 8: Command injection; Attacks and Indicators, Chapter 8: Cross-site scripting (XSS)
- Buffer overflowAttacks and Indicators, Chapter 8: Buffer overflows
- ReplayAttacks and Indicators, Chapter 7: Replay attacks
- Privilege escalationAttacks and Indicators, Chapter 8: Privilege escalation
- ForgeryAttacks and Indicators, Chapter 8: Request forgery
- Directory traversalAttacks and Indicators, Chapter 8: Directory traversalAlso: Attacks and Indicators, Chapter 8: The traces in the access log
- Credential attacksAttacks and Indicators, Chapter 9: Guessing online
- Password sprayingAttacks and Indicators, Chapter 9: Password sprayingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 5: Practice: spraying or brute force?; Attacks and Indicators, Chapter 10: Steps 4 and 5: pivot and timeline
- Brute forceAttacks and Indicators, Chapter 9: Brute forceAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 5: Practice: spraying or brute force?
- User enumerationAttacks and Indicators, Chapter 9: User enumeration
- ReplayAttacks and Indicators, Chapter 7: Replay attacks
- Multifactor authentication (MFA) bypassAttacks and Indicators, Chapter 9: Getting around MFAAlso: Attacks and Indicators, Chapter 9: Worked example: Priya's 2 a.m. phone
2.6 Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage.
- Model manipulationSecurity Monitoring and Automation, Chapter 11: Model manipulation and evasionAlso: Security Monitoring and Automation, Chapter 11: AI tools are attack surface
- PoisoningSecurity Monitoring and Automation, Chapter 11: Poisoning
- Prompt injectionSecurity Monitoring and Automation, Chapter 11: Prompt injectionAlso: Security Monitoring and Automation, Chapter 11: The stand-in assistant
- Data lossSecurity Monitoring and Automation, Chapter 11: Hallucination, bias and explainability
- BiasSecurity Monitoring and Automation, Chapter 11: Hallucination, bias and explainability
- ExplainabilitySecurity Monitoring and Automation, Chapter 11: Hallucination, bias and explainability
- HallucinationsSecurity Monitoring and Automation, Chapter 11: Hallucination, bias and explainability
- JailbreakingSecurity Monitoring and Automation, Chapter 11: Jailbreaks
- EvasionSecurity Monitoring and Automation, Chapter 11: Model manipulation and evasion
- PrivacySecurity Monitoring and Automation, Chapter 11: Hallucination, bias and explainability
- Ethical considerationsSecurity Monitoring and Automation, Chapter 11: Hallucination, bias and explainability
- Session hijackingSecurity Fundamentals, Chapter 8: Sessions: logging in onceAlso: Security Fundamentals, Chapter 8: Worked example: hijacking Priya's session
- Code executionSecurity Monitoring and Automation, Chapter 11: Prompt injectionAlso: Security Monitoring and Automation, Chapter 11: AI tools are attack surface
3.0 Security Architecture (19% of the exam)
3.1 Compare and contrast security implications of different architecture models.
- Architecture and infrastructure conceptsCloud and Data Security, Chapter 1: Where Kettle & Crane's systems liveAlso: Virtualization and Cloud Basics, Chapter 4: Deployment models: whose cloud?
- CloudCloud and Data Security, Chapter 1: On-premises, cloud and hybridAlso: Virtualization and Cloud Basics, Chapter 4: Somebody else's data center, rented by the hour
- ServerlessCloud and Data Security, Chapter 2: Serverless: smaller jobs for you, new ones tooAlso: Cloud and Data Security, Chapter 2: Validate the event; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- MulticloudCloud and Data Security, Chapter 1: MulticloudAlso: Virtualization and Cloud Basics, Chapter 4: Deployment models: whose cloud?; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- Deployment models Hybrid Private Public CommunityVirtualization and Cloud Basics, Chapter 4: Deployment models: whose cloud?Also: Cloud and Data Security, Chapter 1: Community cloud; Cloud and Data Security, Chapter 1: On-premises, cloud and hybrid
- Infrastructure as Code (IaC)Cloud and Data Security, Chapter 3: Why security teams like IaCAlso: Virtualization and Cloud Basics, Chapter 10: Infrastructure as Code; Cloud and Data Security, Chapter 3: Scan before you deploy; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- OTSecurity Fundamentals, Chapter 10: IoT and OT devices
- On-premises infrastructureCloud and Data Security, Chapter 1: On-premises, cloud and hybrid
- Air-gapped networkNetwork Security, Chapter 4: Physical segmentation and air gapsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- MicroservicesCloud and Data Security, Chapter 2: Microservices: many small doorsAlso: Cloud and Data Security, Chapter 2: Make a service refuse strangers; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- Logical segmentationNetwork Security, Chapter 4: Logical segmentation: VLANs, subnets and ACLsAlso: Network Security, Chapter 4: Worked example: segmenting Kettle & Crane; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- Physical segmentationNetwork Security, Chapter 4: Physical segmentation and air gapsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- Technical considerationsCloud and Data Security, Chapter 1: Where Kettle & Crane's systems liveAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- AvailabilityIncident Response and Resilience, Chapter 9: What high availability meansAlso: Security Fundamentals, Chapter 1: Availability
- ResilienceIncident Response and Resilience, Chapter 9: What high availability meansAlso: Incident Response and Resilience, Chapter 10: Worked example: Kettle & Crane's resilience plan; Incident Response and Resilience, Chapter 8: Backups decide how incidents end
- Proprietary vs. open sourceCloud and Data Security, Chapter 1: Software and peopleAlso: Governance, Risk and Compliance, Chapter 8: Vendor lock-in
- UsabilityCloud and Data Security, Chapter 1: Software and people
- ResponsibilityCloud and Data Security, Chapter 1: Shared responsibilityAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- ComputeVirtualization and Cloud Basics, Chapter 1: What the hypervisor shares outAlso: Cloud and Data Security, Chapter 1: Scalability; Virtualization and Cloud Basics, Chapter 6: Scaling: up or out
- Power requirementsIncident Response and Resilience, Chapter 10: Sizing a UPSAlso: Incident Response and Resilience, Chapter 10: Power problems and their fixes
- Ease of recoveryIncident Response and Resilience, Chapter 11: RTO and RPO: two questions for every systemAlso: Incident Response and Resilience, Chapter 8: Restoration testing
- Business considerationsCloud and Data Security, Chapter 1: Worked example: where should the café portal run?Also: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- Data sovereigntyCloud and Data Security, Chapter 10: Data sovereigntyAlso: Cloud and Data Security, Chapter 10: Kettle & Crane's decision; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- Data classificationCloud and Data Security, Chapter 5: Classification levelsAlso: Cloud and Data Security, Chapter 5: You can't protect what you haven't sorted
- CostVirtualization and Cloud Basics, Chapter 4: Buying versus rentingAlso: Cloud and Data Security, Chapter 1: Worked example: where should the café portal run?
- OwnershipCloud and Data Security, Chapter 1: Where Kettle & Crane's systems liveAlso: Cloud and Data Security, Chapter 1: Shared responsibility
- Environmental requirementsCloud and Data Security, Chapter 1: On-premises, cloud and hybridAlso: Incident Response and Resilience, Chapter 10: Power problems and their fixes
- ScalabilityCloud and Data Security, Chapter 1: ScalabilityAlso: Virtualization and Cloud Basics, Chapter 6: Scaling: up or out; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.1 Architecture models
- RiskGovernance, Risk and Compliance, Chapter 3: What a risk isAlso: Governance, Risk and Compliance, Chapter 4: Two ways to measure a risk
3.2 Given a scenario, manage the security architecture to best protect the infrastructure.
- Infrastructure considerationsNetwork Security, Chapter 1: Attack surfaceAlso: Network Security, Chapter 1: Security zones; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- Device placementNetwork Security, Chapter 1: Device placementAlso: Network Security, Chapter 7: Worked example: where should the sensor go?; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- Security zonesNetwork Security, Chapter 1: Security zonesAlso: Network Security, Chapter 4: Worked example: segmenting Kettle & Crane; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- Attack surfaceNetwork Security, Chapter 1: Attack surfaceAlso: Network Security, Chapter 1: Measuring the surface with nmap; Network Security, Chapter 1: Worked example: shrinking the attack surface; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- DiversityNetwork Security, Chapter 1: Device placementAlso: Security Fundamentals, Chapter 3: Defense in depth
- Zero Trust architectureNetwork Security, Chapter 10: From zones to every requestAlso: Network Security, Chapter 10: A policy engine and an enforcement point; Security Fundamentals, Chapter 3: Zero trust; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- User authenticationIdentity and Access Management, Chapter 2: Proving who you areAlso: Identity and Access Management, Chapter 2: MFA means different categories; Network Security, Chapter 10: A policy engine and an enforcement point
- Device managementEndpoint and Application Security, Chapter 7: Phones are endpoints tooAlso: Endpoint and Application Security, Chapter 7: Enrollment; Network Security, Chapter 10: A policy engine and an enforcement point
- HealthIdentity and Access Management, Chapter 10: Posture: is the device healthy?Also: Endpoint and Application Security, Chapter 7: Checking compliance; Network Security, Chapter 10: A policy engine and an enforcement point
- InventoryVulnerability, Asset and Change Management, Chapter 1: Asset trackingAlso: Vulnerability, Asset and Change Management, Chapter 1: The register; Network Security, Chapter 10: A policy engine and an enforcement point
- Application access controlNetwork Security, Chapter 10: A policy engine and an enforcement pointAlso: Identity and Access Management, Chapter 8: Role-based: the job decides
- Secure communication/accessNetwork Security, Chapter 5: TunnelingAlso: Network Security, Chapter 6: The keys to everything
- Virtual private network (VPN)Network Security, Chapter 5: IPsec, TLS VPNs and WireGuardAlso: Network Security, Chapter 5: Build a WireGuard VPN; Network Security, Chapter 5: Full tunnel or split tunnel
- Remote accessNetwork Security, Chapter 6: Hardening SSHAlso: Network Security, Chapter 6: RDP and VNC; Network Security, Chapter 6: Jump hosts
- TunnelingNetwork Security, Chapter 5: TunnelingAlso: Network Security, Chapter 5: See the tunnel on the wire
- User managementIdentity and Access Management, Chapter 1: Provisioning: the joinerAlso: Identity and Access Management, Chapter 1: Deprovisioning: the leaver; Identity and Access Management, Chapter 1: Changes: the mover
- User accessIdentity and Access Management, Chapter 8: Who decides?Also: Identity and Access Management, Chapter 11: Access reviews; Identity and Access Management, Chapter 8: One request, six answers
- Least privilegeSecurity Fundamentals, Chapter 3: Least privilegeAlso: Identity and Access Management, Chapter 9: Privileged accounts
- End-to-end encrypted messagingCryptography and PKI, Chapter 10: End-to-end encryptionAlso: Network Security, Chapter 5: VPN encryption is not end-to-end encryption
- Out-of-band managementNetwork Security, Chapter 6: Out-of-band managementAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- File transferNetwork Security, Chapter 6: Secure file transferAlso: Command Line for IT: Bash and PowerShell, Chapter 12: Shortcuts, copies and remote commands
- Security Service Edge (SSE)Network Security, Chapter 10: Security Service EdgeAlso: Network Security, Chapter 10: Worked example: from VPN to ZTNA; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- Identity managementIdentity and Access Management, Chapter 1: Identities, accounts and credentialsAlso: Identity and Access Management, Chapter 9: Privileged accounts
- Group Managed Service Accounts (gMSAs)Identity and Access Management, Chapter 9: Managed service accounts in Windows: gMSAAlso: Identity and Access Management, Chapter 9: Service accounts; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- Least privilege access accountsIdentity and Access Management, Chapter 9: Privileged accountsAlso: Security Fundamentals, Chapter 3: Least privilege; Identity and Access Management, Chapter 9: Just-in-time access
- Privilege creepIdentity and Access Management, Chapter 11: Privilege creepAlso: Identity and Access Management, Chapter 11: Access reviews; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.2 Secure infrastructure
- Failure modesNetwork Security, Chapter 9: Failure modesAlso: Network Security, Chapter 9: See both in the lab; Network Security, Chapter 9: Worked example: choosing failure modes at Kettle & Crane
