CompTIA Security+
Certification Exam
Objectives
EXAM NUMBER: SY0-601
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Guidelines and tips
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
the objectives of CompTIA exam "security plus"
Typology: Cheat Sheet
2021/2022
1 / 24
This page cannot be seen from the preview
Don't miss anything!
Related documents
Partial preview of the text
Download Security plus exam objectives and more Cheat Sheet Computer science in PDF only on Docsity!
CompTIA Security+
Certification Exam
Objectives
EXAM NUMBER: SY0-
Candidates are encouraged to use this document to help prepare for the CompTIA Security+ (SY0-601) certification exam. The CompTIA Security+ certification exam will verify the successful candidate has the knowledge and skills required to:
- Assess the security posture of an enterprise environment and recommend **and implement appropriate security solutions
- Monitor and secure hybrid environments, including cloud, mobile, and IoT
- Operate with an awareness of applicable laws and policies, including** **principles of governance, risk, and compliance
- Identify, analyze, and respond to security events and incidents** This is equivalent to two years of hands-on experience working in a security/systems administrator job role. These content examples are meant to clarify the test objectives and should not be construed as a comprehensive listing of all the content of this examination. EXAM DEVELOPMENT CompTIA exams result from subject matter expert workshops and industry-wide survey results regarding the skills and knowledge required of an IT professional. CompTIA AUTHORIZED MATERIALS USE POLICY CompTIA Certifications, LLC is not affiliated with and does not authorize, endorse or condone utilizing any content provided by unauthorized third-party training sites (aka “brain dumps”). Individuals who utilize such materials in preparation for any CompTIA examination will have their certifications revoked and be suspended from future testing in accordance with the CompTIA Candidate Agreement. In an effort to more clearly communicate CompTIA’s exam policies on use of unauthorized study materials, CompTIA directs all certification candidates to the CompTIA Certification Exam Policies. Please review all CompTIA policies before beginning the study process for any CompTIA exam. Candidates will be required to abide by the CompTIA Candidate Agreement. If a candidate has a question as to whether study materials are considered unauthorized (aka “brain dumps”), he/she should contact CompTIA at [email protected] to confirm. PLEASE NOTE The lists of examples provided in bulleted format are not exhaustive lists. Other examples of technologies, processes, or tasks pertaining to each objective may also be included on the exam although not listed or covered in this objectives document. CompTIA is constantly reviewing the content of our exams and updating test questions to be sure our exams are current, and the security of the questions is protected. When necessary, we will publish updated exams based on testing exam objectives. Please know that all related exam preparation materials will still be valid.
About the Exam
- Phishing
- Smishing
- Vishing
- Spam
- Spam over Internet messaging (SPIM)
- Spear phishing
- Dumpster diving
- Shoulder surfing
- Pharming
- Tailgating
- Eliciting information
- Whaling
- Prepending
- Identity fraud
- Invoice scams
- Credential harvesting
- Reconnaissance
- Hoax
- Impersonation
- Watering hole attack
- Typo squatting
- Influence campaigns
- Hybrid warfare
- Social media
- Principles (reasons for effectiveness)
- Authority
- Intimidation
- Consensus
- Scarcity
- Familiarity
- Trust
- Urgency
- Influence campaigns
- Malware
- Ransomware
- Trojans
- Worms
- Potentially unwanted programs (PUPs)
- Fileless virus
- Command and control
- Bots
- Crypto malware
- Logic bombs
- Spyware
- Keyloggers
- Remote access Trojan (RAT)
- Rootkit
- Backdoor
- Password attacks
- Spraying
- Dictionary
- Brute force
- Offline
- Online
- Rainbow tables
- Plaintext/unencrypted
- Physical attacks
- Malicious universal serial bus (USB) cable
- Malicious flash drive
- Card cloning
- Skimming
- Adversarial artificial intelligence (AI)
- Tainted training data for machine learning (ML)
- Security of machine learning algorithms
- Supply-chain attacks
- Cloud-based vs. on-premises attacks
- Cryptographic attacks
- Birthday
- Collision
- Downgrade
- Adversarial artificial intelligence (AI)
- Password attacks
1.0 Threats, Attacks and Vulnerabilities
Compare and contrast different types of social engineering techniques.
