CompTIA Security+ (SY0-601)

Analyze threat actor types, attack vectors, and threat intelligence to assess vulnerability, threat, and risk; apply threat modeling and guard against insider threats and evolving attack surfaces.

Identify diverse threat intelligence sources—from academia, open source feeds, honeypots, and ISACs to social media—and use tactics, techniques and procedures, indicators of compromise, and indicators of attack to detect threats.

Profile threat actor types most likely to threaten your business. Identify industry-relevant threat research sources and evaluate threat intelligence platforms, including proprietary and open source data feeds, with sector-specific data.

Develop skills to assess organizational security using network reconnaissance tools, covering ping sweeps, ARP, route tracing, port scanning, service discovery, fingerprinting, and packet capture with tcpdump, wireshark, and nessus.

Perform packet capture and replay with Wireshark in a lab network, capturing icmp and arp traffic between a Windows host and a Linux device, and analyze frames and bytes.

Explain security concerns linked to general vulnerability types, including patch management, software and firmware vulnerabilities, weak configurations, data breach versus data exfiltration, third-party risks, and cloud versus on-premises storage.

Explore vulnerability scanning techniques, compare automated and manual scanners, intrusive and non-intrusive scans, credentialed vs non-credentialed access, and how CVE and CVSS drive risk in vulnerability assessments and threat hunting.

Explain penetration testing concepts and techniques, including pen tests, rules of engagement, black/white/grey box models, red/blue teams, and active, intrusive methods to identify vulnerabilities and test security controls.

Identify procedures and tools to scan the attack surface for vulnerabilities, run scans, review results, remediate via CVEs, and conduct threat hunting and structured penetration testing across the kill chain.

Compare social engineering techniques, including impersonation and pretexting, to phishing, vishing, and whaling, and recognize malware indicators, fraud schemes, and intrusion methods.

Identify malware types and indicators to determine attack types and use tools to assess security. Covers viruses, worms, trojans, gray wear, adware, spyware, keyloggers, backdoors, botnets, rootkits, ransomware, and cryptojacking.

Explore how a fork bomb malware operates by spawning processes in an infinite loop, driving CPU and memory usage to the limit, crashing a virtual machine, and illustrating malware behavior.

Build defenses by training employees to recognize social engineering, phishing and farming attempts, vishing, spam; use security filters and limited privileges, and deploy sandbox analysis tools with threat data feeds.

Summarize hashing, symmetric and asymmetric ciphers, and key concepts for encryption and decryption, including RSA and ECC for public-key cryptography and key exchange.

Explore how digital signatures use public key cryptography and hashing to provide integrity and authentication. Understand how TLS and diffie-hellman key exchange achieve perfect forward secrecy in transport encryption.

Analyze cryptographic use cases and weaknesses by distinguishing primitives from systems, covering hybrid and public key cryptography, authentication, non repudiation, confidentiality, and hash functions.

Explore quantum computing concepts, post-quantum cryptography, and their potential impact on key distribution and cryptanalysis. Examine homomorphic encryption, blockchain's public ledger, and steganography for covert channels.

Summarize cryptographic functions and their use in hybrid encryption to provide confidentiality, integrity, authentication, and resilience, identify limitations, weaknesses, attack types, and concepts like quantum blockchain, homomorphic encryption, and steganography.

Explore how to implement a public key infrastructure with certificate authorities, digital certificates, and certificate chaining across SSL, TLS, and VPN systems.

Explore public key infrastructure management, including certificate and key life cycle, renewal, revocation, OCSP/CRL, and certificate formats, with OpenSSL and Windows certificate services.

Demonstrates implementing a PKI with OpenSSL and Active Directory Certificate Services, creating RSA keys, CSRs, root and subordinate CAs, templates, auto enrollment, CRLs, and key archival.

Evaluate single versus intermediate certificate authorities, implement offline certificate handling, define policies, types, and templates, ensure valid subjects and common name, manage requests, revocation, and key escrow, and troubleshoot.

Define authentication design concepts within identity and access management and CIA triad. Apply factors such as something you know, something you have, and something you are to enable multi-factor authentication.

Explore knowledge-based authentication and Kerberos single sign-on using tickets, password hashes, and remote authentication methods. Identify password attacks, hash-based defenses, password managers, and secure vault practices to protect credentials.

John the Ripper rapidly cracks a simple administrator password in a lab demo, using four threads on nine salted hashes, illustrating how easily password files can be breached.

Explore how smart cards and tokens support authentication, certificate-based methods, and multifactor solutions, guided by EAP, RADIUS, and TACACS+ architectures, with HSM and TPM protection.

Explore biometric authentication concepts, including enrollment and sensor tuning, fingerprints and facial and vein, retina, or iris scans. Assess throughput, false rejection and false acceptance rates, and privacy considerations.

Assess the design requirements for integrity and availability, then determine multi-factor needs and select methods and protocols—such as smart cards, one-time password, biometrics, sms, push, Kerberos, 802.1X Radius, and TACACS+.

Apply identity and account management controls to enforce least privilege, provisioning, and access policies, including federated identity management, single sign-on, background checks, onboarding and offboarding, and privilege separation.

Implement Windows account policies and group policy objects to enforce identity and access controls, including location-based restrictions. Apply password rules, time-based restrictions, and recertification audits to prevent authorization creep.

Create and manage user accounts in a Windows domain, assign them to groups, set login hours and computer access, and apply domain and local security policies.

Compare access control models like dac, mac, rbac, and abac, and explain federation, directory services, and attestation for secure authentication and authorization.

Explain how personnel policies safeguard security by defining conduct and acceptable use. Learn about bring your own device, shadow IT, clean desk standards, and role-based training including phishing simulations.

Establish identity and access management controls with least privilege. Configure accounts, roles, and policies: onboarding, offboarding, conditional access, and federated services across on-premises and cloud environments.

Implement secure network designs by configuring secure routing and switching, wireless infrastructure, and load balancers. Understand network weaknesses, zoning, DMZs, and zero trust, focusing on segmentation, availability, and proper documentation.

Implement secure switching and routing across zones and analyze indicators of network attacks. Defend against man-in-the-middle, ARP poisoning, MAC flooding, and loops with spanning tree and port security.

Demonstrates practical network attack techniques in a lab, including mac flooding with a dsniff tool, CDP flooding, ICMP floods, and ping of death, analyzed with Wireshark.

implement secure wireless infrastructure by configuring WPA2 or WPA3 with enterprise authentication (802.1x and EAP variants) and conducting site surveys, channel planning, and rogue access point defenses.

Discover how load balancers mitigate distributed denial of service by distributing requests across server pools, performing health checks, and enabling clustering and session persistence for fault tolerance.

Design segmented network zones based on business workflows, using VLANs, subnets, and firewall policies to meet security requirements and support DMZ, zero-trust, and IPv6.

Implement secure network designs by configuring firewalls and proxy servers, applying ACLs, and using stateless, stateful, and application-aware filtering with NAT and IP tables.

Explore basic network monitoring concepts, including IDS and IPS, taps, and inline deployment. Learn about next-generation firewalls, secure gateways, UTMs, WAFs, and host-based protections like file integrity monitoring.

Explore how a SIEM aggregates and normalizes logs from multiple devices, enabling correlation, threat intelligence, and alerting for indicators of compromise across the network.

Identify security requirements for a network zone and select appropriate technologies, including firewalls, ACLs, IDS/IPS, and UTMs. Document and test ACLs, monitor logs, and compare proprietary versus open-source options.