CompTIA Security+ SY0-701 Full Course, Labs, and Study Plan

Master core security concepts like CIA and triple A, including confidentiality, integrity, availability, authentication, and authorizations, to build the foundation for the rest of the course.

Explore the CIA triad—confidentiality, integrity, and availability—and how firewalls, encryption, intrusion detection system, and malware protection secure data, networks, and people.

Explore confidentiality as the core IT security tenet and learn to use access control, passwords, ACLs, encryption, and SSL/TLS to protect data from unauthorized access.

Ensure data integrity by preventing unauthorized changes and confirming accuracy through digital signatures and access controls that differentiate write and view permissions.

Treat security as availability; ensure data systems are accessible to authorized users, protect confidentiality and integrity, and maintain availability through backups, RAID systems, and dual power supplies against DDoS.

Learn how the CIA triad—confidentiality, integrity, and availability—drives protection against disclosure, alteration, and denial to preserve data and system uptime.

Adopt zero trust by authenticating every access request and enforcing least privilege with adaptive identity, MFA, policy enforcement point, and policy decision point, plus continuous monitoring.

Explore non-repudiation in information technology security, ensuring a party cannot deny an action by using digital signatures and certificates that verify origin and authenticity of messages.

Master the triple A framework—authentication, authorization, and accounting—and learn how to verify identities, control access with access control lists, and track user activity.

Explore how authorization controls user access by assigning rights and permissions through ACLs; see administrators grant or deny folder access and manage read and write rights.

Track user activity and resources through accounting by logging logins, file access, and changes in system log files such as Windows security logs, enabling auditing and accountability.

Accountability in security requires identifying, authenticating, authorizing, and tracking actions with log files to hold individuals responsible; if any step fails, accountability cannot be established.

Identify the current security state, define the desired state, and analyze gaps in controls and policies to meet standards and regulatory requirements through a structured gap analysis.

The lecture explains four control categories: technical (logical) controls, managerial (administrative) controls, operational controls, and physical controls, using firewalls, policies, training, and cameras as examples.

Analyze how controls span multiple types, including preventative, detective, corrective, deterrent, directive, and compensating, with examples like firewalls, encryption, intrusion detection systems, and surveillance.

Secure data with multiple layers of controls through defense in depth, pairing firewall, encryption, policies, procedures, and physical security.

Explore why attackers target organizations, from financial gain to espionage and political motives; examine data theft, ransomware, backdoors, DDoS, hacktivism, blackmail, disgruntled employees, chaos, and nation-state warfare to secure networks.

Identify threats to networks, from nation-states to insider threats and shadow IT, and learn how cameras, firewalls, intrusion detection system, and other controls protect against them.

Assess whether threats are internal or external, their funding and resources, and their sophistication to defend networks from insider threats, nation-state attackers, and unskilled attackers.

Nation-state threats rely on unlimited funding and advanced persistent threats to disrupt infrastructure, steal information, and influence politics, requiring a massive, layered defense.

Explain how unskilled attackers, often script kiddies, use pre-made tools to exploit vulnerabilities that are not patched and why organizations must keep systems secure.

Promote political agendas through hacking, as hacktivists deface sites, gain unauthorized access, release confidential information, and defend machines with defense in depth and layered security controls.

Learn how organized crime operates as a hierarchical, well-funded threat using ransomware and data theft to steal money; defend with robust controls, firewalls, IDs, and user training.

Identify how shadow IT arises from security restrictions and user needs, including unapproved software and cloud storage, risking data breaches and noncompliance.

Explore threat vectors and attack surfaces from phishing, instant messaging, image-based malware, USB drops, vulnerable software, and default credentials, and apply a layered security approach.

Identify vulnerabilities as weaknesses in a network that hackers exploit to gain unauthorized access, including misconfigured firewalls, default passwords, open ports, and unpatched devices facing zero day attacks.