Given a scenario, analyze potential indicators
to determine the type of attack.
- Privilege escalation
- Cross-site scripting
- Injections
- Structured query language (SQL)
- Dynamic link library (DLL)
- Lightweight directory access protocol (LDAP)
- Extensible markup language (XML)
- Pointer/object dereference
- Directory traversal
- Buffer overflows
- Race conditions
- Time of check/time of use
- Error handling
- Improper input handling
- Replay attack
- Session replays
- Integer overflow
- Request forgeries
- Server-side
- Client-side
- Cross-site
- Application programming interface (API) attacks
- Resource exhaustion
- Memory leak
- Secure sockets layer (SSL) stripping
- Driver manipulation
- Shimming
- Refactoring
- Pass the hash
- Race conditions
- Wireless
- Evil twin
- Rogue access point
- Bluesnarfing
- Bluejacking
- Disassociation
- Jamming
- Radio frequency identifier (RFID)
- Near field communication (NFC)
- Initialization vector (IV)
- Man in the middle
- Man in the browser
- Layer 2 attacks
- Address resolution protocol (ARP) poisoning
- Media access control (MAC) flooding
- MAC cloning
- Domain name system (DNS)
- Domain hijacking
- DNS poisoning
- Universal resource locator (URL) redirection - Domain reputation
- Distributed denial of service (DDoS)
- Network
- Application
- Operational technology (OT)
- Malicious code or script execution
- PowerShell
- Python
- Bash
- Macros
- Virtual Basic for Applications (VBA)
- Distributed denial of service (DDoS)
Given a scenario, analyze potential indicators
associated with application attacks.
Given a scenario, analyze potential indicators
associated with network attacks.
1.0 Attacks, Threats, and Vulnerabilities
- Penetration testing
- White box
- Black box
- Gray box
- Rules of engagement
- Lateral movement
- Privilege escalation
- Persistence
- Cleanup
- Bug bounty
- Pivoting
- Passive and active reconnaissance
- Drones/unmanned aerial vehicle (UAV)
- War flying
- War driving
- Footprinting
- OSINT
- Exercise types
- Red team
- Blue team
- White team
- Purple team
- Passive and active reconnaissance
- Threat hunting
- Intelligence fusion
- Threat feeds
- Advisories and bulletins
- Maneuver
- Vulnerability scans
- False positives
- False negatives
- Log reviews
- Credentialed vs. non-credentialed
- Intrusive vs. non-intrusive
- Application
- Web application
- Network
- Common Vulnerabilities and Exposures (CVE)/Common Vulnerability Scoring System (CVSS)
- Configuration review
- Syslog/Security information and event management (SIEM) - Review reports - Packet capture - Data inputs - User behavior analysis - Sentiment analysis - Security monitoring - Log aggregation - Log collectors
- Security orchestration, automation, response (SOAR)
Explain the techniques used in penetration testing.
Summarize the techniques used in security assessments.
1.0 Attacks, Threats, and Vulnerabilities
- Configuration management
- Diagrams
- Baseline configuration
- Standard naming conventions
- Internet protocol (IP) schema
- Data sovereignty
- Data protection
- Data loss prevention (DLP)
- Masking
- Encryption
- At rest
- In transit/motion
- In processing
- Tokenization
- Rights management
- Hardware security module (HSM)
- Geographical considerations
- Cloud access security broker (CASB)
- Response and recovery controls
- Secure Sockets Layer (SSL)/Transport Layer Security (TLS) inspection
- Hashing
- API considerations
- Site resiliency
- Hot site
- Cold site
- Warm site
- Deception and disruption
- Honeypots
- Honeyfiles
- Honeynets
- Fake telemetry
- DNS sinkhole
- Deception and disruption
- Cloud models
- Infrastructure as a service (IaaS)
- Platform as a service (PaaS)
- Software as a service (SaaS)
- Anything as a service (XaaS)
- Public
- Community
- Private
- Hybrid
- Cloud service providers
- Managed service provider (MSP)/ Managed security service provider (MSSP)
- On-premises vs. off-premises
- Fog computing
- Edge computing
- Thin client
- Containers
- Micro-services/API
- Infrastructure as code
- Software-defined networking (SDN)
- Software-defined visibility (SDV)
- Serverless architecture
- Services integration
- Resource policies
- Transit gateway
- Virtualization
- Virtual machine (VM) sprawl avoidance
- VM escape protection 2.0 Architecture and Design
- Infrastructure as code
Explain the importance of security concepts
in an enterprise environment.
