CompTIA Security+ (SY0-701)

Explore the three security control categories—technical, administrative, and physical—and how firewalls, encryption, policies, and physical protections shape practical, multi-category safeguards.

Explore the seven security control types—preventative, deterrent, detective, corrective, compensating, recovery, and directive—and see how encryption, access controls, backups, and training meet their goals.

Explore security fundamentals through the CIA triad—confidentiality, integrity, and availability—with practical methods like encryption, access control, authentication, non-repudiation, and backups.

Explore authentication factors: something you know, something you have, and something you are, with examples like usernames, passwords, PINs, smart cards, authenticator apps, biometrics, and geolocation to bolster MFA.

Learn how authorization grants or denies resource access after authentication, and compare discretionary, mandatory, role-based, rule-based, and the bonus attribute-based models in cloud contexts.

Discover authentication, authorization, and accounting (AAA) as identity-driven access control, what users can do, and what actions are logged, with RADIUS and TACACS Plus as centralized solutions.

Adopt a never trust, always verify zero trust mindset, using policy enforcement points, data and control planes, and adaptive identity to enable conditional, policy-driven access.

Explore physical security concepts and layered defense to protect digital systems, including cameras, guards, secure access vestibules, turnstiles, access badges, fencing, lighting, and sensors like infrared, microwave, and ultrasonic.

Explore deception and disruption technologies, using honey pots, honey nets, honey files, and honey tokens to lure attackers from production assets and reveal techniques for defense.

Explore how change management affects business processes and security operations, detailing stakeholders, ownership, impact analysis, approval processes, maintenance windows, and back-out planning.

Explore change management implications and documentation in security, including firewall rule changes, downtime, legacy systems, and the need for up-to-date diagrams and version control of policies.

Explore a high-level view of encryption, including symmetric and asymmetric ciphers, block and stream modes, encryption levels from file to database, and secure transport through TLS.

Explore PKI's certificate authority hierarchy, including root and subordinate CAs, and how internal and external CAs enable trusted digital certificates for encryption and authentication.

Understand how digital certificates and signatures verify server authenticity and trusted authorities in PKI, including x.509 formats, PKCS file types, PEM and DER, and private key protection.

Understand asymmetric encryption uses a public key to encrypt and a private key to decrypt, using key pairs and certificates. TLS handshakes begin with asymmetric encryption, then use symmetric keys.

Explore symmetric encryption, a single-key method that encrypts and decrypts data, and compare block and stream ciphers with examples like AES, Twofish, ChaCha20, Salsa, and RC4 (deprecated).

Compare hashing and obfuscation, and learn hashing as a data integrity check with fixed-length outputs, while obfuscation hides data and requires encryption for confidentiality.

Explore threat actors from script kiddies to nation-state hackers, detailing motivations such as financial gain, espionage, and political aims, with examples like APTs, insider threats, hacktivists, and ransomware gangs.

Explore social engineering, from phishing and smishing to voice scams and impersonation. Learn to recognize typosquatting, misleading links, pretexting, brand impersonation, and file-based threats.

Explore how business email compromise uses social engineering and lookalike domains to impersonate vendors, CEOs, or lawyers, targeting finance, HR, and executives, with defenses like MFA and DMARC.

Explore digital system threats through app vulnerabilities, client-based and agentless risks, web application flaws and network services, and practical defense ideas, including OWASP top 10 and mitigation strategies.

Explore wired and wireless threats, from physical access and VLAN hopping to ARP poisoning, rogue devices, and Bluetooth attacks, emphasizing encryption and secure configurations.

Examine removable media threats from USB drives and SD cards, including malware infections, insider risks, and rubber ducky keystroke attacks, with practical mitigations like disable USB and secure file sharing.

Explains supply chain attacks, using SolarWinds and 3CX cases to show how attackers infiltrate software vendors or MSPs to insert malicious code and backdoors into trusted products.

This lecture covers application vulnerabilities, including memory injection and buffer overflows, dll injection and hijacking, race conditions, and the impact of malicious updates and supply chain attacks.

Explore operating system vulnerabilities across Windows, Linux, Mac OS, Android, iOS, and embedded systems. Learn about buffer overflows, race conditions, and privilege escalation with exploits like EternalBlue and Shellshock.

Learn about web-based vulnerabilities and the OWASP top 10, including injection and cross-site scripting. Discover securing server software and CMS plugins, and the importance of not trusting user input.