3.3 Summarize concepts and strategies used to protect data.
- Data typesCloud and Data Security, Chapter 5: Structured and unstructured dataAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- StructuredCloud and Data Security, Chapter 5: Structured and unstructured dataAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- UnstructuredCloud and Data Security, Chapter 5: Structured and unstructured dataAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data statesCloud and Data Security, Chapter 6: Three statesAlso: Cloud and Data Security, Chapter 6: Worked example: a protection for each state; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data at restCloud and Data Security, Chapter 6: Protecting data at restAlso: Cloud and Data Security, Chapter 6: Three states; Cryptography and PKI, Chapter 11: Data at rest needs encryption too
- Data in useCloud and Data Security, Chapter 6: Protecting data in useAlso: Cloud and Data Security, Chapter 6: See data in use
- Data in transitCloud and Data Security, Chapter 6: See data in transitAlso: Cloud and Data Security, Chapter 6: Three states; Cryptography and PKI, Chapter 10: TLS ties it all together
- Data classificationsCloud and Data Security, Chapter 5: Classification levelsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- SensitiveCloud and Data Security, Chapter 5: Classification levels
- SecretCloud and Data Security, Chapter 5: Classification levels
- CriticalCloud and Data Security, Chapter 5: Classification levels
- ConfidentialCloud and Data Security, Chapter 5: Classification levels
- PublicCloud and Data Security, Chapter 5: Classification levels
- Top secretCloud and Data Security, Chapter 5: Classification levelsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- RestrictedCloud and Data Security, Chapter 5: Classification levels
- Methods used to secure dataCloud and Data Security, Chapter 7: Four ways to hide one valueAlso: Cloud and Data Security, Chapter 7: Try all four; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- MaskingCloud and Data Security, Chapter 7: Four ways to hide one valueAlso: Cloud and Data Security, Chapter 7: Try all four
- HashingCryptography and PKI, Chapter 2: What a hash isAlso: Cloud and Data Security, Chapter 7: Four ways to hide one value; Cryptography and PKI, Chapter 2: The three properties that make a hash useful
- FilteringCloud and Data Security, Chapter 8: What DLP doesAlso: Cloud and Data Security, Chapter 8: Actions and tuning; Cloud and Data Security, Chapter 8: Block it at the proxy
- TokenizationCloud and Data Security, Chapter 7: Why tokenization wins for card dataAlso: Cloud and Data Security, Chapter 7: Four ways to hide one value
- EncryptionCryptography and PKI, Chapter 11: Data at rest needs encryption tooAlso: Cloud and Data Security, Chapter 7: Four ways to hide one value; Cryptography and PKI, Chapter 11: The levels, outside in
- Data transposeCloud and Data Security, Chapter 7: Four ways to hide one value
- DeidentificationCloud and Data Security, Chapter 7: DeidentificationAlso: Cloud and Data Security, Chapter 7: Worked example: a test copy of the shop database; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- ObfuscationCryptography and PKI, Chapter 1: Encryption is not encodingAlso: Cloud and Data Security, Chapter 7: Four ways to hide one value
- Data protection rolesCloud and Data Security, Chapter 9: Why roles matterAlso: Cloud and Data Security, Chapter 9: Keep a register
- Data ownerCloud and Data Security, Chapter 9: Owner, steward and custodianAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data custodianCloud and Data Security, Chapter 9: Owner, steward and custodianAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data stewardCloud and Data Security, Chapter 9: Owner, steward and custodianAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data operatorCloud and Data Security, Chapter 9: Owner, steward and custodianAlso: Cloud and Data Security, Chapter 9: Controller, processor and subprocessor
- Data controllerCloud and Data Security, Chapter 9: Controller, processor and subprocessorAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data subprocessorCloud and Data Security, Chapter 9: Controller, processor and subprocessorAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data handlingCloud and Data Security, Chapter 5: LabelingAlso: Cloud and Data Security, Chapter 8: Where DLP inspects; Cloud and Data Security, Chapter 10: Geofencing
- EndpointsCloud and Data Security, Chapter 8: Where DLP inspectsAlso: Endpoint and Application Security, Chapter 7: Phones are endpoints too
- Marking and labelingCloud and Data Security, Chapter 5: LabelingAlso: Cloud and Data Security, Chapter 5: Find what needs a higher label; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- GeofencingCloud and Data Security, Chapter 10: GeofencingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data locationCloud and Data Security, Chapter 10: Data sovereigntyAlso: Cloud and Data Security, Chapter 10: Find data in the wrong region
- Data placementCloud and Data Security, Chapter 10: Kettle & Crane's decisionAlso: Cloud and Data Security, Chapter 10: Stop it happening again
- Data management life cycleCloud and Data Security, Chapter 11: The data lifecycleAlso: Cloud and Data Security, Chapter 11: Worked example: the yearly retention run
- CreationCloud and Data Security, Chapter 11: The data lifecycle
- ManagementCloud and Data Security, Chapter 11: The data lifecycle
- DistributionCloud and Data Security, Chapter 11: The data lifecycle
- RetentionCloud and Data Security, Chapter 11: Retention and retention requirementsAlso: Cloud and Data Security, Chapter 11: Purge with a dry run; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- DisposalCloud and Data Security, Chapter 11: DisposalAlso: Vulnerability, Asset and Change Management, Chapter 1: Decommissioning and sanitization; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Data complianceGovernance, Risk and Compliance, Chapter 9: What compliance isAlso: Cloud and Data Security, Chapter 11: The data lifecycle
- StandardsGovernance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meetsAlso: Cloud and Data Security, Chapter 5: Data that needs special care
- Health dataCloud and Data Security, Chapter 5: Data that needs special careAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection; Governance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meets
- Personal informationCloud and Data Security, Chapter 5: Data that needs special careAlso: Cloud and Data Security, Chapter 11: The right to be forgotten; Governance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject
- FinancialCloud and Data Security, Chapter 5: Data that needs special careAlso: Governance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meets
- Child/minor dataCloud and Data Security, Chapter 5: Data that needs special care
- Intellectual propertyCloud and Data Security, Chapter 5: Data that needs special careAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.3 Data protection
- Legal dataCloud and Data Security, Chapter 5: Data that needs special careAlso: Incident Response and Resilience, Chapter 5: Legal hold