Summarize virtualization and cloud computing concepts.
Given a scenario, implement cybersecurity resilience.
Explain the security implications of embedded and specialized systems.
- Redundancy
- Geographic dispersal
- Disk
- Redundant array of inexpensive disks (RAID) levels
- Multipath
- Network
- Load balancers
- Network interface card (NIC) teaming
- Power
- Uninterruptible power supply (UPS)
- Generator
- Dual supply
- Managed power distribution units (PDUs) - Replication - Storage area network (SAN) - VM - On-premises vs. cloud - Backup types - Full - Incremental - Snapshot - Differential - Tape - Disk - Copy - Network attached storage (NAS) - SAN - Cloud - Image - Online vs. offline - Offsite storage - Distance considerations
- Non-persistence
- Revert to known state
- Last known good configuration
- Live boot media
- High availability
- Scalability
- Restoration order
- Diversity
- Technologies
- Vendors
- Crypto
- Controls
- Embedded systems
- Raspberry Pi
- Field programmable gate array (FPGA)
- Arduino
- System control and data acquisition (SCADA)/industrial control system (ICS) - Facilities - Industrial - Manufacturing - Energy - Logistics
- Internet of Things (IoT)
- Sensors
- Smart devices
- Wearables
- Facility automation
- Weak defaults
- Specialized
- Medical systems
- Vehicles
- Aircraft
- Smart meters
- Voice over IP (VoIP)
- Heating, ventilation, air conditioning (HVAC)
- Drones/AVs
- Multifunction printer (MFP)
- Real-time operating system (RTOS)
- Surveillance systems
- System on chip (SoC)
- Communication considerations
- 5G
- Narrow-band
- Baseband radio
- Subscriber identity module (SIM) cards
- Zigbee
- Specialized
- Constraints
- Power
- Compute
- Network
- Crypto
- Inability to patch
- Authentication
- Range
- Cost
- Implied trust
2.0 Architecture and Design
2.0 Architecture and Design
Explain the importance of physical security controls.
Summarize the basics of cryptographic concepts.
- Bollards/barricades
- Mantraps
- Badges
- Alarms
- Signage
- Cameras
- Motion recognition
- Object detection
- Closed-circuit television (CCTV)
- Industrial camouflage
- Personnel
- Guards
- Robot sentries
- Reception
- Two-person integrity/control
- Locks
- Biometrics
- Electronic
- Physical
- Cable locks
- Biometrics
- USB data blocker
- Lighting
- Fencing
- Fire suppression
- Sensors
- Motion detection
- Noise detection
- Proximity reader
- Moisture detection
- Cards
- Temperature
- Drones/UAV
- Visitor logs
- Faraday cages
- Air gap
- Demilitarized zone (DMZ)
- Protected cable distribution
- Secure areas
- Air gap
- Vault
- Safe
- Hot aisle
- Cold aisle
- Secure data destruction
- Burning
- Shredding
- Pulping
- Pulverizing
- Degaussing
- Third-party solutions
- Digital signatures
- Key length
- Key stretching
- Salting
- Hashing
- Key exchange
- Elliptical curve cryptography
- Perfect forward secrecy
- Quantum
- Communications
- Computing
- Post-quantum
- Ephemeral
- Modes of operation
- Authenticated
- Unauthenticated
- Counter
- Blockchain
- Public ledgers
- Cipher suites
- Stream
- Block
- Symmetric vs. asymmetric
- Lightweight cryptography
- Steganography
- Audio
- Video
- Image
- Homomorphic encryption
- Common use cases
- Low power devices
- Low latency
- High resiliency
- Supporting confidentiality
- Supporting integrity
- Supporting obfuscation
- Supporting authentication
- Supporting non-repudiation
- Resource vs. security constraints
- Blockchain
- Limitations
- Speed
- Size
- Weak keys
- Time
- Longevity
- Predictability
- Reuse
- Entropy
- Computational overheads
- Resource vs. security constraints
Given a scenario, implement secure network designs.