Explore hardware vulnerabilities on consumer devices, from debugging interfaces like JTAG, UART, I2C, and SPI to firmware analysis, exposing attack surfaces, backdoors, and supply-chain risks in IoT hardware.

Investigate cloud vulnerabilities, including public storage misconfigurations, exposed API keys, IAM missteps, and insider threats, then apply defenses like least privilege and security controls.

Discover virtualization vulnerabilities, including virtual machine escape. Learn how attackers move from a guest vm to the host or other tenants, and why isolation and secure management consoles matter.

Explore cryptographic vulnerabilities, including downgrade attacks and PUDL, hash collisions, and techniques like password cracking and hash verification for secure systems.

Explore mobile device vulnerabilities, from malware and bluetooth and SS7 threats to jailbreaking, rooting, and third-party app stores, and learn defenses like encryption, updates, and avoiding SMS-based two-factor codes.

Explore zero day vulnerabilities, from discovery by researchers to patch cycles, and how bug bounty programs, responsible disclosure, and famous cases like eternal blue and WannaCry shape patching.

Identify malware indicators such as poor performance, high resource use, random crashes, and unusual network activity. Watch for malicious binaries, including trojans, ransomware, rootkits, and web shells.

Identify physical attack indicators, from unknown persons in secure areas and propped doors to tampered cameras, RFID vulnerabilities, and unauthorized devices, and learn how to challenge and deter threats.

Identify network attack indicators, including DDoS and DNS threats, domain spoofing, cache poisoning, rogue access points, deauthentication, on-path attacks, and credential replay.

Identify indicators of application attacks by monitoring logs from web apps and servers for injection attempts, directory traversal, buffer overflows, replay and privilege escalation.

Identify indicators of cryptographic attacks by analyzing logs and network traffic for weak downgrades, warnings, and errors. Look for HTTP downgrades and potential hash collisions that cause data duplication.

Identify indicators of password attacks, including brute-force, dictionary, and mutation techniques, and detect them by monitoring Linux auth.log and Windows security event IDs.

Explore cybersecurity mitigation techniques such as network segmentation, access control models, application allow lists, isolation strategies, patch management, encryption, monitoring, least privilege, config enforcement, decommissioning, and practical hardening guides.

Examine cloud deployment models—public, private, and hybrid—and the shared responsibility model. Learn how infrastructure as code, serverless, and microservices shape cloud security strategies.

Explore network infrastructure concepts and architectures, comparing on-prem vs cloud, full control, centralized vs decentralized designs, and logical and physical isolation, including SDN with Cisco DNA.

Explore virtualization concepts and security for virtual machines and containers, including Kubernetes, container orchestration, and security groups and network ACLs in cloud environments.

Explore the security implications of IoT and SCADA within operational technology, highlighting embedded systems, IPv6 address space, and the industrial internet of things for critical infrastructure.

Evaluate availability and resiliency in architectures, emphasizing redundancy, cost, and responsiveness. Contrast scalability with elasticity, and plan for patching, legacy devices, power, and compute to maintain secure, recoverable systems.

Explore security infrastructure considerations, including device placement, failure modes (fail open or fail closed), active versus passive monitoring, DMZ design, attack surface reduction, and secure out-of-band management.

Explore common network appliances, including jump servers, proxy servers, ids/ips, load balancers, and sensors, and learn how they secure remote access and traffic in cloud and on-prem environments.

Explore port security as a defense in depth tool for switches, using mac address locking and sticky learning alongside 802.1x for robust wired and wireless network access.

Trace the evolution of firewalls from stateless inspection to deep packet inspection across layers 4–7, and explore cloud-guarded web application firewalls and open source options like Naxi and Mod Security.

Explore secure communication and access for remote workers via VPNs, TLS, IPSec, and clientless options, then examine SD-WAN and SAS for cloud WAN and zero trust.

Explore selecting effective security controls by classifying physical, technical, and administrative controls and their preventative, detective, and corrective roles, balancing budget and not one size fits all.

Identify where data types reside and safeguard regulated data, trade secrets, personal information, IP, and financial information across the organization's data estate.

Classify data with labels, from public to private to sensitive to restricted to confidential, and integrate these classifications into security controls and cloud tools like Macie and data loss prevention.

Explore data states at rest, in transit, and in use, along with data sovereignty and geolocation, and learn how labeling, encryption, and protections against access-based attacks safeguard data.