3.4 Explain the importance of resilience and recovery in security architecture.
- Site considerationsIncident Response and Resilience, Chapter 10: Recovery sitesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- HotIncident Response and Resilience, Chapter 10: Recovery sitesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- ColdIncident Response and Resilience, Chapter 10: Recovery sitesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- WarmIncident Response and Resilience, Chapter 10: Recovery sitesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- EnvironmentalIncident Response and Resilience, Chapter 10: Recovery sitesAlso: Incident Response and Resilience, Chapter 10: Power problems and their fixes
- Platform diversityIncident Response and Resilience, Chapter 9: Platform diversityAlso: Virtualization and Cloud Basics, Chapter 1: Gains and risks
- Vendor platformIncident Response and Resilience, Chapter 9: Platform diversity
- HardwareIncident Response and Resilience, Chapter 9: Platform diversityAlso: Computer Hardware Basics, Chapter 5: RAID in one page
- VirtualizationVirtualization and Cloud Basics, Chapter 1: Gains and risksAlso: Virtualization and Cloud Basics, Chapter 1: One host, many systems
- Redundancy strategies and solutionsIncident Response and Resilience, Chapter 9: What high availability meansAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- Load balancingIncident Response and Resilience, Chapter 9: Load balancingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- ClusteringIncident Response and Resilience, Chapter 9: Active-passive, active-active and clusteringAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- AutoscalingIncident Response and Resilience, Chapter 9: AutoscalingAlso: Virtualization and Cloud Basics, Chapter 6: Auto scaling groups; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- High availabilityIncident Response and Resilience, Chapter 9: What high availability meansAlso: Virtualization and Cloud Basics, Chapter 6: Regions and availability zones; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- Multicloud systemsCloud and Data Security, Chapter 1: MulticloudAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- PowerIncident Response and Resilience, Chapter 10: Power problems and their fixesAlso: Incident Response and Resilience, Chapter 10: Sizing a UPS
- Uninterruptible power supply (UPS)Incident Response and Resilience, Chapter 10: Power problems and their fixesAlso: Incident Response and Resilience, Chapter 10: Sizing a UPS; Incident Response and Resilience, Chapter 10: Watching a UPS with NUT
- Redundant power supply (RPS)Incident Response and Resilience, Chapter 10: Power problems and their fixes
- Power generatorIncident Response and Resilience, Chapter 10: Power problems and their fixesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- Surge protectorIncident Response and Resilience, Chapter 10: Power problems and their fixesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- StorageComputer Hardware Basics, Chapter 5: RAID in one pageAlso: Operating System Basics, Chapter 10: The 3-2-1 rule
- BackupsIncident Response and Resilience, Chapter 8: Backups decide how incidents endAlso: Operating System Basics, Chapter 10: The 3-2-1 rule; Incident Response and Resilience, Chapter 8: Full, incremental and differential
- RetentionIncident Response and Resilience, Chapter 8: Immutable backupsAlso: Cloud and Data Security, Chapter 11: Retention and retention requirements
- ImmutabilityIncident Response and Resilience, Chapter 8: Immutable backupsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- ScopeIncident Response and Resilience, Chapter 8: Full, incremental and differential
- Restoration testingIncident Response and Resilience, Chapter 8: Restoration testingAlso: Operating System Basics, Chapter 10: Proving a copy is identical; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- TestingIncident Response and Resilience, Chapter 11: Testing the planAlso: Incident Response and Resilience, Chapter 2: Tabletop exercises
- FailoverIncident Response and Resilience, Chapter 9: Failover with a virtual IPAlso: Incident Response and Resilience, Chapter 11: Testing the plan
- SimulationIncident Response and Resilience, Chapter 11: Testing the planAlso: Incident Response and Resilience, Chapter 11: Worked example: testing the order database fix
- Parallel processingIncident Response and Resilience, Chapter 11: Testing the plan
- Disaster recoveryIncident Response and Resilience, Chapter 11: Checking a plan against the targetsAlso: Governance, Risk and Compliance, Chapter 1: The policy pyramid
- Business continuityGovernance, Risk and Compliance, Chapter 6: What a BIA isAlso: Governance, Risk and Compliance, Chapter 1: The policy pyramid
- Capacity planningIncident Response and Resilience, Chapter 10: Capacity planningAlso: Virtualization and Cloud Basics, Chapter 6: Worked example: how many servers for the sale?; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- Recovery metricsIncident Response and Resilience, Chapter 11: RTO and RPO: two questions for every systemAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 9: Recovery numbers; CompTIA Security+ SY0-801 Exam Prep, Chapter 6: 3.4 Resilience and recovery
- Recovery time objective (RTO)Incident Response and Resilience, Chapter 11: RTO and RPO: two questions for every systemAlso: Governance, Risk and Compliance, Chapter 6: Step 3: set the targets; CompTIA Security+ SY0-801 Exam Prep, Chapter 9: Recovery numbers
- Recovery point objective (RPO)Incident Response and Resilience, Chapter 11: RTO and RPO: two questions for every systemAlso: Governance, Risk and Compliance, Chapter 6: Step 3: set the targets; CompTIA Security+ SY0-801 Exam Prep, Chapter 9: Recovery numbers
- Mean time to repair (MTTR)Incident Response and Resilience, Chapter 11: MTTR and MTBFAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 9: Recovery numbers
- Mean time between failures (MTBF)Incident Response and Resilience, Chapter 11: MTTR and MTBFAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 9: Recovery numbers
4.0 Security Operations (27% of the exam)
4.1 Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment.
- SegmentationNetwork Security, Chapter 4: Why segment?Also: Network Security, Chapter 4: Logical segmentation: VLANs, subnets and ACLs; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Access controlsIdentity and Access Management, Chapter 8: Who decides?Also: Operating System Basics, Chapter 7: Reading permissions; Endpoint and Application Security, Chapter 3: Mandatory access control; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- HardeningEndpoint and Application Security, Chapter 1: A secure baselineAlso: Endpoint and Application Security, Chapter 1: Applying a baseline; Endpoint and Application Security, Chapter 2: Settings that harden Windows; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- SandboxingEndpoint and Application Security, Chapter 6: SandboxingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Deception and disruption technologyEndpoint and Application Security, Chapter 11: Bait that nobody should touchAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- HoneypotEndpoint and Application Security, Chapter 11: Honeypots and honeynetsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- HoneynetEndpoint and Application Security, Chapter 11: Honeypots and honeynetsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- HoneyfileEndpoint and Application Security, Chapter 11: HoneyfilesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- HoneytokenEndpoint and Application Security, Chapter 11: HoneytokensAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Canary accountEndpoint and Application Security, Chapter 11: CanariesAlso: Endpoint and Application Security, Chapter 11: Worked example: placing the decoys; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Monitoring/alertingSecurity Monitoring and Automation, Chapter 1: Watching, not just defendingAlso: Security Monitoring and Automation, Chapter 1: From log line to action; Security Monitoring and Automation, Chapter 4: Alert tuning; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Mobile device management (MDM)Endpoint and Application Security, Chapter 7: Phones are endpoints tooAlso: Endpoint and Application Security, Chapter 7: What a policy contains; Endpoint and Application Security, Chapter 7: Checking compliance; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Application controlEndpoint and Application Security, Chapter 6: Deny lists and allow listsAlso: Endpoint and Application Security, Chapter 6: A hash allow list; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Allow listsEndpoint and Application Security, Chapter 6: Deny lists and allow listsAlso: Endpoint and Application Security, Chapter 6: A hash allow list; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Block listsEndpoint and Application Security, Chapter 6: Deny lists and allow listsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Intrusion detection/prevention systemsNetwork Security, Chapter 7: What a firewall missesAlso: Network Security, Chapter 7: Signatures and anomalies; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Network-based intrusion detection system (NIDS)/Network-based intrusion prevention system (NIPS)Network Security, Chapter 7: Passive or inlineAlso: Network Security, Chapter 7: A passive NIDS in the lab; Network Security, Chapter 7: An inline NIPS; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Host-based intrusion detection system (HIDS)/Host-based Intrusion prevention system (HIPS)Endpoint and Application Security, Chapter 5: Watching from inside the hostAlso: Endpoint and Application Security, Chapter 5: Blocking with Fail2ban; Endpoint and Application Security, Chapter 5: File integrity with AIDE; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Wireless intrusion prevention system (WIPS)Network Security, Chapter 11: WIPS: watching the airAlso: Network Security, Chapter 11: A small WIPS in the lab; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- FirewallsNetwork Security, Chapter 2: What a firewall doesAlso: Network Security, Chapter 2: Stateful filtering; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Rate-limiting requestsNetwork Security, Chapter 8: Rate limitingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Web application firewall (WAF)Network Security, Chapter 8: A reverse proxy as a WAFAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Rule-basedNetwork Security, Chapter 2: Rule order and the implicit denyAlso: Network Security, Chapter 3: From matrix to rules; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Unified threat management (UTM)Network Security, Chapter 9: Unified threat managementAlso: Network Security, Chapter 9: Failure modes; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Layer 4/Layer 7Network Security, Chapter 2: Layer 4 and next-generation firewallsAlso: Network Security, Chapter 8: A reverse proxy as a WAF; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Content filterNetwork Security, Chapter 8: A forward proxy with a content filterAlso: Network Security, Chapter 8: Two kinds of proxy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Data loss prevention (DLP)Cloud and Data Security, Chapter 8: What DLP doesAlso: Cloud and Data Security, Chapter 8: A rule for card numbers; Cloud and Data Security, Chapter 8: Actions and tuning; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Agent-basedCloud and Data Security, Chapter 8: Where DLP inspectsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Centralized proxyNetwork Security, Chapter 8: Two kinds of proxyAlso: Cloud and Data Security, Chapter 8: Block it at the proxy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Endpoint securityEndpoint and Application Security, Chapter 1: Endpoints and their attack surfaceAlso: Endpoint and Application Security, Chapter 5: Watching from inside the host; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Endpoint detection and response (EDR)Endpoint and Application Security, Chapter 4: EDR: watching behaviorAlso: Endpoint and Application Security, Chapter 4: Worked example: one incident, three views; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Extended detection and response (XDR)Endpoint and Application Security, Chapter 4: XDR: joining the piecesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- AntivirusEndpoint and Application Security, Chapter 4: Antivirus and signaturesAlso: Endpoint and Application Security, Chapter 4: Your own signatures; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Network access controlIdentity and Access Management, Chapter 10: Who may plug in?Also: Identity and Access Management, Chapter 10: Worked example: Kettle & Crane's network access; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Captive portalsIdentity and Access Management, Chapter 10: Captive portalsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- 802.1XIdentity and Access Management, Chapter 10: 802.1X: three partsAlso: Identity and Access Management, Chapter 10: A real 802.1X login; Identity and Access Management, Chapter 10: EAP methods; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Endpoint posture/complianceIdentity and Access Management, Chapter 10: Posture: is the device healthy?Also: Endpoint and Application Security, Chapter 7: Checking compliance; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- RepositoriesVulnerability, Asset and Change Management, Chapter 5: Public repositoriesAlso: Endpoint and Application Security, Chapter 9: Checks that run themselves; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Secrets scanningEndpoint and Application Security, Chapter 9: Secrets scanningAlso: Endpoint and Application Security, Chapter 9: Worked example: a leaked key in a pull request; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Application securityEndpoint and Application Security, Chapter 8: The trust boundaryAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Input validationEndpoint and Application Security, Chapter 8: Input validationAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Secure cookiesEndpoint and Application Security, Chapter 8: Secure cookiesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Static code analysisEndpoint and Application Security, Chapter 9: Static code analysisAlso: Vulnerability, Asset and Change Management, Chapter 8: Source code review; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Code signingEndpoint and Application Security, Chapter 9: Code signingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Email securityEndpoint and Application Security, Chapter 10: Anyone can write the From lineAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Domain-based Message Authentication, Reporting, and Conformance (DMARC)Endpoint and Application Security, Chapter 10: DMARCAlso: Endpoint and Application Security, Chapter 10: Worked example: from none to reject; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Sender Policy Framework (SPF)Endpoint and Application Security, Chapter 10: SPFAlso: Endpoint and Application Security, Chapter 10: The lab: publish and check; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- DomainKeys Identified Mail (DKIM)Endpoint and Application Security, Chapter 10: DKIMAlso: Endpoint and Application Security, Chapter 10: The lab: publish and check; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Brand Indicators for Message Identification (BIMI)Endpoint and Application Security, Chapter 10: BIMIAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Operating systems securityEndpoint and Application Security, Chapter 2: One change, every laptopAlso: Endpoint and Application Security, Chapter 1: Windows and macOS laptops; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Group PolicyEndpoint and Application Security, Chapter 2: One change, every laptopAlso: Endpoint and Application Security, Chapter 2: Link, block and enforce; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
- Security-enhanced Linux (SELinux)Endpoint and Application Security, Chapter 3: Labels and type enforcementAlso: Endpoint and Application Security, Chapter 3: Modes; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.1 Mitigating controls and techniques