Given a scenario, install and configure wireless security settings.
- Load balancing
- Active/active
- Active/passive
- Scheduling
- Virtual IP
- Persistence
- Network segmentation
- Virtual local area network (VLAN)
- DMZ
- East-west traffic
- Extranet
- Intranet
- Zero trust
- Virtual private network (VPN)
- Always on
- Split tunnel vs. full tunnel
- Remote access vs. site-to-site
- IPSec
- SSL/TLS
- HTML
- Layer 2 tunneling protocol (L2TP)
- DNS
- Network access control (NAC)
- Agent and agentless
- Out-of-band management
- Port security
- Broadcast storm prevention
- Bridge Protocol Data Unit (BPDU) guard
- Loop prevention
- Dynamic Host Configuration Protocol (DHCP) snooping
- Media access control (MAC) filtering
- Network appliances
- Jump servers
- Proxy servers
- Forward
- Reverse
- Network-based intrusion detection system (NIDS)/network-based intrusion prevention system (NIPS) - Signature based - Heuristic/behavior - Anomaly - Inline vs. passive
- HSM
- Sensors
- Collectors
- Aggregators
- Firewalls
- Web application firewall (WAF) - Next-generation firewall
- Agent and agentless
- Stateful
- Stateless
- Unified threat management (UTM)
- Network address translation (NAT) gateway
- Content/URL filter
- Open-source vs. proprietary
- Hardware vs. software
- Appliance vs. host-based vs. virtual
- Access control list (ACL)
- Route security
- Quality of service (QoS)
- Implications of IPv
- Port spanning/port mirroring
- Port taps
- Monitoring services
- File integrity monitors
- Cryptographic protocols
- WiFi protected access II (WPA2)
- WiFi protected access III (WPA3)
- Counter-mode/CBC-MAC protocol (CCMP)
- Simultaneous Authentication of Equals (SAE)
- Authentication protocols
- Extensible Authentication Protocol (EAP)
- Protected Extensible Application Protocol (PEAP)
- EAP-FAST
- EAP-TLS
- EAP-TTLS
- IEEE 802.1X
- Remote Authentication Dial-in User Server (RADIUS) Federation
- Methods
- Pre-shared key (PSK) vs. Enterprise vs. Open
- WiFi Protected Setup (WPS)
- Captive portals
- Installation considerations
- Site surveys
- Heat maps
- WiFi analyzers
- Channel overlays
- Wireless access point (WAP) placement
- Controller and access point security
3.0 Implementation
3.0 Implementation
Given a scenario, implement secure mobile solutions.
Given a scenario, apply cybersecurity solutions to the cloud.
- Connection methods and receivers
- Cellular
- WiFi
- Bluetooth
- NFC
- Infrared
- USB
- Point to point
- Point to multipoint
- Global Positioning System (GPS)
- RFID
- Mobile device management (MDM)
- Application management
- Content management
- Remote wipe
- Geofencing
- Geolocation
- Screen locks
- Push notifications
- Passwords and pins
- Biometrics
- Context-aware authentication
- Containerization
- Storage segmentation
- Full device encryption
- Mobile devices
- MicroSD HSM
- MDM/Unified endpoint management (UEM)
- Mobile application management (MAM)
- SEAndroid
- Enforcement and monitoring of:
- Third-party app stores
- Rooting/jailbreaking
- Sideloading
- Custom firmware
- Carrier unlocking
- Firmware over-the-air (OTA) updates
- Camera use
- SMS/multimedia message service (MMS)/Rich communication services (RCS)
- External media
- USB on the go (OTG)
- Recording microphone
- GPS tagging
- WiFi direct/ad hoc
- Tethering
- Hotspot
- Payment methods
- Deployment models
- Bring your own device (BYOD)
- Corporate-owned personally enabled (COPE)
- Choose your own device (CYOD)
- Corporate-owned
- Virtual desktop infrastructure (VDI)
- Cloud security controls
- High availability across zones
- Resource policies
- Secrets management
- Integration and auditing
- Storage
- Permissions