Explore how encryption and hashing protect data at rest and in transit, and differentiate confidentiality from integrity with masking, tokenization, obfuscation, and segmentation, using AES and SHA.

Explore high availability concepts and site considerations, including load balancing versus clustering, horizontal scaling, hot, warm, and cold sites, and metrics like RTO, RPO, and five nines.

Compare single-vendor versus multi-vendor IT strategies, with Cisco, Palo Alto, Dell, Aruba, and Splunk across network, security, and monitoring, plus multi-cloud choices AWS, Azure, and Google Cloud.

Explore continuity of operations and business continuity alongside capacity planning to keep systems available during security breaches, natural disasters, and power outages, using backups, virtualization, serverless compute, and cloud-based redundancy.

Explore testing of security designs and infrastructure with tabletop exercises, failover testing, simulations, and pen testing, featuring red team, blue team, and purple team to drive measurable improvements.

Explore on-site and off-site backups, including replication, snapshots, and journaling, to protect mission-critical data with appropriate cadence, encryption, and recovery testing in cloud and hybrid environments.

Explore how generators and UPS shape disaster recovery, with load assessment, fuel storage, automatic transfer switches, maintenance, remote management, and governance to ensure secure, reliable power for virtualized IT.

Explore identity and access management as a centralized lifecycle that authenticates identities, validates credentials, and authorizes access to resources across directory and cloud environments.

Explore wireless security by configuring access points, changing defaults, and using wpa2 or wpa3 with site surveys, heat maps, and encryption best practices.

Explore operating system security by reducing attack surfaces, enforcing centralized administration, strong authentication, host-based controls, and integrity monitoring to harden systems against cyber threats.

Explore firewalls and intrusion detection devices, compare IDS and IPS, and learn how ACLs, implicit deny, and rule processing strengthen enterprise security, including DMZs and screen subnets.

Explore password security and management through password policies, complexity, length, age, history, and forbidden strings, and leverage password managers, single sign-on, multi-factor authentication, and passwordless options.

Explore web filtering concepts, including url filtering, content filtering, and dns filtering, plus how centralized proxies, on-prem or cloud deployments, and network appliances enforce access controls and reputation checks.

Explore the NIST-based incident response process, covering preparation, detection, analysis, containment, eradication, recovery, and post-event lessons learned to continuously improve security.

Explore endpoint detection and response (edr) and its evolution to extended detection and response (xdr), covering endpoints, telemetry, detection, investigation, automated responses, and threat hunting.

Explore single sign-on and identity federation concepts, including IDPs, service providers, SAML, OAuth, OpenID, Kerberos, and how a layered approach with MFA and tokenization strengthens access across resources.

Explore secure network protocols and services, including https, tls handshakes, tcp three-way handshake, ldap secure, sftp, smb3, smtp, imap, pop3, and ike v2.

Explore how automation and scripting reduce human error in security operations, enabling consistent provisioning, fast disaster recovery, and secure, scalable continuous integration and delivery, with guard rails and just-in-time access.

Learn how asset management provides a systematic lifecycle for procuring, documenting, assigning ownership, classifying, monitoring, tracking, and disposing assets, with data sanitization and certification to protect information and reduce costs.

Learn how privileged identity management fits inside identity and access management, with monitoring, provisioning and de-provisioning of administrative accounts, just-in-time access, privilege bracketing, and password vaulting.

Ensure input validation to verify text inputs before they reach the database, safeguarding data with syntactic and semantic checks and strategies like secure cookies, static code analysis, and code signing.

Discover investigation data sources and the vital role of log data in security incidents. Leverage security dashboards, vulnerability scans, PCAPs, and network, firewall, IDS/IPS, and endpoint logs to illuminate investigations.

Explore mobile device security within a modern BYOD era, covering deployment models (BYOD, CYOD, COPE, COSU), centralized MDM, and key protections like MFA, encryption, containerization, ABAC, and VPN use.

Assess vulnerability analysis by understanding risk tolerance, false positives and false negatives, and how CVEs and CVSS guide asset classification, prioritization, and remediation.

Explore digital forensics activities, including legal hold, chain of custody, data acquisition, preservation, reporting, and eDiscovery, with emphasis on maintaining evidence integrity and legal admissibility.

Master vulnerability response, remediation, and reporting; apply patches, compensating controls, and segmentation, then validate with rescans and auditing to ensure secure, auditable results.

Security baselines define expected configurations to meet regulations, standards, and vendor guidance across on-prem and cloud environments, while hardening reduces attack surfaces through enforced controls and continuous monitoring.