4.2 Explain the security implications of proper hardware, software, and data asset management.
- Asset management life cycleVulnerability, Asset and Change Management, Chapter 1: The asset lifecycleAlso: Vulnerability, Asset and Change Management, Chapter 1: The register; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Planning/scopingVulnerability, Asset and Change Management, Chapter 1: You can't protect what you don't know aboutAlso: Vulnerability, Asset and Change Management, Chapter 1: The asset lifecycle; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Acquisition/procurement processVulnerability, Asset and Change Management, Chapter 1: The asset lifecycleAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Assignment/accountingVulnerability, Asset and Change Management, Chapter 1: OwnershipAlso: Vulnerability, Asset and Change Management, Chapter 1: The asset lifecycle; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Monitoring/asset trackingVulnerability, Asset and Change Management, Chapter 1: Asset trackingAlso: Vulnerability, Asset and Change Management, Chapter 2: Discovery with nmap; Vulnerability, Asset and Change Management, Chapter 2: IP address management; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Disposal/decommissioningVulnerability, Asset and Change Management, Chapter 1: Decommissioning and sanitizationAlso: Cloud and Data Security, Chapter 11: Disposal; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
4.3 Given a scenario, perform tasks associated with vulnerability management.
- Identification methodsVulnerability, Asset and Change Management, Chapter 6: What a vulnerability scanner doesAlso: Vulnerability, Asset and Change Management, Chapter 2: Discovery with nmap; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- ScanningVulnerability, Asset and Change Management, Chapter 6: What a vulnerability scanner doesAlso: Vulnerability, Asset and Change Management, Chapter 6: Network scans: what an outsider sees; Vulnerability, Asset and Change Management, Chapter 6: Credentialed scans: what the server knows; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Internet Protocol Address Management (IPAM)Vulnerability, Asset and Change Management, Chapter 2: IP address managementAlso: Vulnerability, Asset and Change Management, Chapter 2: Plan versus reality; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Cloud security posture management (CSPM)Vulnerability, Asset and Change Management, Chapter 8: Cloud security posture managementAlso: Vulnerability, Asset and Change Management, Chapter 8: Checking cloud settings as code; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Source code reviewVulnerability, Asset and Change Management, Chapter 8: Source code reviewAlso: Vulnerability, Asset and Change Management, Chapter 8: A review checklist; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- PrioritizationVulnerability, Asset and Change Management, Chapter 9: Ranking with contextAlso: Vulnerability, Asset and Change Management, Chapter 9: A ranking script; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Severity assessmentVulnerability, Asset and Change Management, Chapter 9: Ranking with contextAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 9: Reading a CVSS vector
- Penetration test report reviewVulnerability, Asset and Change Management, Chapter 11: The penetration test reportAlso: Vulnerability, Asset and Change Management, Chapter 11: Worked example: reading one finding; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- RemediationVulnerability, Asset and Change Management, Chapter 9: The remediation loopAlso: Vulnerability, Asset and Change Management, Chapter 9: Choosing the fix; Vulnerability, Asset and Change Management, Chapter 8: Worked example: fix or accept; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- VerificationVulnerability, Asset and Change Management, Chapter 9: Verify: scan againAlso: Vulnerability, Asset and Change Management, Chapter 7: Worked example: fix and prove it; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- ReportingVulnerability, Asset and Change Management, Chapter 6: Worked example: the scan summaryAlso: Vulnerability, Asset and Change Management, Chapter 9: The remediation loop; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- InternalVulnerability, Asset and Change Management, Chapter 6: Worked example: the scan summaryAlso: Vulnerability, Asset and Change Management, Chapter 9: The remediation loop; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- ExternalVulnerability, Asset and Change Management, Chapter 11: Bug bounties and responsible disclosureAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Bounty programVulnerability, Asset and Change Management, Chapter 11: Bug bounties and responsible disclosureAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
- Responsible disclosure policiesVulnerability, Asset and Change Management, Chapter 11: Bug bounties and responsible disclosureAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.2 and 4.3 Assets and vulnerabilities
4.4 Explain security alerting and monitoring concepts and tools.
- Monitoring computing resourcesSecurity Monitoring and Automation, Chapter 1: Watching, not just defendingAlso: Security Monitoring and Automation, Chapter 1: Log sources; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- SystemsSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Security Monitoring and Automation, Chapter 2: Windows and other devices; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- ApplicationSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Security Monitoring and Automation, Chapter 2: Forwarding from the shop; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- InfrastructureSecurity Monitoring and Automation, Chapter 5: Network management systemsAlso: Security Monitoring and Automation, Chapter 5: Two kinds of network data; Security Monitoring and Automation, Chapter 1: Log sources; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- ActivitiesSecurity Monitoring and Automation, Chapter 1: From log line to actionAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Log aggregationSecurity Monitoring and Automation, Chapter 2: Log aggregationAlso: Security Monitoring and Automation, Chapter 2: The lab and the log server; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- AlertingSecurity Monitoring and Automation, Chapter 4: What a SIEM doesAlso: Security Monitoring and Automation, Chapter 4: A threshold rule; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- ScanningVulnerability, Asset and Change Management, Chapter 6: What a vulnerability scanner doesAlso: Vulnerability, Asset and Change Management, Chapter 6: Network scans: what an outsider sees; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- ArchivingSecurity Monitoring and Automation, Chapter 2: Log aggregationAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- ReportingSecurity Monitoring and Automation, Chapter 4: What a SIEM doesAlso: Security Monitoring and Automation, Chapter 1: Dashboards; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Alert tuningSecurity Monitoring and Automation, Chapter 4: Alert tuningAlso: Security Monitoring and Automation, Chapter 4: True, false, positive, negative; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- ToolsSecurity Monitoring and Automation, Chapter 1: From log line to actionAlso: Security Monitoring and Automation, Chapter 4: What a SIEM does; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- BenchmarksVulnerability, Asset and Change Management, Chapter 7: BenchmarksAlso: Vulnerability, Asset and Change Management, Chapter 7: A small benchmark; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Agents/agentlessSecurity Monitoring and Automation, Chapter 7: Two ways to get the dataAlso: Security Monitoring and Automation, Chapter 7: What agents give and cost; Security Monitoring and Automation, Chapter 7: What agentless gives and costs; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Security information and event management (SIEM)Security Monitoring and Automation, Chapter 4: What a SIEM doesAlso: Security Monitoring and Automation, Chapter 4: A correlation rule; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- AntivirusEndpoint and Application Security, Chapter 4: Antivirus and signaturesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- DLPCloud and Data Security, Chapter 8: What DLP doesAlso: Cloud and Data Security, Chapter 8: Where DLP inspects; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Vulnerability scannersVulnerability, Asset and Change Management, Chapter 6: What a vulnerability scanner doesAlso: Vulnerability, Asset and Change Management, Chapter 6: Credentialed scans: what the server knows; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- OrchestrationSecurity Monitoring and Automation, Chapter 9: Why automateAlso: Security Monitoring and Automation, Chapter 9: A response playbook; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Packet analyzerSecurity Monitoring and Automation, Chapter 6: Packet analyzersAlso: Security Monitoring and Automation, Chapter 6: Capture the night; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- ProtocolsSecurity Monitoring and Automation, Chapter 5: Two kinds of network dataAlso: Security Monitoring and Automation, Chapter 2: syslog in one paragraph; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- NetFlowSecurity Monitoring and Automation, Chapter 5: NetFlow and IPFIXAlso: Security Monitoring and Automation, Chapter 5: Flows: who talked to whom; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Simple Network Management Protocol (SNMP)Security Monitoring and Automation, Chapter 5: SNMP, securelyAlso: Security Monitoring and Automation, Chapter 5: Traps; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- syslogSecurity Monitoring and Automation, Chapter 2: syslog in one paragraphAlso: Security Monitoring and Automation, Chapter 2: The message, field by field; Security Monitoring and Automation, Chapter 2: UDP, TCP or TLS; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Security Content Automation Protocol (SCAP)Vulnerability, Asset and Change Management, Chapter 7: SCAP: benchmarks a computer can readAlso: Vulnerability, Asset and Change Management, Chapter 7: Real benchmarks with SCAP content; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Automated alertsSecurity Monitoring and Automation, Chapter 4: A threshold ruleAlso: Security Monitoring and Automation, Chapter 9: A response playbook; Security Monitoring and Automation, Chapter 1: From log line to action; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Port mirroringSecurity Monitoring and Automation, Chapter 6: Port mirroringAlso: Security Monitoring and Automation, Chapter 6: Where to capture; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- DashboardsSecurity Monitoring and Automation, Chapter 1: DashboardsAlso: Security Monitoring and Automation, Chapter 1: A text dashboard; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
- Network management systemsSecurity Monitoring and Automation, Chapter 5: Network management systemsAlso: Security Monitoring and Automation, Chapter 5: SNMP, securely; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.4 Monitoring