- Encryption
- Replication
- High availability
- Network
- Virtual networks
- Public and private subnets
- Segmentation
- API inspection and integration
- Compute
- Security groups
- Dynamic resource allocation
- Instance awareness
- Virtual private cloud (VPC) endpoint
- Container security
- Solutions
- CASB
- Application security
- Next-generation secure web gateway (SWG)
- Firewall considerations in a cloud environment - Cost - Need for segmentation - Open Systems Interconnection (OSI) layers
- Cloud native controls vs. third-party solutions
- Solutions
4.0 Operations and Incident Response
- Network reconnaissance and discovery
- tracert/traceroute
- nslookup/dig
- ipconfig/ifconfig
- nmap
- ping/pathping
- hping
- netstat
- netcat
- IP scanners
- arp
- route
- curl
- the harvester
- sn1per
- scanless
- dnsenum
- Nessus
- Cuckoo
- File manipulation
- head
- tail
- cat
- grep
- chmod
- logger
- Shell and script environments
- SSH
- PowerShell
- Python
- OpenSSL
- Packet capture and replay
- Tcpreplay
- Tcpdump
- Wireshark
- Forensics
- dd
- Memdump
- WinHex
- FTK imager
- Autopsy
- Exploitation frameworks
- Password crackers
- Data sanitization
- Incident response plans
- Incident response process
- Preparation
- Identification
- Containment
- Eradication
- Recovery
- Lessons learned
- Exercises
- Tabletop
- Walkthroughs
- Simulations
- Attack frameworks
- MITRE ATT&CK
- The Diamond Model of Intrusion Analysis
- Cyber Kill Chain
- Stakeholder management
- Communication plan
- Disaster recovery plan
- Business continuity plan
- Continuity of operation planning (COOP)
- Incident response team
- Retention policies
- Exercises
Given a scenario, use the appropriate tool to
assess organizational security.
Summarize the importance of policies, processes,
and procedures for incident response.
4.0 Operations and Incident Response
Given an incident, utilize appropriate data
sources to support an investigation.
Given an incident, apply mitigation techniques
or controls to secure an environment.
Explain the key aspects of digital forensics.
- Vulnerability scan output
- SIEM dashboards
- Sensor
- Sensitivity
- Trends
- Alerts
- Correlation
- Log files
- Network
- System
- Application
- Security
- Web
- DNS
- Authentication
- Dump files
- VoIP and call managers
- Session Initiation Protocol (SIP) traffic
- syslog/rsyslog/syslog-ng
- journalctl
- nxlog
- Retention
- Bandwidth monitors
- Metadata
- Mobile
- Web
- File
- Netflow/sflow
- Echo
- IPfix
- Protocol analyzer output
- Reconfigure endpoint security solutions
- Application whitelisting
- Application blacklisting
- Quarantine
- Configuration changes
- Firewall rules
- MDM
- DLP
- Content filter/URL filter
- Update or revoke certificates
- Isolation
- Containment
- Segmentation
- Secure Orchestration, Automation, and Response (SOAR) - Runbooks - Playbooks
- Documentation/evidence
- Legal hold
- Video
- Admissibility
- Chain of custody
- Timelines of sequence of events
- Time stamps
- Time offset
- Tags
- Reports
- Event logs
- Interviews
- Acquisition
- Order of volatility
- Disk
- Random-access memory (RAM)
- Swap/pagefile
- OS
- Device
- Firmware
- Snapshot
- Cache
- Network
- Artifacts
- On-premises vs. cloud
- Right to audit clauses
- Regulatory/jurisdiction
- Data breach notification laws
- Integrity
- Hashing
- Checksums
- Provenance
- Preservation
- E-discovery
- Data recovery
- Non-repudiation
- Strategic intelligence/ counterintelligence
- On-premises vs. cloud
- Acquisition
5.0 Governance, Risk, and Compliance
Summarize risk management processes and concepts.
Explain privacy and sensitive data concepts in relation to security.