Memory injection enables attackers to place malicious code into a program's memory, with buffer overflow as a key example and secure coding practices and vulnerability scanners as defenses.

Explore race conditions and time-of-check-to-time-of-use errors, where timing gaps between access and open enable attackers to insert malicious code. Learn how secure programming and input validation prevent these vulnerabilities.

Protect devices from malicious updates that impersonate operating systems, applications, or firmware. Download updates only from the manufacturer’s official site and verify authenticity with digital signatures or code signing.

Update the operating system regularly to close vulnerabilities that could allow unauthorized access. Enable automatic updates and avoid end-of-life systems to protect desktops, kiosks, and embedded devices.

Explain how SQL injection inserts malicious SQL into input fields to bypass logins, and show how input validation helps secure the front end against back end database queries.

Learn how cross site scripting (XSS) creates web vulnerabilities by injecting client-side scripts, and apply input validation to prevent such attacks in web applications.

Explore hardware vulnerabilities, including firmware weaknesses, end-of-life hardware, and legacy devices, and learn how updating trusted firmware and avoiding outdated hardware protects high-security networks.

Explore virtualization vulnerabilities, including VM escape and resource reuse, where malware in a VM can compromise the host; learn why patching virtualization software prevents attacks.

Explore cloud-specific vulnerabilities, including data breaches and insecure APIs, across on prem, off prem, and hybrid environments to understand how cloud data can be protected.

Explore supply chain vulnerabilities across IT by outlining service, hardware, and software providers, and show how breaches, tampering, and firmware or software flaws can compromise the entire chain.

Explore encryption vulnerabilities, from weak algorithms like DES to key mismanagement, and learn why TLS and AES 256 vs 128 choices impact security.

Master misconfiguration vulnerabilities by avoiding default settings, disabling unnecessary services, and applying proper firewall, anti-malware, intrusion detection, and cryptographic solutions.

Discover how mobile devices hold confidential data from emails to credit card info, and learn about vulnerabilities like outdated updates, unencrypted wi-fi, physical access, and jailbreaking or sideloading.

Explore zero-day vulnerabilities, why attackers exploit unknown flaws before patches exist, and how a layered security approach thwarts these threats.

Explore malware, the threats that aim to harm your computer, and learn to distinguish worms, viruses, Trojan horses, logic bombs, and rootkits, plus exam-focused defense strategies.

Explain what computer viruses are and how they spread, including file infector, macro, and boot sector viruses, and outline antivirus detection with signatures, heuristic methods, and regular updates.

Analyze how worms replicate to spread across networks by exploiting OS and service vulnerabilities, and apply defenses such as Windows update, antivirus, network segmentation, access control, firewalls, and user training.

Trojan malware disguises as legitimate software to trick users into downloading or executing it; defend with patch management, antivirus, network segmentation, access control, firewalls, filtering, and user training.

Explore ransomware: how malware encrypts or steals data, demands payment, and threatens availability; learn defenses like backups, patch management, antivirus, network segmentation, firewalls, traffic filtering, and user training against phishing.

Learn how spyware silently steals data by logging keystrokes, capturing screens, and recording browsing history, and discover preventive steps: updates, antivirus, secure browsing, user training, firewalls, and traffic filtering.

Explore how rootkits provide continued privileged access and hide from administrators. Discover defenses like secure boot, anti-rootkit tools, system hardening, and patch management.

Logic bombs are dormant malware that trigger on time or action. They may delete data or spy on activity; defend with anti-malware, backups, code reviews, and change management.

Examine hardware and software keyloggers, how they capture keystrokes and passwords for surveillance, and defend with two-factor authentication and the on-screen keyboard.

Bloatware is unwanted pre-installed software that consumes resources and may slow devices. Choose devices carefully, use removal tools, or disable unnecessary apps to speed up systems.

Explore how distributed denial of service attacks overwhelm targets with botnet traffic. Learn UDP floods, SYN floods, and amplification or reflection techniques using DNS, NTP, and SSDP.