4.5 Given a scenario, apply concepts related to identity and access management.
- Provisioning/deprovisioning user accountsIdentity and Access Management, Chapter 1: Provisioning: the joinerAlso: Identity and Access Management, Chapter 1: Deprovisioning: the leaver; Identity and Access Management, Chapter 1: Worked example: the November account check; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Permissions assignments and implicationsIdentity and Access Management, Chapter 1: Changes: the moverAlso: Identity and Access Management, Chapter 11: Privilege creep; Identity and Access Management, Chapter 8: Role-based: the job decides; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Identity proofingIdentity and Access Management, Chapter 1: Identity proofingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- FederationIdentity and Access Management, Chapter 6: Federation: trust between organizationsAlso: Identity and Access Management, Chapter 6: Worked example: federating the importer's portal; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Single sign-on (SSO)Identity and Access Management, Chapter 6: Sign in onceAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Security Assertions Markup Language (SAML)Identity and Access Management, Chapter 6: SAMLAlso: Identity and Access Management, Chapter 6: A SAML sign-in, step by step; Identity and Access Management, Chapter 6: An IdP in the lab: Keycloak; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Lightweight Directory Access Protocol (LDAP)Identity and Access Management, Chapter 5: The directory at the centerAlso: Identity and Access Management, Chapter 5: Require TLS: LDAPS and StartTLS; Identity and Access Management, Chapter 5: Build the Kettle & Crane directory; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Open authorization (OAuth)Identity and Access Management, Chapter 7: Delegation: access without the passwordAlso: Identity and Access Management, Chapter 7: The authorization code flow; Identity and Access Management, Chapter 7: OAuth is not sign-in: OpenID Connect; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Account typesIdentity and Access Management, Chapter 1: Identities, accounts and credentialsAlso: Identity and Access Management, Chapter 9: Privileged accounts; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- UserIdentity and Access Management, Chapter 1: Identities, accounts and credentialsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- PrivilegedIdentity and Access Management, Chapter 9: Privileged accountsAlso: Identity and Access Management, Chapter 9: Worked example: Kettle & Crane's privileged accounts; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- GlobalIdentity and Access Management, Chapter 9: Privileged accountsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- LocalIdentity and Access Management, Chapter 9: Privileged accountsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- ServiceIdentity and Access Management, Chapter 9: Service accountsAlso: Identity and Access Management, Chapter 9: Managed service accounts in Windows: gMSA; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Third-partyIdentity and Access Management, Chapter 9: Third-party accountsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Emergency accessIdentity and Access Management, Chapter 9: Emergency access: break-glass accountsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- MFAIdentity and Access Management, Chapter 2: MFA means different categoriesAlso: Identity and Access Management, Chapter 3: Worked example: MFA for the admin accounts; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Hard tokenIdentity and Access Management, Chapter 3: Hard tokens and soft tokensAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Soft tokenIdentity and Access Management, Chapter 3: Hard tokens and soft tokensAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- BiometricsIdentity and Access Management, Chapter 3: BiometricsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- One-time password (OTP)Identity and Access Management, Chapter 3: One-time passwordsAlso: Identity and Access Management, Chapter 3: How a TOTP code is made; Identity and Access Management, Chapter 3: Check it against a real tool; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Backup codeIdentity and Access Management, Chapter 3: Backup codesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Access control modelsIdentity and Access Management, Chapter 8: Who decides?Also: Identity and Access Management, Chapter 8: One request, six answers; Identity and Access Management, Chapter 8: Worked example: choosing models for the office; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Rule-basedIdentity and Access Management, Chapter 8: Rule-based, time-based and attribute-basedAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Role-basedIdentity and Access Management, Chapter 8: Role-based: the job decidesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Time-basedIdentity and Access Management, Chapter 8: Rule-based, time-based and attribute-basedAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- MandatoryIdentity and Access Management, Chapter 8: Mandatory: labels decideAlso: Endpoint and Application Security, Chapter 3: Mandatory access control; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- DiscretionaryIdentity and Access Management, Chapter 8: Discretionary: the owner decidesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Just-in-timeIdentity and Access Management, Chapter 9: Just-in-time accessAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Access managementIdentity and Access Management, Chapter 8: Who decides?Also: Identity and Access Management, Chapter 10: Who may plug in?; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- AuthenticationIdentity and Access Management, Chapter 2: Proving who you areAlso: Identity and Access Management, Chapter 2: MFA means different categories; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- PoliciesIdentity and Access Management, Chapter 8: One request, six answersAlso: Identity and Access Management, Chapter 11: Access reviews; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Logical/technicalIdentity and Access Management, Chapter 8: One request, six answersAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Administrative/businessIdentity and Access Management, Chapter 11: Access reviewsAlso: Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Access reviewIdentity and Access Management, Chapter 11: Access reviewsAlso: Identity and Access Management, Chapter 12: Step 5: The checks (Chapters 1, 3, 8, 9 and 11); CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Password conceptsIdentity and Access Management, Chapter 2: Password rules that workAlso: Identity and Access Management, Chapter 4: Signing in without a password; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- PasskeyIdentity and Access Management, Chapter 4: What a passkey isAlso: Identity and Access Management, Chapter 4: Synced or device-bound; Identity and Access Management, Chapter 4: Act it out with openssl; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Password managersIdentity and Access Management, Chapter 2: Password rules that workAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- PasswordlessIdentity and Access Management, Chapter 4: Signing in without a passwordAlso: Identity and Access Management, Chapter 4: A phishing site gets nothing; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Password best practicesIdentity and Access Management, Chapter 2: Password rules that workAlso: Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy; Identity and Access Management, Chapter 2: Checking a password against the rules; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- LengthIdentity and Access Management, Chapter 2: Password rules that workAlso: Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- ComplexityIdentity and Access Management, Chapter 2: Password rules that workAlso: Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- ReuseIdentity and Access Management, Chapter 2: Password rules that workAlso: Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- ExpirationIdentity and Access Management, Chapter 2: Password rules that workAlso: Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- AgeIdentity and Access Management, Chapter 2: Password rules that workAlso: Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Compromised credential monitoringIdentity and Access Management, Chapter 11: Compromised credentialsAlso: Identity and Access Management, Chapter 2: Rules can't see breaches; Identity and Access Management, Chapter 11: Worked example: Sam's password in a breach; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Account auditingIdentity and Access Management, Chapter 11: Access reviewsAlso: Identity and Access Management, Chapter 1: Stale credentials; Identity and Access Management, Chapter 12: Step 5: The checks (Chapters 1, 3, 8, 9 and 11); CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
- Policy reportIdentity and Access Management, Chapter 12: Step 6: The report and the main part (Chapter 11)Also: Identity and Access Management, Chapter 11: Access reviews; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.5 Identity and access
4.6 Given a scenario, apply automation and orchestration solutions to secure operations.
- Use cases of automation and scriptingSecurity Monitoring and Automation, Chapter 9: Why automateAlso: Security Monitoring and Automation, Chapter 9: A response playbook; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- User provisioningIdentity and Access Management, Chapter 1: Provisioning: the joinerAlso: Security Monitoring and Automation, Chapter 9: Why automate; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Resource provisioningCloud and Data Security, Chapter 3: Why security teams like IaCAlso: Cloud and Data Security, Chapter 3: A CloudFormation template; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Desired state managementSecurity Monitoring and Automation, Chapter 9: Desired stateAlso: Cloud and Data Security, Chapter 3: Drift: when the cloud stops matching the file; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Anomaly detectionSecurity Monitoring and Automation, Chapter 10: Anomaly detectionAlso: Security Monitoring and Automation, Chapter 10: A measured baseline; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Ticket managementSecurity Monitoring and Automation, Chapter 9: TicketsAlso: Security Monitoring and Automation, Chapter 9: A response playbook; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- ConsiderationsSecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- GuardrailsSecurity Monitoring and Automation, Chapter 10: Agentic tools and guardrailsAlso: Security Monitoring and Automation, Chapter 9: A response playbook; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Automation logicSecurity Monitoring and Automation, Chapter 9: A response playbookAlso: Security Monitoring and Automation, Chapter 9: Worked example: Friday's spraying; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Process engineeringSecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- ComplexitySecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- FinancialSecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Process risksSecurity Monitoring and Automation, Chapter 9: Why automateAlso: Security Monitoring and Automation, Chapter 9: A response playbook; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- DeploymentSecurity Monitoring and Automation, Chapter 9: CI/CD: test before you deployAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- AISecurity Monitoring and Automation, Chapter 10: Where AI helpsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- CapabilitiesSecurity Monitoring and Automation, Chapter 10: Where AI helpsAlso: Security Monitoring and Automation, Chapter 10: Predictive models; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- AgenticSecurity Monitoring and Automation, Chapter 10: Agentic tools and guardrailsAlso: Security Monitoring and Automation, Chapter 10: Worked example: the agent's Friday proposals; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- ChatbotSecurity Monitoring and Automation, Chapter 10: Where AI helpsAlso: Security Monitoring and Automation, Chapter 11: Hallucination, bias and explainability; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Predictive analysisSecurity Monitoring and Automation, Chapter 10: Predictive modelsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- AI-augmented baselinesSecurity Monitoring and Automation, Chapter 10: A measured baselineAlso: Security Monitoring and Automation, Chapter 10: Anomaly detection; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Intended outcomesSecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Efficiency/time savingSecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Enforcing baselinesSecurity Monitoring and Automation, Chapter 9: Desired stateAlso: Security Monitoring and Automation, Chapter 9: Why automate; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Continuous improvementsSecurity Monitoring and Automation, Chapter 9: CI/CD: test before you deployAlso: Security Monitoring and Automation, Chapter 4: Alert tuning; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Productivity improvementsSecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Reduced downtimeSecurity Monitoring and Automation, Chapter 9: Desired stateAlso: Security Monitoring and Automation, Chapter 9: Why automate; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Increased proactivitySecurity Monitoring and Automation, Chapter 9: A response playbookAlso: Security Monitoring and Automation, Chapter 9: Why automate; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- SecOpsSecurity Monitoring and Automation, Chapter 9: Why automateAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Continuous integration and continuous deployment (CI/CD)Security Monitoring and Automation, Chapter 9: CI/CD: test before you deployAlso: Vulnerability, Asset and Change Management, Chapter 10: Version control for configuration; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- WorkflowsSecurity Monitoring and Automation, Chapter 9: A response playbookAlso: Security Monitoring and Automation, Chapter 9: Why automate; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- AutomationSecurity Monitoring and Automation, Chapter 9: Why automateAlso: Security Monitoring and Automation, Chapter 9: Worked example: Friday's spraying; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- IntegrationsSecurity Monitoring and Automation, Chapter 9: A response playbookAlso: Security Monitoring and Automation, Chapter 9: Why automate; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