- Risk types
- External
- Internal
- Legacy systems
- Multiparty
- IP theft
- Software compliance/licensing
- Risk management strategies
- Acceptance
- Avoidance
- Transference
- Cybersecurity insurance
- Mitigation
- Risk analysis
- Risk register
- Risk matrix/heat map
- Risk control assessment
- Risk control self-assessment
- Risk awareness
- Inherent risk
- Residual risk
- Control risk
- Risk appetite
- Regulations that affect risk posture
- Risk assessment types
- Qualitative
- Quantitative
- Likelihood of occurrence
- Impact
- Asset value
- Single loss expectancy (SLE)
- Annualized loss expectancy (ALE)
- Annualized rate of occurrence (ARO)
- Disasters
- Environmental
- Man-made
- Internal vs. external
- Business impact analysis
- Recovery time objective (RTO)
- Recovery point objective (RPO)
- Mean time to repair (MTTR)
- Mean time between failures (MTBF)
- Functional recovery plans
- Single point of failure
- Disaster recovery plan (DRP)
- Mission essential functions
- Identification of critical systems
- Site risk assessment
- Disasters
- Organizational consequences of privacy breaches - Reputation damage - Identity theft - Fines - IP theft
- Notifications of breaches
- Escalation
- Public notifications and disclosures
- Data types
- Classifications
- Public
- Private
- Sensitive
- Confidential
- Critical
- Proprietary
- Personally identifiable information (PII)
- Health information
- Financial information
- Government data
- Customer data
- Classifications
- Privacy enhancing technologies
- Data minimization
- Data masking
- Tokenization
- Anonymization
- Pseudo-anonymization
- Roles and responsibilities
- Data owners
- Data controller
- Data processor
- Data custodian/steward
- Data privacy officer (DPO)
- Information life cycle
- Impact assessment
- Terms of agreement
- Privacy notice
ACRONYM DEFINITION 3DES Triple Digital Encryption Standard AAA Authentication, Authorization, and Accounting ABAC Attribute-based Access Control ACL Access Control List AES Advanced Encryption Standard AES256 Advanced Encryption Standards 256bit AH Authentication Header AI Artificial Intelligence AIS Automated Indicator Sharing ALE Annualized Loss Expectancy AP Access Point API Application Programming Interface APT Advanced Persistent Threat ARO Annualized Rate of Occurrence ARP Address Resolution Protocol ASLR Address Space Layout Randomization ASP Active Server Page ATT&CK Adversarial Tactics, Techniques, and Common Knowledge AUP Acceptable Use Policy AV Antivirus BASH Bourne Again Shell BCP Business Continuity Planning BGP Border Gateway Protocol BIA Business Impact Analysis BIOS Basic Input/Output System BPA Business Partnership Agreement BPDU Bridge Protocol Data Unit BYOD Bring Your Own Device CA Certificate Authority CAC Common Access Card CAPTCHA Completely Automated Public Turing Test to Tell Computers and Humans Apart CAR Corrective Action Report CASB Cloud Access Security Broker CBC Cipher Block Chaining CBT Computer-based Training CCMP Counter-Mode/CBC-Mac Protocol CCTV Closed-Circuit Television CERT Computer Emergency Response Team CFB Cipher Feedback CHAP Challenge Handshake Authentication Protocol CIO Chief Information Officer CIRT Computer Incident Response Team CIS Center for Internet Security CMS Content Management System COOP Continuity of Operation Planning COPE Corporate Owned Personal Enabled CP Contingency Planning CRC Cyclical Redundancy Check CRL Certificate Revocation List CSO Chief Security Officer CSP Cloud Service Provider CSR Certificate Signing Request CSRF Cross-Site Request Forgery CSU Channel Service Unit CTM Counter-Mode CTO Chief Technology Officer CVE Common Vulnerabilities and Exposures CVSS Common Vulnerability Scoring System CYOD Choose Your Own Device DAC Discretionary Access Control DBA Database Administrator DDoS Distributed Denial of Service DEP Data Execution Prevention DER Distinguished Encoding Rules DES Digital Encryption Standard DHCP Dynamic Host Configuration Protocol DHE Diffie-Hellman Ephemeral DKIM Domain Keys Identified Mail DLL Dynamic Link Library The following is a list of acronyms that appear on the CompTIA Security+ exam. Candidates are encouraged to review the complete list and attain a working knowledge of all listed acronyms as part of a comprehensive exam preparation program. Security+ (SY0-601) Acronym List