CompTIA Security+ (SY0-701) Certification Training + LAB

Protect information by ensuring confidentiality, integrity, availability, and non-repudiation for data at rest and in transit, guarding against unauthorized access and modifications.

Master the cyber security framework, a five-step checklist: identify, protect, detect, respond, recover, for protecting data against internal and external threats to confidentiality, integrity, and availability.

Perform gap analysis against standards to identify missing controls and protect the organization. Explore access control, IAM, and ACL guiding who accesses which resources via identification, authentication, authorization, and accounting.

Explore the four categories of security controls—physical, technical, operational, and managerial—and see how guards, access cards, locks, CCTV, firewalls, antivirus, and proper configuration protect information.

Explore the six functional types of security controls—preventive, detective, corrective, directive, deterrent, and compensating—along with examples like antivirus and firewall to preempt, detect, and respond to intrusions.

Explore configuring preventive, detective, and corrective security controls in Windows labs, including access permissions, auditing, event viewer, banner messages, and hash-based file integrity checks.

Compare threat types and threat actor motivations, examining attributes and common vectors, while learning to reduce the attack surface and protect your organization.

Explain threats and threat actors, and how vulnerabilities enable threats to create risk, including internal and external threats such as cross-site scripting and SQL injection.

Analyze threat actors by attributes such as internal versus external and low versus high capability, and examine funding and motivations, including malicious, opportunistic, financial, and political goals.

Identify threat actors from white hat to hacktivists and advanced persistent threats, and recognize internal and unintentional insider threats within organizations.

Identify the attack surface across physical, network, application, and human interfaces, and examine vulnerable software vectors and patch management, legacy systems, and client-based versus agentless vulnerability scanners.

Analyze remote and local exploit techniques on insecure networks, revealing attack surfaces from open ports, default credentials, and malware delivered via USB, macro-enabled documents, and browser vulnerabilities.

Explore how supply chain attacks expand attack surfaces across suppliers, vendors, and partners through email, sms, web, social media, and voice channels, and learn mitigation with managed service providers.

Examine how social engineering manipulates the human mind to steal credentials and gain unauthorized access, using impersonation, pretexting, and persuasive tactics to exploit the human attack surface.

Explore phishing, pharming, and typo squatting, including fake websites, emails, and voice or SMS spoofing, and learn how attackers collect credentials through redirects and DNS tricks.

Learn how spear phishing compromises business emails by targeting individuals from staff to executives, with brand impersonation, misinformation and disinformation, and watering hole attacks.

Learn to use the set toolkit for a social engineering attack in a hands-on lab, including spear phishing, payload creation, listener setup, and phishing email delivery.

Explore cryptographic solutions that protect data at rest and in transit, compare algorithms, and explain the role of PKI and digital certificates in secure key exchange.

Explore cryptographic concepts, including encryption and decryption, encoding and decoding, transformation of plain text into cipher text. Examine hashing as a one-way encryption and contrast symmetric and asymmetric encryption.

Identify how symmetric encryption uses a single key for both encryption and decryption, with examples of substitution and transportation, and discuss its suitability for bulk data and key distribution challenges.

Encrypt data and decrypt it with a key whose length, key space, and bit size defend against brute force attacks, as AES 256 provides strong security at resource costs.

asymmetric encryption uses a private key and a public key as a key pair; one encrypts and the other decrypts for secure client–server communication, using RSA 2048 or ECC 256-bit.

Hashing converts plaintext into a fixed-length, one-way hash (MD5, SHA-1, SHA-256, SHA-512); it is used for password storage and integrity verification, and any change alters the hash.

Digital signature ensures data integrity, authenticity, and non-repudiation by hashing the data, encrypting the hash with a private key to form the signature, and verifying it with the public key.

This lecture explains public key infrastructure and the role of certificate authorities in issuing certificates that bind public keys to servers, enabling secure browser connections.

Explore how digital certificates bind a subject's public key to identity, define validity and expiry, and how root of trust and PKI hierarchies enable secure LAN and web communications.

Learn how certificate signing requests work from a web server perspective, including generating key pairs, submitting CSR to the CA, and handling common name, subject alternative names, and wildcard domains.

Learn how certificate revocation protects communications when a certificate is compromised, and how CRL and OCSP deliver real-time status. Explore key management lifecycles, including decentralized and centralized approaches.

Examine cryptoprocessors and secure enclave concepts, entropy, and true versus pseudo random generation. Learn how TPMs and hardware security modules protect keys for BitLocker and on-the-fly encryption.

