CompTIA Security+ (SY0-701) Mastery Course w/ Labs & Exams

Explore domain 1 of the CompTIA Security+ mastery course to learn the NIST cybersecurity framework, CIA concepts, zero trust, cryptography, and exam prep with PBQs and case studies.

Explore domain two by identifying threat actors, their motivations, and data exfiltration, then assess vulnerabilities and attack surfaces across apps, OS, and cloud, and apply mitigation like patching and segmentation.

Analyze security architecture for cloud and on-prem networks, emphasizing infrastructure as code, serverless, and zero-trust design. Examine data protection, resilience, backups, and ransomware defenses across IoT, SCADA, and virtualization.

Explore governance, risk, and compliance (GRC) and learn how policies, standards, and procedures guide security program leadership, third-party risk, audits, and security awareness training, with case studies and pbqs.

Identify where valuable data and critical assets reside, and who can access them, using the CIS top 18 controls to inventory hardware and software and guide secure deployment.

Learn the NIST CSF 2.0, identify critical assets, implement protect and detect controls, and execute respond and recovery with governance and SIEM/IDS/EDR for rapid incident response.

Explore the csf 2.0 categories and their functions, including identify, protect, detect, respond, and recover, with governance, asset management, risk assessment, security awareness, and CIEM.

Master authentication, authorization, and accounting (AAA) fundamentals—identifying, verifying identity, and granting access by role-based (RBAC) or attributes—along with cloud IAM and auditing to track activity and prevent insider threats.

Explore defense in depth, using multiple layers of security—encryption, access controls, DLP, secure coding, input validation, and endpoint protection—to ensure resilience even if one layer fails.

Enforce the principle of least privilege and need-to-know by granting only the minimum permissions needed, enabling effective access control and reducing breach impact through proper identity management.

Separation of duties enforces least privilege by ensuring two people handle a critical function, reducing risk and deterring fraud through checks, approvals, and periodic vacations.

Mitigate risk by balancing security and functionality, implementing controls to reduce likelihood and impact, and bringing risk to a manageable level through risk transference, avoidance, acceptance, and ongoing monitoring.

Learn how security controls reduce risk by applying technical controls such as firewalls and 2FA, administrative policies, operational daily habits, and physical measures like fences and CCTV.

Explains deterrent controls as psychological warnings that discourage trespassers, using examples like warning signs, a warning banner on login pages, and security guards to deter rather than prevent.

Master detective controls such as CCTV surveillance and real-time monitoring that detect incidents and alert responders; SNORT is IDS, while Splunk and Elastic are CIM tools that monitor activity.

Describe how corrective controls activate after an incident to recover, restore, and reconfigure systems; promote backing up, patching, restoring settings, and reconfiguring firewalls to return to normal.

compensating controls provide alternatives when the primary control is unavailable, such as using a security guard for a broken door lock, enhanced monitoring for legacy systems, or multi-factor authentication.

learn to balance security with business enablement, practice risk management and acceptable risk, and support threat hunting, incident response, and penetration testing through practical, report-driven defense.

Detective controls reveal security events through monitored alerts from systems like Splunk. Note that CCTV or SIEM require human monitoring to function as detective controls.

Corrective controls jump into action to stop the bleed and restore normal operations after an attack, using measures like intrusion prevention systems, spyware remediation, and recovery controls.

Analyze threat actors by assessing motivation, capability, and persistence, including financial and political motives, advanced persistence threat groups, their tools, and how defenders use Mendiant and CrowdStrike.

Explore organized crime as a structured threat actor using ransomware as a service to target companies for money, highlighting REVO groups, WannaCry, Colonial Pipeline, JBS, and FBI guidance on paying.

Identify terrorist groups as threat actors who use cyber means to threaten governments and citizens with violence, spreading fear, propaganda, disinformation, and disruption.

Identify all potential entry points in the attack surface, distinguish it from attack vectors, and reduce risk by removing unnecessary services, ports, and accounts, and by implementing strong authentication.

A zero-day exploit targets an unknown vulnerability, often used against high-value targets; detectability lacks signatures, so defend with defense in depth, behavior-based anomaly detection, reduced attack surface, and threat intelligence.

Examine the cyber kill chain from recon (osint) to weaponization, delivery, exploitation, installation, command and control, and exfiltration, a framework for attacker steps.

Explore the MITRE ATT&CK framework with Navigator and Detect to map adversary techniques to your logs, prioritize detections, and tailor the approach to your environment.

Generate an asymmetric key pair in Kali Linux with ssh-keygen using RSA, creating a public key for sharing on MIT's public key server and a private key for secure communication.

Explain how cryptography achieves confidentiality, integrity, authentication, and non-repudiation by using a cipher and a key to transform plaintext into ciphertext and back through encryption and decryption.

Symmetric encryption uses a single secret key for both encryption and decryption, making it fast and ideal for bulk data, but its key distribution and non-repudiation limitations pose challenges.

Explore symmetric algorithms, including AES, DES, 3DES, RC4, Blowfish, and Twofish, with emphasis on AES as the current standard used in Wi‑Fi and the weaknesses of older ciphers.

Explore symmetric encryption use cases such as disk and file encryption, database security, and secure communications, highlighting bulk data protection, key management challenges, and AES vs DES key lengths.