Explore how DNS resolves bestbuy.com to an IP address and how attacks like DNS spoofing, cache poisoning, amplification, tunneling, and hijacking undermine security, with DNSSEC and zone signing as defenses.

Explore how an on-path attack intercepts and possibly manipulates data between you and a server, using sniffing on unencrypted connections. Use https and VPNs to stop it.

Secure login credentials against credential replay by encrypting transmission with ipsec or tls, and applying multi-factor authentication, strong passwords, regular password changes, and ongoing monitoring for unusual login attempts.

Understand privilege escalation, where attackers move from a normal user to an administrator or access other data across the network, via vertical and horizontal escalation, vulnerabilities, rootkits, or social engineering.

Explore request forgery attacks, including cross-site and server-side variants, and learn practical defenses like anti cross-site request forgery tokens, refer header, input validation, least privileges, and network segmentation.

Demonstrates a directory traversal vulnerability in Windows IIS by enabling directory browsing, exposing files like secret.txt through a misconfigured web server, and shows how to disable directory browsing.

Identify indicators of malicious activity such as account lockout, impossible travel logins, concurrent sessions, block content or firewall alerts, and abnormal resource use, and train users to report anomalies.

Learn core cryptography concepts used to secure data across networks. Explore hashing, encryption, and the SSL handshake, and authentication to defend against adversaries.

Learn core cryptography terms, including encryption that hides data from unintended recipients, crypto analysis, cryptology, and cryptographic keys and crypto variables.

Learn the four goals of cryptography: confidentiality, integrity, authentication, and non-repudiation, using encryption, cryptographic hashes, and digital certificates or signatures; note cryptography does not address availability.

Explore the difference between cryptographic algorithms and keys, using Caesar cipher as a starting point, and learn how key length and randomness drive security in AES and RSA.

Explore block ciphers and stream ciphers, noting block-by-block vs bit-by-bit encryption. Understand substitution and transposition and how multiple rounds strengthen ciphers.

Learn how symmetric encryption uses the same key to encrypt and decrypt data, its speed advantages, key distribution challenges, and its role in AES, SSL/TLS, and VPNs.

Explore iconic symmetric encryption algorithms, from DES and triple DES to AES (Rijndael) and RC4, noting DES cracking and AES as today’s standard.

Explore asymmetric cryptography with public and private keys, enabling secure key distribution and digital signatures, while noting its slow bulk-data performance and the hybrid approach used in practice.

Explore RSA, ECC, Diffie-Hellman, and ElGamal, focusing on what they are, their uses in digital signatures, key exchanges, and SSL/TLS, and their pros and cons.

Learn how hybrid cryptography combines asymmetric key exchange with symmetric encryption to secure data, using a session key encrypted by a public key, as in SSL handshakes.

Learn how cryptographic hashes convert data of any length into a fixed-length, one-way sha-256 hash, demonstrating determinism, the avalanche effect, and collision resistance via the birthday paradox.

Explore common hashing functions, including sha-256 and sha-512, and learn why md5 and sha-1 are deprecated due to collisions, while hash functions serve integrity, not encryption.

Explain how a digital signature proves authenticity, integrity, and non-repudiation, not confidentiality, by hashing a message and encrypting the digest with a private key for verification with a public key.

Explore PKI fundamentals by showing how TLS uses certificates and certificate authorities to verify Amazon.com's identity, with the lock icon and certificate fields securing trusted connections.

Explore how the ssl handshake builds trust. The client validates the certificate with a certificate authority, encrypts the symmetric key with the server's public key, and establishes aes session key.

Learn the PKI process for obtaining and installing a trusted certificate. Generate a public key pair, create a CSR, and obtain CA issuance via RA and VA.

Explore x.509 certificates, detailing version, serial number, issuer, subject, and public key, then compare self-signed versus third-party certificates and discuss validation, wildcard use, and trust for internal and external use.