Key escrow splits a cryptographic key into multiple parts stored across locations under m of n control, enabling recovery and preventing data loss if the key is compromised.

Encrypt data to maintain confidentiality across rest, transit, and use; explain symmetric versus asymmetric encryption and disk, volume, and database encryption with tools like BitLocker and EFS.

Explain how transport encryption uses public/private keys to securely exchange a symmetric key and encrypted data between Alice and Bob, and the risk of private key compromise.

Perfect forward secrecy uses Diffie-Hellman between Alice and Bob with public p and g and private exponents, producing a shared key secure from eavesdropping.

strengthen passwords with salting and key stretching to resist brute-force attacks, and explain how blockchain links blocks with hashes for peer-to-peer transactions and various use cases.

Explore hashing and salting to verify file integrity and protect passwords, compare md5, sha1, and sha256 strategies, and examine salted hashes and cracking concepts.

Understand authentication design by exploring how username and password verify identity, and how biometrics, otps, and other factors support confidentiality, integrity, and availability.

Design strong password concepts by enforcing 8–16 character length with mixed case, symbols, and numbers. Avoid obvious patterns and birth dates; use password managers to securely generate and store credentials.

Explore multifactor and biometric authentication, including factors like something you know, something you have, and something you are, with enrollment templates and concerns like false rejection and false acceptance.

Compare hard tokens like smart cards and hardware OTPs with soft tokens and authenticator apps, covering PKI, certificate authorities, U2F security keys, passwordless, and root of trust.

Compare discretionary access control, based on resource ownership, with mandatory access control, based on data labels and classifications, and learn how owners grant read and write permissions.

Explore role-based access control and attribute-based access control, where administrators assign roles or attributes to govern permissions, from HR to firewall tasks, with central, non-discretionary control.

Explore rule-based and attribute-based access control with system-defined policies for normal and administrator users. Learn about conditional access, continual authentication, and pseudo permission for a limited time via uac.

Apply least privilege strategies during user provisioning by assigning only sufficient permissions, performing identity proofing, credential issuance, asset allocation, and ongoing training to prevent authorization creep.

Identify account attributes and access policies, including CID, sudo, and privileged access management, RDP access, file permissions, and location/time restrictions.

Learn to manage permissions across Linux and Windows environments using chmod, numeric and symbolic modes, ACLs, NTFS rights, and SMB share access.

Understand identity management through local and remote authentication, including password hashes, Active Directory, Kerberos tickets, ntlm, Linux shadow, and pam for passwordless options.

Learn directory service basics with LDAP concepts, attributes, and access control lists, then discover Kerberos-based single sign-on using a key distribution center and service tickets.

Explore federation and shared sign-on, where trusted identity providers authenticate users and issue tokens that authorize access to service providers across organizations.

Examine how SAML and OAuth manage identity and access between an identity provider and a service provider, using XML assertions, signatures, HTTPS or SOAP, and REST-based authorization.

Explore the enterprise campus network architecture and infrastructure, compare security implications of on-premises models, apply security principles, select effective controls, and ensure secure remote access and tunneling.

Explore enterprise network architecture as the device arrangement and the infrastructure that enables media, addressing, and forwarding. Observe data flow via SMTP between mail servers like Gmail and Yahoo.

Study network infrastructure across OSI layers, including switches and routers, VLANs, IP addressing, ARP, MAC tables, and key protocols like TCP/UDP, HTTP, DNS, and FTP.

Discover how switching and routing infrastructure shapes on-premises networks, from star topology and structured cabling to hierarchical core/access design, VLANs, and layer 3 routing with IPv4/IPv6.

Categorize data, store it across multiple security zones, and apply defense in depth to minimize attack surface and prevent a single point of failure.

Discuss port security strategies, including disabling unused ports, mac filtering and its vulnerability to mac spoofing, plus EAP/radius-based authentication and physical isolation for sensitive networks.

Evaluate architectural costs, including capital cost, depreciation, and maintenance, while ensuring compute efficiency, reduced downtime, fast recovery, scalability, availability, patch management, and risk transference under SLAs.

Explore defense in depth with preventive, detective, and corrective controls across VLANs and subnets. Understand active and passive monitoring, inline and tap methods, and fail closed versus fail open.

Explore layer 4 and layer 7 firewalls, using ACLs, packet filtering, and stateful inspection to control traffic with deep packet inspection and application layer gateways.

Explore how proxy servers mediate client requests using forward, non-transparent, transparent, and reverse configurations, and how intrusion detection systems like Suricata and Zeek analyze traffic to detect or prevent threats.

