CompTIA Security+ SY0-601 Lab Course with Simulations/PBQ

Protect people as the top asset and apply the CIA triad (confidentiality, integrity, and availability) using encryption, hashing, and access control to guard data, systems, and services.

Learn the IAAA framework—identification, authentication, authorization, auditing, and accountability—and how log files and non-repudiation deter intrusions and hold users accountable.

Identify basic security controls, including user training, endpoint protection, encryption, access controls, and physical safeguards, to defend against phishing, malware, and unauthorized access.

Learn to combat shoulder surfing with privacy screens and user training, and prevent dumpster diving through shredding or incineration of confidential documents.

Explore tailgating and piggybacking in secure access, and learn how mantraps enforce authentication between two doors to prevent unauthorized entry in data centers and high-security spaces.

Explore malware fundamentals, distinguishing viruses, worms, and trojans, and understand how viruses spread versus self-spreading worms, plus a look at ransomware and demonstrations.

Explore ransomware and crypto malware, how they encrypt data and demand ransom, and how to prevent infections via backups, email links, and antivirus.

Explore adversarial AI and how attackers use evasion attacks, data poisoning, and model stealing to undermine machine learning systems, from stop sign tricks to IDs and spam filters.

Understand supply chain attacks from raw materials to customers, and how attackers tamper with electronics to disrupt systems, with examples like the Target POS breach and the Stuxnet worm.

Explore keyloggers, including software and hardware variants, and how they capture keystrokes, passwords, and screen activity. Learn defenses such as updated antivirus, firewalls, and physical inspection to protect data.

Learn how passwords are stored as cryptographic hashes rather than plain text, and how the system rehashes input to verify logins. The video demonstrates MD5 and discusses password cracking.

Explore how hashcat uses GPU acceleration to crack passwords through a dictionary attack with the rockyou file, including MD5 hash generation and Windows setup.

Explore privilege escalation, including vertical and horizontal access, ssl stripping risks, and defenses like https and hsts, plus pass the hash on Windows systems.

Learn to identify cross-site scripting and injection attacks, their impact on web apps, and how input validation and sanitization defend against them.

Explore driver manipulation in this Security+ lab, covering shimming and refactoring, how digitally signed drivers protect the operating system, and the importance of obtaining drivers from trusted sources.

Explore bluesnarfing and bluejacking, bluetooth attacks that grant unauthorized access to calendars, contacts, emails, messages, photos, and videos; learn to mitigate by turning off discovery mode and updating devices.

Watch a live demonstration of cracking WEP with Kali Linux, using a single command and an IV attack to expose why WEP should never be used for wireless security.

Explore wireless disassociation and deauthentication attacks and jammers, showing how Kali Linux can disconnect devices while highlighting legal and ethical considerations for wireless security testing.

Examine man in the middle attacks, including ARP poisoning and man in the browser, with a Cain and Abel demo and emphasis on encrypted traffic.

Explore IV attacks on wireless encryption, then learn RFID attack vectors—sniffing, replay, and denial of service—and examine NFC risks like data modification and replay, with practical security measures.

Explain how switches use mac addresses and cam tables to forward traffic, and how mac flooding can turn a switch into a hub, use mac cloning to spoof a NIC.

Learn about malicious code and script execution across Windows and Linux, including PowerShell, Python, Bash, and VBA macros, and how anti-malware and regular updates stop these threats.

Identify threat actors and their attributes, from insider threats to state-sponsored actors and criminals. Explore motivations, sophistication, resources, and vectors like direct access, phishing, supply chains, and cloud.

Explore threat intelligence sources—from open source intelligence and OS frameworks to vulnerability databases and indicators of compromise—for ethical hacking and pen testing.

Explore vendor advisories, CVE databases, threat feeds, and security conferences (including Defcon) to identify vulnerabilities using Mitre resources, RFCs, and IETF research for informed security.

Compare cloud-based and on-premises vulnerabilities, highlighting data control, internet accessibility, multi-tenant risks, and deletion concerns. Explain zero-day exploits and practical mitigations like updates, firewalls, and malware scanning to strengthen security.

Explore the organizational impacts of hacking and compromised vulnerabilities, including data loss and breaches, ransomware, financial loss, and damaged reputation, with emphasis on backups, regulatory risk, and legal jeopardy.

Identify threats through threat hunting by leveraging intelligent fusion centers and threat feeds, and stay up to date with CVE advisories and csa.gov bulletins on vulnerabilities and maneuvers.

Explore how SIEM systems centralize log collection, analyze security events, and generate alerts, then see how SOAR automates threat response to strengthen security operations.

Explore penetration testing as an external, permission-based security assessment, detailing reconnaissance, vulnerability assessment, exploitation, rules of engagement, and remediation.