Understand the PKI root of trust, with a root CA, subordinate CAs, and an offline root. Minimize the impact when a CA is compromised by isolating issuance to lower CAs.

Verify that a received certificate originates from the issuer by checking the CA signature against a store, and review revocation methods like CRL and OCSP, plus certificate pinning for security.

Learn steganography, encoding hidden messages into images and other media, and apply detection techniques such as file size analysis and hash checks to reveal concealed data.

Learn blockchain as a decentralized, distributed ledger of transaction blocks secured by hashing, where each block contains the previous hash, across thousands of machines, enabling public ledgers beyond cryptocurrency.

Discover how salt randomizes each password before hashing, creating a salted hash stored instead of plaintext, and how verification rehashes with the same salt to resist brute-force attacks.

Protect data by enabling disk encryption with a TPM chip, storing cryptographic keys and verifying the boot process to secure mobile laptops.

Secure enclaves isolate sensitive data like fingerprints and passwords from main memory to prevent malware access during cryptographic operations, providing hardware-level isolation and tamper resistance for secure processing.

Learn how data obfuscation disguises sensitive data to protect confidentiality, and compare it with data masking, encryption, and tokenization for secure testing and development.

Explore tokenization as a method to substitute sensitive payment data with tokens, using PayPal and token servers to protect credit card details while enabling merchant transactions.

Key escrow stores cryptographic keys with a trusted third party to enable access for data recovery, compliance with law enforcement requests, or maintaining business continuity in critical scenarios.

Hardware security modules offload cryptographic processing for secure key generation, storage, encryption, decryption, signing, and management, available as PCIe cards or cloud HSMs (AWS) with FIPS levels 1–4.

Explore social engineering, a range of malicious activities carried out through human interaction that trick people into bypassing security procedures to access systems, networks, or locations.

Identify phishing and social engineering as credential theft risks via emails, texts, or calls; reinforce defenses with user education, email filtering, MFA, and rapid incident response.

Explore vishing, a voice-based social engineering attack that impersonates trusted institutions to steal sensitive data, using urgency and spoofed caller IDs; learn verification steps and multifactor defenses to prevent it.

Identify smishing as text-message phishing that mimics banks, prompting credential disclosure; verify via calling the bank and use training and security apps to block these messages.

Learn to identify spear phishing, a highly targeted phishing using personalized emails and attachments. Implement user training and email filtering to defend against spoofed messages from leaders like the CEO.

Explains misinformation vs disinformation, how false information spreads on social media, and trains users to verify sources, fact-check, and practice cyber hygiene.

Learn how impersonation through spoofed emails and social engineering lets attackers steal credentials and access sensitive data, and how multi-factor authentication, strong passwords, user training, and incident planning stop them.

Explore business email compromise, where spoofing and hijacking impersonate leaders to request funds or data, and learn to train employees and apply spf, dkim, and dmarc to stop it.

Explore how pretexting uses fabricated scenarios and trusted figures like the IRS to elicit actions such as buying gift cards, and learn verification and reporting to counter impersonation and phishing.

Learn how watering hole attacks target groups by infecting websites they frequently visit, causing drive-by downloads, and defend through website security audits, updated antivirus, and network segmentation.

Explore how brand impersonation uses fake emails, fake websites, and counterfeit elements to deceive users, steal data, or spread malware, and learn practical mitigations and incident response.

Learn about typosquatting, a cyberattack that registers misspellings of popular domains to mislead users and install malware, and how to prevent it by bookmarking, educating users, and registering common misspellings.

Train your users to recognize phishing emails and report suspicious messages. Use phishing campaigns to test awareness, reinforce security training, and highlight anomalous or risky behavior.

Develop and deploy a dynamic security awareness program that trains users to recognize phishing, insider threats, and social engineering, follow handbooks, manage passwords, and report incidents.

Segment your network with VLANs to create multiple subnets, keep broadcast traffic contained, and boost security and performance by preventing worm spread and restricting access between sales and accounting.