Explore next generation firewalls with application aware filtering, decryption, and blocking. Discover how unified threat management integrates firewall, antivirus, NIPS, web application firewall, spam filtering, and load balancing.

Explore how VPN remote access creates encrypted tunnels between a VPN client and a VPN gateway, and how site-to-site VPN links head office and branch offices over the internet.

Learn how tls and ipsec tunnels secure connections between gateways, using certificate-based authentication and a radius server, with ah and esp providing integrity and confidentiality in tunnel and transport modes.

Explore how internet key exchange enables ipsec vpn authentication and key exchange using certificates or pre-shared keys, establishing security associations and supporting ikev1 and ikev2.

Explore remote desktop technologies using rdp to access gui and terminal interfaces, and secure shell for remote administration with authentication methods like username/password, public key, and Kerberos.

Explore out-of-band management and jump servers, including secure admin workstations and vpn access; learn how serial modems and virtual terminals use separate vlans to route traffic to app servers.

Set up remote access for Windows and Linux, including remote desktop and SSH. Configure SSH server, adjust sshd_config for password and public key authentication, and verify with systemctl and PuTTY.

Configure an IPsec VPN between two Windows systems by creating an IP security policy, IP filter lists, and filter actions to encrypt traffic and data in transit.

Examine cloud deployment models based on ownership, including private, public, community, and hybrid clouds, and learn how these infrastructures are managed and secured.

Explore security implications of cloud infrastructure choices, including single-tenant and multi-tenant architectures, hybrid deployments, and serverless auto-scaling, with emphasis on logical separation and storing sensitive data.

Explore cloud service models IaaS, PaaS, and SaaS, with examples like Office 365 and Google Docs, and examine front-end and back-end hosting and platform versus infrastructure.

Map the shared security responsibilities between cloud providers and customers across IaaS and PaaS, including data classification, IAM, encryption, and data protection across geographic regions.

Compare centralized computing architecture, which processes data at a single location, with decentralized models such as blockchain, CDN, distributed databases, and Tor networks.

Explore resilient cloud architecture built on data replication to achieve high availability through local and regional replication, plus geo gradient storage across Mumbai, USA, and China.

Explore software defined networking and its three planes—control, data, and management—centralizing configurations, enabling automation, and guiding forwarding from the control plane.

Explore cloud architecture features like cost efficiency, scalability, resilience, and easy deployment. Examine cloud security through data backup, encryption, access control, patching, and secure SD-WAN networks.

Learn to create and manage docker containers on Windows Server, including starting containers from Nano Server images, accessing containers, and managing users and data inside containers.

Learn to install and configure Hyper-V on Windows, create a virtual machine, attach ISO images, and set up private and external virtual switches to test networking.

Explore embedded systems—hardware plus software built for specific tasks—and their role in industrial control systems, scada, plc, and hmi, with zero trust architecture across automation.

Explore the internet of things by examining how IoT devices collect data via sensors, connect through wifi or 5G, and face security risks from limited processing power and memory.

Protect resources with de-perimeterisation by implementing zero trust, following never trust, always verify, and applying strict policies for authentication, authorization, and access control.

Learn the essential components of a zero trust architecture, including policy engine and policy administrator, identity and access management, policy-based enforcement, network segmentation, cloud security, data protection, and continuous monitoring.

Learn resiliency and site security concepts, focusing on physical security controls to protect tangible and intangible assets, ensure data availability, and sustain business continuity through server and network redundancy.

Track tangible and non tangible assets, assign ownership, and monitor changes with inventory tools and CMDBs, while managing licensing and baseline compliance across cloud and mobile assets.

Protect hardware assets like laptops and mobile devices using RFID and barcodes, implement standard naming conventions, and enforce configuration management with change control to safeguard operations and continuity.

Implement advanced data protection techniques by using snapshot points across virtual machines, file systems, and SANs, and apply replication, journaling, and encryption to ensure failover and recovery.

Explore secure data destruction for end-of-life assets, disposing hardware and sanitizing storage to remove sensitive data completely. Learn how sanitization, destruction and certification prevent unauthorized access and data breaches.

Learn to implement backups and shadow copies with diskpart and Windows Server Backup, create and format partitions, back up user data to a local drive, and restore previous versions.

Explore drive sanitization in linux by creating and formatting sdb1, mounting it, securely deleting data with shred, and overwriting with zero to ensure thorough destruction.

Explore redundancy strategies to maintain business continuity during disruptions, using backups, backup servers, snapshots, and capacity planning to keep critical operations online.