Explore hashing algorithms and their role in data integrity and password security, showing how hashes protect passwords and how breaches like Rockyou exploit unencrypted credentials.

Discuss hashing algorithms for passwords, detailing md5 and sha, the sha-2 family, sha-3, and hmac, including collision issues and authentication use cases like one-time codes and bitcoin verification.

Explore how PKI creates a root of trust by linking encryption, hashing, and trusted websites through a CA hierarchy and domain, OV, and EV validations for https.

Identify the roles of the registration authority and certificate authority in PKI, and describe certificate signing requests, X.509 digital certificates, and certificate status methods like CRL and OCSP.

Explore entropy-driven key generation and compare storage options—TPM on the motherboard, removable HSM, and secure enclaves—with self-encrypting drives for full-disk encryption.

Key escrow backups keys with a third party to enable data recovery and compliance, while M of N controls distribute keys among multiple people to prevent a point of failure.

Explore obfuscation as making code hard to understand, and see how attackers misuse it; also cover steganography, data masking of PII and PHI, tokenization, and de-identification.

Analyze the 2010 Stuxnet case study, a cyber weapon targeting Iran's nuclear program, attributed to the US and Israeli intelligence, using usb delivery, zero-day exploits, and stolen Microsoft keys.

Explore authentication and authorization, including AAA, MFA, passwords and tokens, SSO. Cover SAML, OAuth, OpenID Connect, DAC, MAC, RBAC, ABAC, rule-based models, and Kerberos, LDAP, RADIUS, TACACS and TACACS+.

Explore the three main authentication factors—something you know, something you have, and something you are—and how location and behavior add depth, with examples like passwords, smart cards, biometrics, and smartphones.

Compare multi-factor authentication with two-factor authentication and learn how MFA uses two or more methods, such as something you know, something you have, and something you are.

Explore how authentication methods verify user identity using passwords, tokens, biometric, digital signatures, and digital certificates. Understand how these methods are applied to authenticate people in various scenarios.

Biometric authentication offers highest security but is costly and enrollment-driven, relying on a biometric database to compare scans; engineers balance false rejection, false acceptance, and crossover error rate.

Explore passwordless authentication with FIDO standards, passkeys and biometrics to verify identity without passwords, featuring magic links and security tokens for improved security and user experience.

Explore how single sign-on enables a user to sign in once and access multiple applications. Understand federation, where an identity provider enables cross-organization sign-in using SAML, OAuth, and OpenID Connect.

Explore how OpenID Connect uses tokens like JSON web tokens to authenticate users via Google. Learn how SAML uses XML and HTTPS with SOAP for secure data exchange.

Explore discretionary access control (DAC) and its challenges, then compare role-based access control (RBAC) using Active Directory and OUs, attribute-based access control with zero trust, and rule-based RUBAC with ACLs.

Kerberos is a single sign-on authentication protocol that uses tickets; a key distribution center issues tickets via the authentication and ticket-granting servers, for eight-hour validity in Windows environments.

Discover how Kerberos uses an authentication service to issue a ticket-granting ticket, which the client exchanges for a service ticket to enable mutual authentication between client and server.

Implement radius to authenticate, authorize, and account by interfacing with Active Directory, noting UDP usage and incomplete encryption, with diameter offering TLS and IP security.

Explore TACACS+ and its improvements over TACACS and Radius, highlighting TCP-based, fully encrypted conversations for centralized authentication, authorization, and accounting in device management for routers, switches, and firewalls.

Explore why physical security is essential to cybersecurity and how access controls protect data center assets and prevent unauthorized entry.

Learn how security guards, lighting, and access badges form essential physical security controls to deter, detect, and prevent intrusions, with badge authentication and credential verification.

Explore change management and security impact, covering business processes, version control with git and GitHub, and the role of documentation in maintaining secure systems.

Master change management to prevent vulnerabilities and outages by testing changes in a controlled environment, rolling back when needed, and integrating security to reduce incidents and ensure compliance.

Approve changes via a manager or change management committee, test in a virtualized environment, announce a maintenance window, ensure ownership and accountability with a back-out plan and sops for compliance.

Distinguish viruses and worms; explain macros and polymorphic or metamorphic variants, with examples like Morris worm, I love you worm, Code Red, Conficker, Stuxnet.

Learn about logic bombs that trigger by time or event, and fireless malware that stays in RAM to evade detection, using EDR and XDR with behavior analytics.

Phishing uses a broad volume of fraudulent e-mails to exploit social engineering, while spear phishing targets specific individuals. Whaling narrows further to compromise high-value targets like the CEO.

Learn about business email compromise (BEC), where attackers impersonate colleagues or brands to target a specific employee, including techniques like watering hole attacks.

Explore vishing and smishing as voice and text social engineering attacks, and farming (pharming) via DNS poisoning and host file manipulation to redirect users.

Learn how tailgating, dumpster diving, and shoulder surfing enable breaches and how to prevent them with badge verification, awareness of trash for sensitive data, and privacy screens.

Implement a multi-layer defense that blends human firewall training with tech controls like email filtering, security gateways, AI tools, EPP, patching, antivirus, and least-privilege policies against phishing.