Explore isolation and segmentation in security networks, including a fully disconnected laptop for top secret data. Discover how isolation prevents contact with other systems while segmentation enables controlled interconnections.

Access control governs granting or denying access between subjects (users or processes) and objects (resources). Tools like ACLs, Windows permissions, firewalls, and encryption enforce who can access what.

Apply the principle of least privilege to limit user and process access to only what’s needed, use standard accounts for daily tasks, and reserve admin accounts for privileged tasks.

Explore how access control lists, used by routers, firewalls, switches, and file systems, authorize or deny traffic based on IP addresses and rules, enabling port openings for services.

Understand how to configure file system permissions for files and directories, assigning access to users and groups with read, write, execute, and modify rights.

Adopt an application allow list to run only pre-approved software, and deny everything else by default. Test compatibility and keep the list updated to boost security.

Patch software regularly to fix vulnerabilities and bugs, and enable automatic updates on devices. Test updates on a Windows Update Server before phased deployment, balancing security with compatibility.

Enforce configuration enforcement across hardware and software with change management policies, approvals, testing, and rollback to prevent misconfigurations and protect network security.

Decommissioning ob 2.5 outlines formally retiring it assets—hardware, software, and data—via safe procedures that prevent vulnerabilities and address data destruction and regulatory retention.

Learn to continuously monitor network traffic and systems with intrusion prevention and detection, firewalls, siem and dlp systems to detect anomalies and prevent breaches.

Apply hardening techniques to reduce vulnerabilities and minimize the attack surface. Encrypt data at rest and in transit, use https, close unused ports with firewalls, and remove unused software.

Explore cloud computing fundamentals, including public, private, community, and hybrid deployment models, and service models—from software as a service to infrastructure as a service—alongside the shared responsibility and compliance considerations.

Learn how infrastructure as code treats hardware and virtual devices like software, using version control and testing to streamline changes across servers, routers, switches, and virtual machines, improving security.

Explore serverless architecture as a cloud concept where developers focus on writing and testing code while the cloud provider manages the servers and hardware; there is always a server.

Explore how microservices modularize an e-commerce app, separating inventory, accounting, checkout, user management, and payments, enabling flexible hosting across providers and selective scaling.

Identify air gap machines and air gap networks as physically isolated from networks to protect confidentiality. Update manually via usb and keep it offline to prevent malware and data theft.

Software defined networking centralizes control with an sdn controller, separating the control plane from routers and switches, and using southbound and northbound interfaces like OpenFlow to streamline routing.

Compare on-premises infrastructure with cloud options by weighing security control, cost, and risk. Keep in mind on-prem provides full internal control and security but incurs costs for space and cooling.

Centralized systems offer easy management and consistent policies but create a single point of failure. Decentralized systems boost resiliency but complicate security and increase costs.

Explore virtualization concepts and run multiple guest operating systems on one host with VirtualBox, VMware ESX, and Hyper-V, including type one and type two hypervisors, VM escape, backups, and snapshots.

Explore containerization with Docker, comparing containers to virtual machines; learn how container engines share a single kernel to run multiple isolated containers, delivering faster deployment and higher density.

Design a network for high availability by minimizing planned and unplanned downtime through redundancy, raid, backup clusters, and failover mechanisms while weighing costs and business impact.

Explore the internet of things, its risks, and practical security measures such as password management, timely updates, and network segmentation to protect IoT devices in both home and corporate environments.

Explore the security risks of industrial control systems powering critical infrastructure, including SCADA and PLCs, and learn isolation, segmentation, updates, and password management to defend against attacks like Stuxnet.

Evaluate deployment options from monolith vs microservices, on-prem vs cloud, weighing high availability, resiliency, scalability, and cost, while considering patching, support, risk transfer, and power needs.

Explore real time operating systems and embedded systems, their dedicated task focus, small footprints, and use in safety critical devices such as medical devices, flight controllers, cameras, and microphones.