Outline capacity planning risks, including people risk and skill gaps. Explain cross training, remote work readiness, secure remote access, alternative reporting structures, and rapid hiring or layoffs.

Explore high availability to keep operations online with no downtime, and apply scalability, elasticity, fault tolerance, and redundancy across hot, warm, cold, and cloud sites.

Explore testing strategies for redundancy, high availability, and clustering, including load testing, failover testing, monitoring, and active-active or active-passive setups with virtual IPs and load balancers.

Learn defense in depth through platform diversity, multi-cloud and vendor diversity, while ensuring power redundancy with dual power supplies, UPS, and battery backups for uninterrupted operations.

Explore deception technology to misguide attackers, identify attacks with honeypots and fake information, and test resiliency through tabletop exercise, failover simulation, and robust documentation.

Protect assets with physical security controls that deter unauthorized access, using fencing, lighting, CCTV, alarms, biometrics, and digital entry such as access cards or one-time passwords.

Learn vulnerability management by identifying, evaluating, and mitigating vulnerabilities across operating systems, applications, and architectures, and document remediation for developer review.

Explore operating system vulnerabilities across Windows, macOS, Linux, Android, and iOS, including buffer overflows, input validation, privilege escalation, misconfigurations, and the importance of patching and secure boot.

Identify zero day vulnerabilities and explain how researchers disclose them to prompt patches and CVE release, and discuss why traditional defenses fail against such unknown flaws.

Explore misconfiguration vulnerabilities across operating systems, hardware, software, and cloud services, focusing on default configurations and weak credentials such as admin/admin and other default passwords.

Discover how cryptographic vulnerabilities threaten data protection, from data at rest and data in transit to secure communication with https, emphasizing strong algorithms and keys and proper key protection.

Explore how mobile device vulnerabilities arise from human factors, and how rooting, jailbreaking, and sideloading grant admin access or install untrusted apps, risking data and warranty.

Explore common application and cloud vulnerabilities, including race conditions, memory injection, buffer overflow, and malicious updates, with secure coding practices to mitigate risks in web apps and cloud platforms.

Evaluate vulnerabilities and security posture through security testing, vulnerability assessment, and documentation review. Practice secure coding, configuration checks, cryptographic analysis, and architecture review to ensure compliance verification and layered protection.

Explore common web application attacks that target servers and clients, including cross-site scripting, cross-site request forgery, and SQL injection.

Explore sql injection exploitation and detection in an assisted lab, building a vulnerable web app environment, identifying vulnerabilities, extracting schema details, and reviewing server logs for evidence.

Explore cloud-based application attacks by analyzing vulnerabilities in cloud platforms and hosted apps, including misconfigurations, weak authentication, and access control flaws, plus attackers using cloud as an attack platform.

Identify supply chain vulnerabilities across hardware, software, and cloud components, distinguishing intentional from unintentional risks. Explain how old or malicious firmware and software dependencies can impact your organization.

Explore indicators of compromise and threat intelligence feeds, learn sources and formats such as ISAC, STIX, and TAXII, and see how feeds inform firewalls, IDS, and SIEM.

Learn to perform vulnerability scans using the Greenbone Security Assistant, configure the target Windows Server 2016 with credentials in a Kali Linux lab, run scans, and review reports.

Explore security control types and how to establish baselines with CIS benchmarks for operating systems, devices, and cloud platforms, then automate secure configurations using Puppet, Chef, and Ansible.

Establish baseline security for switches and routers by changing default credentials, disabling unnecessary services, using ssh or https; enforce ACLs, logging, and port security, including strong passwords.

Enforce a strong server baseline: change default credentials, disable unused services, and apply patches daily. Implement least privilege, firewall and IDS/IPS, CIS benchmarks, logging, antivirus, and physical security.

Conduct a site survey with a heat map to optimally place wireless access points, then implement WPA/WPA2/WPA3 encryption with pre-shared keys or radius-based enterprise authentication and NAC onboarding.

Master access control lists to filter traffic on the network layer by source and destination IPs and ports, with FTP, SSH, HTTPS, and firewall rules.

Explore how intrusion detection and prevention systems inspect payloads beyond headers to block malicious data, using signature-based and anomaly-based detection across network deployments.

Block malicious and inappropriate websites using category-based web filtering, including social, streaming, and adult sites, enforce policy with ACL/IDS/IPS checks, inspect https traffic with decryptors in a centralized, agent-based system.

Implement Windows Defender firewall to block icmp v4/v6 between pc ten and dc ten, block smb sharing, and verify access denial with ping and file sharing tests.