4.7 Summarize concepts associated with incident response activities.
- PreparationIncident Response and Resilience, Chapter 2: What preparation meansAlso: Incident Response and Resilience, Chapter 1: The seven phases; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- TrainingIncident Response and Resilience, Chapter 2: What preparation meansAlso: Attacks and Indicators, Chapter 11: Phishing simulations; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- TestingIncident Response and Resilience, Chapter 2: Tabletop exercisesAlso: Incident Response and Resilience, Chapter 11: Testing the plan; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Tabletop exercisesIncident Response and Resilience, Chapter 2: Tabletop exercisesAlso: Incident Response and Resilience, Chapter 2: Worked example: Alex runs the first tabletop; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- PlaybooksIncident Response and Resilience, Chapter 2: PlaybooksAlso: Security Monitoring and Automation, Chapter 9: A response playbook; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- SimulationIncident Response and Resilience, Chapter 2: Tabletop exercisesAlso: Attacks and Indicators, Chapter 11: Phishing simulations; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- RolesIncident Response and Resilience, Chapter 2: The response teamAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- IdentificationIncident Response and Resilience, Chapter 1: The seven phasesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- DetectionIncident Response and Resilience, Chapter 1: Events, alerts and incidentsAlso: Incident Response and Resilience, Chapter 1: Worked example: Sam's fake login page; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Internal advisoryIncident Response and Resilience, Chapter 2: Who must be toldAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- External advisoryIncident Response and Resilience, Chapter 2: Who must be toldAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Threat huntingIncident Response and Resilience, Chapter 3: Why hunt?Also: Incident Response and Resilience, Chapter 3: The hunting loop; Incident Response and Resilience, Chapter 3: Hunt step 1: who talks to whom, how often; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- InvestigationIncident Response and Resilience, Chapter 5: What digital forensics isAlso: Incident Response and Resilience, Chapter 1: A case folder and a timeline; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Digital forensicsIncident Response and Resilience, Chapter 5: What digital forensics isAlso: Incident Response and Resilience, Chapter 5: The order of volatility; Incident Response and Resilience, Chapter 6: One routine for every item; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Chain of custodyIncident Response and Resilience, Chapter 5: Chain of custodyAlso: Incident Response and Resilience, Chapter 5: Worked example: the new bank details; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- E-discoveryIncident Response and Resilience, Chapter 5: E-discoveryAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- PreservationIncident Response and Resilience, Chapter 5: Legal holdAlso: Incident Response and Resilience, Chapter 5: The order of volatility; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- ContainmentIncident Response and Resilience, Chapter 4: Containment: stop the spread firstAlso: Incident Response and Resilience, Chapter 4: Worked example: Jo's fake browser update; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Quarantine/isolationIncident Response and Resilience, Chapter 4: Option 2: quarantine the laptopAlso: Incident Response and Resilience, Chapter 4: The lab: a small office in namespaces; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- NegotiationIncident Response and Resilience, Chapter 2: PlaybooksAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Eradication/recoveryIncident Response and Resilience, Chapter 4: Eradication: remove the causeAlso: Incident Response and Resilience, Chapter 8: Backups decide how incidents end; Incident Response and Resilience, Chapter 8: Restoration testing; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Notification/external reportingIncident Response and Resilience, Chapter 2: Who must be toldAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- StakeholdersIncident Response and Resilience, Chapter 2: Who must be toldAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- CustomersIncident Response and Resilience, Chapter 2: Who must be toldAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Law enforcementIncident Response and Resilience, Chapter 5: Law enforcementAlso: Incident Response and Resilience, Chapter 2: Who must be told; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- MandatoryIncident Response and Resilience, Chapter 2: Who must be toldAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Post-incidentIncident Response and Resilience, Chapter 7: Symptoms, causes and root causesAlso: Incident Response and Resilience, Chapter 7: Worked example: the one-page report; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Lessons learnedIncident Response and Resilience, Chapter 7: Step 3: the lessons-learned meetingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Root cause analysisIncident Response and Resilience, Chapter 7: Symptoms, causes and root causesAlso: Incident Response and Resilience, Chapter 7: Step 2: the five whys; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Post-incident reporting (PIR)Incident Response and Resilience, Chapter 7: Worked example: the one-page reportAlso: Incident Response and Resilience, Chapter 12: Step 8: Write the report (Chapters 7 and 11); CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
4.8 Given a scenario, use data, artifacts and sources to support a security investigation.
- Log and trace data typesSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Command Line for IT: Bash and PowerShell, Chapter 7: Where the logs are; Security Monitoring and Automation, Chapter 3: Why parse; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Access and accountingSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Attacks and Indicators, Chapter 8: The traces in the access log; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- LogicalSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Command Line for IT: Bash and PowerShell, Chapter 3: Meet auth.log; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- PhysicalAttacks and Indicators, Chapter 5: TailgatingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- DeviceSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Security Monitoring and Automation, Chapter 5: Network management systems; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- ServerSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Command Line for IT: Bash and PowerShell, Chapter 7: Where the logs are; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- ApplicationSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Attacks and Indicators, Chapter 8: The traces in the access log; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- AuthenticationCommand Line for IT: Bash and PowerShell, Chapter 3: Meet auth.logAlso: Security Monitoring and Automation, Chapter 1: Log sources; Command Line for IT: Bash and PowerShell, Chapter 7: The Windows Event Log; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- CommunicationSecurity Monitoring and Automation, Chapter 3: Email headersAlso: Security Monitoring and Automation, Chapter 5: Flows: who talked to whom; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- AuditCloud and Data Security, Chapter 4: Logging: CloudTrailAlso: Command Line for IT: Bash and PowerShell, Chapter 7: The Windows Event Log; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- EndpointSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Endpoint and Application Security, Chapter 5: Detecting attacks in logs; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- NetworkSecurity Monitoring and Automation, Chapter 5: Flows: who talked to whomAlso: Security Monitoring and Automation, Chapter 6: Packet capture; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- MetadataSecurity Monitoring and Automation, Chapter 3: MetadataAlso: Security Monitoring and Automation, Chapter 3: Email headers; Security Monitoring and Automation, Chapter 3: File metadata; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Data sourcesSecurity Monitoring and Automation, Chapter 8: What each source is best atAlso: Security Monitoring and Automation, Chapter 8: Start from a question; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Vulnerability scansVulnerability, Asset and Change Management, Chapter 6: What a vulnerability scanner doesAlso: Vulnerability, Asset and Change Management, Chapter 6: Worked example: the scan summary; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Automated reportsSecurity Monitoring and Automation, Chapter 4: What a SIEM doesAlso: Security Monitoring and Automation, Chapter 8: What each source is best at; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- NetFlow/Internet Protocol Flow Information Export (IPFIX)Security Monitoring and Automation, Chapter 5: NetFlow and IPFIXAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Surveillance footageIncident Response and Resilience, Chapter 6: Surveillance footageAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Security toolsSecurity Monitoring and Automation, Chapter 1: Log sourcesAlso: Network Security, Chapter 7: What a firewall misses; Endpoint and Application Security, Chapter 4: Worked example: one incident, three views; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- DashboardsSecurity Monitoring and Automation, Chapter 1: DashboardsAlso: Security Monitoring and Automation, Chapter 1: A text dashboard; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Packet capturesSecurity Monitoring and Automation, Chapter 6: Packet captureAlso: Security Monitoring and Automation, Chapter 6: Packet analyzers; Security Monitoring and Automation, Chapter 6: Capture the night; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- File/log integrityEndpoint and Application Security, Chapter 5: File integrity with AIDEAlso: Incident Response and Resilience, Chapter 6: One routine for every item; Incident Response and Resilience, Chapter 5: Chain of custody; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- System imageIncident Response and Resilience, Chapter 6: System imagesAlso: Incident Response and Resilience, Chapter 6: One routine for every item; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Memory dumpIncident Response and Resilience, Chapter 6: Memory dumpsAlso: Incident Response and Resilience, Chapter 5: The order of volatility; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Bit-level copyIncident Response and Resilience, Chapter 6: Bit-level copiesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- SnapshotIncident Response and Resilience, Chapter 6: SnapshotsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- StakeholdersIncident Response and Resilience, Chapter 5: Legal holdAlso: Incident Response and Resilience, Chapter 2: The response team; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Human Resources (HR)Identity and Access Management, Chapter 1: Identity proofingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- AccountsIdentity and Access Management, Chapter 1: Stale credentialsAlso: Identity and Access Management, Chapter 1: Worked example: the November account check; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- LegalIncident Response and Resilience, Chapter 5: Legal holdAlso: Incident Response and Resilience, Chapter 5: E-discovery; Incident Response and Resilience, Chapter 5: Law enforcement; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
- Log-parsing techniquesSecurity Monitoring and Automation, Chapter 3: Why parseAlso: Security Monitoring and Automation, Chapter 3: Two formats, one table; Security Monitoring and Automation, Chapter 3: parse.py; CompTIA Security+ SY0-801 Exam Prep, Chapter 7: 4.6 to 4.8 Automation, response and evidence
5.0 Security Program Management and Oversight (14% of the exam)
5.1 Explain the importance of governance, risk, and compliance artifacts.
- GuidelinesGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.1 Governance documents
- BenchmarksGovernance, Risk and Compliance, Chapter 2: Benchmarks and reference architecturesAlso: Vulnerability, Asset and Change Management, Chapter 7: Benchmarks; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.1 Governance documents
- AdvisoriesSecurity Fundamentals, Chapter 5: Intelligence sources
- Implementation guidesVulnerability, Asset and Change Management, Chapter 7: Benchmarks
- Reference architectureGovernance, Risk and Compliance, Chapter 2: Benchmarks and reference architecturesAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.1 Governance documents
- StandardsGovernance, Risk and Compliance, Chapter 1: The policy pyramid
- BaselinesGovernance, Risk and Compliance, Chapter 2: Benchmarks and reference architecturesAlso: Vulnerability, Asset and Change Management, Chapter 7: Benchmarks
- PasswordsGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: Identity and Access Management, Chapter 2: Password rules that work; Identity and Access Management, Chapter 2: Worked example: Kettle & Crane's new password policy
- Physical securityGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: Security Fundamentals, Chapter 2: Four categories: how a control works
- Request for comments (RFC)Governance, Risk and Compliance, Chapter 2: RFCsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.1 Governance documents
- EncryptionCryptography and PKI, Chapter 11: Choosing the levelAlso: Cryptography and PKI, Chapter 11: The levels, outside in
- ProceduresGovernance, Risk and Compliance, Chapter 1: The policy pyramid
- Standard operating procedure (SOP)Vulnerability, Asset and Change Management, Chapter 10: The peopleAlso: Governance, Risk and Compliance, Chapter 1: The policy pyramid
- RunbooksGovernance, Risk and Compliance, Chapter 2: Runbooks
- PlansGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: Governance, Risk and Compliance, Chapter 6: What a BIA is
- Business continuityGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: Governance, Risk and Compliance, Chapter 6: What a BIA is; Incident Response and Resilience, Chapter 11: RTO and RPO: two questions for every system
- Disaster recoveryGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: Incident Response and Resilience, Chapter 10: Recovery sites; Incident Response and Resilience, Chapter 11: Testing the plan
- PoliciesGovernance, Risk and Compliance, Chapter 1: The policy pyramid
- Bring your own device (BYOD)Governance, Risk and Compliance, Chapter 2: BYODAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.1 Governance documents
- Acceptable use policy (AUP)Governance, Risk and Compliance, Chapter 2: Acceptable use
- Clean deskGovernance, Risk and Compliance, Chapter 2: Clean deskAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.1 Governance documents
- Information securityGovernance, Risk and Compliance, Chapter 1: The policy pyramid
- Incident responseGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: Incident Response and Resilience, Chapter 2: What preparation means
- Data classification and retentionCloud and Data Security, Chapter 5: Classification levelsAlso: Cloud and Data Security, Chapter 11: Retention and retention requirements
- Access controlGovernance, Risk and Compliance, Chapter 1: The policy pyramidAlso: Identity and Access Management, Chapter 2: Proving who you are
- Data disposalCloud and Data Security, Chapter 11: DisposalAlso: Vulnerability, Asset and Change Management, Chapter 1: Decommissioning and sanitization
- Vulnerability disclosureGovernance, Risk and Compliance, Chapter 2: Vulnerability disclosureAlso: Governance, Risk and Compliance, Chapter 2: Publishing it with security.txt; Vulnerability, Asset and Change Management, Chapter 11: Bug bounties and responsible disclosure; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.1 Governance documents
- PrivacyCloud and Data Security, Chapter 11: The data lifecycleAlso: Governance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject
5.2 Explain the impact of risk management processes on the security of the organization.
- Risk identificationGovernance, Risk and Compliance, Chapter 3: The four stepsAlso: Security Fundamentals, Chapter 5: Intelligence sources
- Asset identificationVulnerability, Asset and Change Management, Chapter 1: You can't protect what you don't know aboutAlso: Governance, Risk and Compliance, Chapter 3: What a risk is
- Stakeholder ownershipGovernance, Risk and Compliance, Chapter 3: The risk ownerAlso: Vulnerability, Asset and Change Management, Chapter 1: Ownership
- Risk assessmentGovernance, Risk and Compliance, Chapter 3: The four stepsAlso: Security Fundamentals, Chapter 5: Likelihood and impact
- ScoringGovernance, Risk and Compliance, Chapter 3: The risk registerAlso: Security Fundamentals, Chapter 5: Ranking the risks
- CategorizationGovernance, Risk and Compliance, Chapter 3: The risk register
- Risk analysisGovernance, Risk and Compliance, Chapter 4: Two ways to measure a risk
- ImpactSecurity Fundamentals, Chapter 5: Likelihood and impactAlso: Governance, Risk and Compliance, Chapter 3: The risk register; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- Likelihood/probabilitySecurity Fundamentals, Chapter 5: Likelihood and impactAlso: Governance, Risk and Compliance, Chapter 3: The risk register
- OwnerGovernance, Risk and Compliance, Chapter 3: The risk ownerAlso: Governance, Risk and Compliance, Chapter 3: The risk register; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- Current mitigationsGovernance, Risk and Compliance, Chapter 5: Checking the register against the appetiteAlso: Governance, Risk and Compliance, Chapter 5: Inherent and residual risk
- Qualitative vs. quantitativeGovernance, Risk and Compliance, Chapter 4: Two ways to measure a risk
- Risk registerGovernance, Risk and Compliance, Chapter 3: The risk registerAlso: Governance, Risk and Compliance, Chapter 3: Printing the register; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- CommunicationGovernance, Risk and Compliance, Chapter 3: The four stepsAlso: Governance, Risk and Compliance, Chapter 3: The risk register
- ReviewsGovernance, Risk and Compliance, Chapter 3: The risk registerAlso: Governance, Risk and Compliance, Chapter 3: Printing the register
- Risk treatmentGovernance, Risk and Compliance, Chapter 5: Four choices
- TransferringGovernance, Risk and Compliance, Chapter 5: Four choices
- AcceptingGovernance, Risk and Compliance, Chapter 5: Four choices
- AvoidingGovernance, Risk and Compliance, Chapter 5: Four choices
- MitigatingGovernance, Risk and Compliance, Chapter 5: Four choices
- Business-level considerationsGovernance, Risk and Compliance, Chapter 6: What a BIA isAlso: Governance, Risk and Compliance, Chapter 5: Inherent and residual risk
- Business impact analysisGovernance, Risk and Compliance, Chapter 6: What a BIA isAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- Risk appetiteGovernance, Risk and Compliance, Chapter 5: Risk appetiteAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- Residual riskGovernance, Risk and Compliance, Chapter 5: Inherent and residual riskAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- Stakeholder involvementGovernance, Risk and Compliance, Chapter 3: The risk ownerAlso: Governance, Risk and Compliance, Chapter 1: Boards, committees and regulators
- Management oversightGovernance, Risk and Compliance, Chapter 1: Boards, committees and regulators
- RegulatoryGovernance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meetsAlso: Governance, Risk and Compliance, Chapter 9: What compliance is
- LegalGovernance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meetsAlso: Governance, Risk and Compliance, Chapter 9: What compliance is
- Single loss expectancy (SLE)Governance, Risk and Compliance, Chapter 4: Step 1: the cost of one incidentAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- Annualized loss expectancy (ALE)Governance, Risk and Compliance, Chapter 4: Step 2: the cost per yearAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
- Annualized rate of occurrence (ARO)Governance, Risk and Compliance, Chapter 4: Step 2: the cost per yearAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.2 Risk management
5.3 Explain the assessment and management processes associated with third- party risk.
- Vendor selectionGovernance, Risk and Compliance, Chapter 7: Why vendors are a riskAlso: Governance, Risk and Compliance, Chapter 7: Four procurement documents
- Request for proposal (RFP)Governance, Risk and Compliance, Chapter 7: Four procurement documentsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Request for information (RFI)Governance, Risk and Compliance, Chapter 7: Four procurement documentsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Request for quote (RFQ)Governance, Risk and Compliance, Chapter 7: Four procurement documentsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Expression of interest (EOI)Governance, Risk and Compliance, Chapter 7: Four procurement documentsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Due diligenceGovernance, Risk and Compliance, Chapter 7: Due diligenceAlso: Governance, Risk and Compliance, Chapter 7: Scoring the questionnaire; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Conflict of interestGovernance, Risk and Compliance, Chapter 7: Conflict of interestAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Agreement typesGovernance, Risk and Compliance, Chapter 8: Why the paperwork matters
- Service-level agreement (SLA)Governance, Risk and Compliance, Chapter 8: SLA and SLO: promises with numbersAlso: Governance, Risk and Compliance, Chapter 8: Checking the SLA with a script; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Service-level objective (SLO)Governance, Risk and Compliance, Chapter 8: SLA and SLO: promises with numbersAlso: Governance, Risk and Compliance, Chapter 8: Checking the SLA with a script; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Memorandum of understanding (MOU)Governance, Risk and Compliance, Chapter 8: MOU and MOA: agreements between partnersAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Memorandum of agreement (MOA)Governance, Risk and Compliance, Chapter 8: MOU and MOA: agreements between partnersAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Non-disclosure agreement (NDA)Governance, Risk and Compliance, Chapter 8: NDA: before any details are sharedAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Master services agreement (MSA)Governance, Risk and Compliance, Chapter 8: MSA: the shared termsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Statement of work (SOW)Governance, Risk and Compliance, Chapter 8: SOW: one piece of workAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Vendor monitoringGovernance, Risk and Compliance, Chapter 7: Why vendors are a riskAlso: Governance, Risk and Compliance, Chapter 8: Right to audit; Governance, Risk and Compliance, Chapter 10: Audits and assessments
- Right to auditGovernance, Risk and Compliance, Chapter 8: Right to auditAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Service-level monitoringGovernance, Risk and Compliance, Chapter 8: Checking the SLA with a scriptAlso: Governance, Risk and Compliance, Chapter 8: SLA and SLO: promises with numbers
- Vendor registryCloud and Data Security, Chapter 9: Keep a register
- Vendor assessmentGovernance, Risk and Compliance, Chapter 7: Due diligenceAlso: Governance, Risk and Compliance, Chapter 7: Scoring the questionnaire
- Compliance attestationGovernance, Risk and Compliance, Chapter 9: Attestation
- Penetration testingVulnerability, Asset and Change Management, Chapter 11: Scans find, tests proveAlso: Governance, Risk and Compliance, Chapter 8: Rules of engagement
- Limitations/constraintsGovernance, Risk and Compliance, Chapter 8: Vendor lock-inAlso: Governance, Risk and Compliance, Chapter 7: Why vendors are a risk
- Staffing limitationsGovernance, Risk and Compliance, Chapter 8: Rules of engagement
- Resource availabilityGovernance, Risk and Compliance, Chapter 8: Rules of engagement
- EnvironmentGovernance, Risk and Compliance, Chapter 8: Rules of engagement
- Legal and regulatory factorsGovernance, Risk and Compliance, Chapter 9: What compliance isAlso: Governance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meets
- Geography/jurisdictionCloud and Data Security, Chapter 10: Data sovereigntyAlso: Cloud and Data Security, Chapter 10: Geofencing
- Financial/return on investment (ROI)Governance, Risk and Compliance, Chapter 4: Is a control worth it?