Explore how to onboard and offboard employees with a structured provisioning process, identity proofing, role-based access control, and secure offboarding practices that protect assets and data.

Explore how email security uses S-MIME encryption and DKIM, SPF, and DMARC to ensure origin authentication, non-repudiation, and integrity while protecting confidentiality and data loss prevention.

Explore how security monitoring provides visibility and how alerting delivers awareness for incident response across applications, systems, and infrastructure, using tools like EDR, DLP, SIEM, SNMP, and vulnerability scanners.

Identify vulnerabilities via vulnerability scanning and OSINT, using static and dynamic testing (SAST and DAST) with white and black box approaches, applying threat feeds, package monitoring, pen testing, and auditing.

Clarify the distinction between guidelines and policies with examples like access controls and security incident response, and examine formal policies such as the acceptable use policy and information security policy.

Discover how standards and procedures shape organizational security, covering password management, multi-factor authentication, access control, encryption, change management, onboarding, and playbooks.

Identify external considerations shaping organizational standards, including regulatory, legal, and industry practices, and monitor and revise policies to stay compliant with HIPA laws and California PII protections.

Explore governance structures, including boards of directors and committees, government entities, and centralized versus decentralized models, with Cisco as a real-world example and independent oversight insights.

Explore common data roles and responsibilities, owners, controllers, processors, and custodians, and how separation of duties and least privilege strengthen data governance and security.

Perform risk identification and assessment by analyzing threats, vulnerabilities, and assets, then evaluate impact and likelihood to produce prioritized risk scenarios and ongoing mitigation and monitoring.

Explore risk analysis through qualitative and quantitative approaches, using tools like risk matrices, SLE, AV, EF, ALE, and ARO to assess and prioritize organizational risk.

Explore how to use a risk register to track risks, risk owners, and thresholds, and distinguish risk appetite, tolerance, and expansionary, neutral, and conservative profiles.

Apply the risk management framework, transferring risk, accepting risk, avoiding risk, and mitigating risk, using cloud examples like AWS and external contractors to balance risk and reward.

Explore how to report risk and conduct a business impact analysis, with clear definitions of RTO, RPO, MTTR, and MTBF to assess and communicate organizational risk.

Explore vendor assessment and selection with a security lens, covering penetration testing rules, auditing versus testing, independent assessments, supply chain, and building a due-diligence committee to reduce conflicts of interest.

Explore common vendor agreement types, from service level agreements to memoranda of understanding, and learn to tailor metrics, baselines, and NDAs to your use case.

Monitor vendors systematically with ongoing assessments and KPIs to ensure service levels align with agreements, maintain transparency via engagement rules, and minimize scope-related risk.

Explore how governance shapes internal and external compliance in security program management, covering policies, training, and metrics to protect customer data and avoid fines, sanctions, and reputational damage.

Implement ongoing compliance monitoring with baseline metrics, push-based alerts, and automated tools in Microsoft 365 and Azure, plus attestation and a clear compliance score for audits.

Explore key privacy concepts in governance, data subjects, and the roles of data controllers and processors, and learn how to inventory, retain, and delete private data in compliance.

Attestation is a formal, documentation-driven process that proves to third parties that security controls are effective, with independent auditors gathering evidence, defining scope, and performing a gap analysis.

Explore internal and external audits, audit committees, governance, and self-assessments to improve compliance, train employees against phishing, and reduce bias with independent assessments.

Learn about penetration testing, including physical security testing, red and blue teams, and purple team coordination; compare known, unknown, and partial environment knowledge, and passive versus active reconnaissance.

Learn to recognize phishing, including spear phishing and smishing, by training end users to inspect sender name and domain, greetings, urgent language, report threats, and participate in anti-phishing campaigns.

Learn how anomalous behavior recognition, powered by AI-enabled security devices and baselines, detects zero-day attacks beyond known signatures, and how end-user training enhances early alerting and response.

Build end-user security awareness through clear policies and handbooks, situational awareness of threats, and recurring training on phishing, password management, insider threats, social engineering, and VPN and operational security.

Implement a robust monitoring and reporting process for security awareness, covering initial setup and recurring phishing simulations, baselines, and post-training assessments. Track KPIs and deliver clear executive reports to management.

Develop a security awareness program with a thorough needs assessment and clear goals. Use diverse delivery methods, pilot tests like phishing, and foster a culture of security with feedback.