- Vendor lock-inGovernance, Risk and Compliance, Chapter 8: Vendor lock-inAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
- Assurance mechanismsGovernance, Risk and Compliance, Chapter 9: AttestationAlso: Governance, Risk and Compliance, Chapter 10: Audits and assessments
- Rules of engagementGovernance, Risk and Compliance, Chapter 8: Rules of engagementAlso: Vulnerability, Asset and Change Management, Chapter 11: Scans find, tests prove; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.3 Third-party risk
5.4 Summarize elements of effective security compliance.
- Compliance trainingAttacks and Indicators, Chapter 11: Onboarding and the learning management systemAlso: Attacks and Indicators, Chapter 11: Phishing simulations
- Data handlingCloud and Data Security, Chapter 5: Data that needs special careAlso: Governance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject; Cloud and Data Security, Chapter 5: Labeling
- Anti-money laundering/counter- terrorism financing (AML/CTF)Governance, Risk and Compliance, Chapter 9: Anti-money laundering
- Anti-briberyGovernance, Risk and Compliance, Chapter 9: Anti-briberyAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.4 Compliance
- Compliance monitoringGovernance, Risk and Compliance, Chapter 9: What compliance isAlso: Governance, Risk and Compliance, Chapter 9: Attestation
- AttestationsGovernance, Risk and Compliance, Chapter 9: Attestation
- AcknowledgementsGovernance, Risk and Compliance, Chapter 9: AttestationAlso: Governance, Risk and Compliance, Chapter 2: Acceptable use
- Consequences of non-complianceGovernance, Risk and Compliance, Chapter 9: Consequences of non-compliance
- Reputational damageGovernance, Risk and Compliance, Chapter 9: Consequences of non-compliance
- FinancialGovernance, Risk and Compliance, Chapter 9: Consequences of non-compliance
- LegalGovernance, Risk and Compliance, Chapter 9: Consequences of non-complianceAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.4 Compliance
- ContractualGovernance, Risk and Compliance, Chapter 9: Consequences of non-compliance
- SanctionsGovernance, Risk and Compliance, Chapter 9: Consequences of non-complianceAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.4 Compliance
- Loss of licenseGovernance, Risk and Compliance, Chapter 9: Consequences of non-complianceAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.4 Compliance
- PrivacyCloud and Data Security, Chapter 11: The data lifecycleAlso: Governance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject; Cloud and Data Security, Chapter 11: The right to be forgotten
- Right to be forgottenCloud and Data Security, Chapter 11: The right to be forgottenAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.4 Compliance
- Opt-in or opt-outCloud and Data Security, Chapter 11: Opt-in: ask first
- Data correctionGovernance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject
- Processing restrictionsGovernance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject
- Processing preventionGovernance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject
- Controller vs. processorCloud and Data Security, Chapter 9: Controller, processor and subprocessorAlso: Governance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject
- OwnershipCloud and Data Security, Chapter 9: Owner, steward and custodianAlso: Governance, Risk and Compliance, Chapter 9: Data roles, retention and the data subject
- Legal complianceIncident Response and Resilience, Chapter 5: Legal holdAlso: Cloud and Data Security, Chapter 11: Retention and retention requirements
- Legal holdIncident Response and Resilience, Chapter 5: Legal holdAlso: Incident Response and Resilience, Chapter 5: E-discovery; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.4 Compliance
- Legal ordersIncident Response and Resilience, Chapter 5: Law enforcementAlso: Incident Response and Resilience, Chapter 5: E-discovery
- Data retention requirementsCloud and Data Security, Chapter 11: Retention and retention requirements
5.5 Explain concepts associated with audit and assessment activities.
- Data gatheringGovernance, Risk and Compliance, Chapter 10: Collecting evidenceAlso: Governance, Risk and Compliance, Chapter 10: Sampling
- SamplingGovernance, Risk and Compliance, Chapter 10: SamplingAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- Questionnaires/surveysGovernance, Risk and Compliance, Chapter 10: Collecting evidence
- InterviewsGovernance, Risk and Compliance, Chapter 10: Collecting evidence
- AssertionGovernance, Risk and Compliance, Chapter 10: Collecting evidence
- Reference sourcesSecurity Fundamentals, Chapter 11: Why frameworksAlso: Security Fundamentals, Chapter 11: MITRE ATT&CK
- MITRE ATT&CKSecurity Fundamentals, Chapter 11: MITRE ATT&CKAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- Cyber Kill ChainSecurity Fundamentals, Chapter 11: The Cyber Kill ChainAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- Diamond Model of Intrusion AnalysisSecurity Fundamentals, Chapter 11: The Diamond Model
- ScopingGovernance, Risk and Compliance, Chapter 10: The audit committee and the audit charterAlso: Governance, Risk and Compliance, Chapter 8: Rules of engagement
- Audit charterGovernance, Risk and Compliance, Chapter 10: The audit committee and the audit charterAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- FrequencyGovernance, Risk and Compliance, Chapter 10: The audit committee and the audit charterAlso: Governance, Risk and Compliance, Chapter 3: The four steps
- Engagement typesGovernance, Risk and Compliance, Chapter 10: Audits and assessments
- Gap analysisGovernance, Risk and Compliance, Chapter 10: Gap analysisAlso: Governance, Risk and Compliance, Chapter 10: Self-assessment; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- InternalGovernance, Risk and Compliance, Chapter 10: Audits and assessments
- ComplianceGovernance, Risk and Compliance, Chapter 9: What compliance isAlso: Governance, Risk and Compliance, Chapter 10: Audits and assessments
- Audit committeeGovernance, Risk and Compliance, Chapter 10: The audit committee and the audit charterAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- Self-assessmentsGovernance, Risk and Compliance, Chapter 10: Self-assessment
- ExternalGovernance, Risk and Compliance, Chapter 10: Audits and assessments
- ExaminationsGovernance, Risk and Compliance, Chapter 10: Audits and assessments
- AssessmentsGovernance, Risk and Compliance, Chapter 10: Audits and assessmentsAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- RegulatoryGovernance, Risk and Compliance, Chapter 10: Audits and assessments
- Independent third-party auditsGovernance, Risk and Compliance, Chapter 10: Audits and assessmentsAlso: Governance, Risk and Compliance, Chapter 9: Attestation
- BenchmarkingGovernance, Risk and Compliance, Chapter 10: Audits and assessments
- Penetration testingVulnerability, Asset and Change Management, Chapter 11: Scans find, tests proveAlso: Vulnerability, Asset and Change Management, Chapter 11: The phases of a test
- Known environmentVulnerability, Asset and Change Management, Chapter 11: Known, partially known, unknownAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- Unknown environmentVulnerability, Asset and Change Management, Chapter 11: Known, partially known, unknownAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- Partially known environmentVulnerability, Asset and Change Management, Chapter 11: Known, partially known, unknown
- PhysicalVulnerability, Asset and Change Management, Chapter 11: Known, partially known, unknown
- OffensiveVulnerability, Asset and Change Management, Chapter 11: Known, partially known, unknown
- DefensiveVulnerability, Asset and Change Management, Chapter 11: Known, partially known, unknown
- IntegratedVulnerability, Asset and Change Management, Chapter 11: Known, partially known, unknown
- ReconnaissanceVulnerability, Asset and Change Management, Chapter 11: The phases of a testAlso: Vulnerability, Asset and Change Management, Chapter 11: Passive reconnaissance; Vulnerability, Asset and Change Management, Chapter 11: Active reconnaissance; CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- PassiveVulnerability, Asset and Change Management, Chapter 11: Passive reconnaissanceAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- ActiveVulnerability, Asset and Change Management, Chapter 11: Active reconnaissanceAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.5 Audits and assessments
- Frameworks and standardsGovernance, Risk and Compliance, Chapter 10: Self-assessmentAlso: Security Fundamentals, Chapter 11: Why frameworks
- Industry-based standardsGovernance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meets
- International standardsGovernance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meets
- Region-specific standardsGovernance, Risk and Compliance, Chapter 9: The rules Kettle & Crane meetsAlso: Cloud and Data Security, Chapter 10: Data sovereignty
- Functional testingGovernance, Risk and Compliance, Chapter 10: Collecting evidence
- Behavioral testingGovernance, Risk and Compliance, Chapter 10: Collecting evidence
5.6 Given a scenario, apply security awareness concepts to improve organizational security.
- Types of trainingAttacks and Indicators, Chapter 11: Why people need a program, not a posterAlso: Attacks and Indicators, Chapter 11: Onboarding and the learning management system
- Initial/onboardingAttacks and Indicators, Chapter 11: Onboarding and the learning management system
- OngoingAttacks and Indicators, Chapter 11: Onboarding and the learning management systemAlso: Attacks and Indicators, Chapter 11: Worked example: a year's plan for Kettle & Crane
- TargetedAttacks and Indicators, Chapter 11: Onboarding and the learning management systemAlso: Attacks and Indicators, Chapter 11: Phishing simulations
- CorrectiveAttacks and Indicators, Chapter 11: Phishing simulations
- Delivery mechanismsAttacks and Indicators, Chapter 11: Onboarding and the learning management system
- Learning management system (LMS)Attacks and Indicators, Chapter 11: Onboarding and the learning management systemAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.6 Security awareness
- Self-service portalsAttacks and Indicators, Chapter 11: Onboarding and the learning management system
- One-to-oneAttacks and Indicators, Chapter 11: Onboarding and the learning management system
- One-to-manyAttacks and Indicators, Chapter 11: Onboarding and the learning management system
- Reporting and monitoring of effectivenessAttacks and Indicators, Chapter 11: Measuring behaviorAlso: Attacks and Indicators, Chapter 11: Worked example: a year's plan for Kettle & Crane
- MetricsAttacks and Indicators, Chapter 11: Measuring behaviorAlso: Attacks and Indicators, Chapter 11: Phishing simulations; Attacks and Indicators, Chapter 11: Worked example: a year's plan for Kettle & Crane
- Managerial reportsAttacks and Indicators, Chapter 11: Worked example: a year's plan for Kettle & Crane
- Personnel behavior risk scoringAttacks and Indicators, Chapter 11: Measuring behavior
- Common training topicsAttacks and Indicators, Chapter 11: Why people need a program, not a posterAlso: Attacks and Indicators, Chapter 11: Removable media, situational awareness and OPSEC
- Social engineeringAttacks and Indicators, Chapter 4: Attacking the person, not the computerAlso: Attacks and Indicators, Chapter 4: The phishing family
- Emerging security topicsAttacks and Indicators, Chapter 4: Deepfakes
- Password and credential managementIdentity and Access Management, Chapter 2: Password rules that workAlso: Attacks and Indicators, Chapter 11: Onboarding and the learning management system
- Remote work/teleworking/hybridAttacks and Indicators, Chapter 11: Removable media, situational awareness and OPSEC
- BYODGovernance, Risk and Compliance, Chapter 2: BYOD
- Business email compromise (BEC)Attacks and Indicators, Chapter 4: Business email compromiseAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.6 Security awareness
- Removable media and cablesAttacks and Indicators, Chapter 11: Removable media, situational awareness and OPSEC
- Situational awarenessAttacks and Indicators, Chapter 11: Removable media, situational awareness and OPSECAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.6 Security awareness
- Operational securityAttacks and Indicators, Chapter 11: Removable media, situational awareness and OPSECAlso: CompTIA Security+ SY0-801 Exam Prep, Chapter 8: 5.6 Security awareness
Objectives text: CompTIA Security+ SY0-801 Exam Objectives, version 2.0, published by CompTIA. CompTIA® and Security+® are registered trademarks of CompTIA, Inc. FiftyPage is not affiliated with, sponsored by or endorsed by CompTIA, and this course is not official CompTIA study material.