CompTIA Security+ Certification Course (SY0-701)

Learning objective: Learning goal: Learn social engineering techniques, how to identify the type of attack, application and network attacks, threat actors, vectors and sources, and common vulnerabilities.

• Security policy
• Threat actors
• Social engineering
• Phishing and types of malware
• Trojans and spyware
• Security control types
• Defense in depth
• Frameworks and compliance
• Security assessment techniques
• Vulnerability scanning concepts
• Penetration testing concepts
• Exploitation frameworks

• Learning goal: Learn how to monitor your security posture, detect incidents and respond to them in a structured way.
• Security monitoring and log analysis
• Security information and event management (SIEM)
• Indicators of compromise
• Threat hunting basics
• The incident response process: preparation, detection and analysis
• Containment, eradication and recovery
• Lessons learned and incident reporting
• Vulnerability management and remediation

• Learning goal: Learn cryptographic concepts, use symmetric and asymmetric algorithms, and understand cryptographic attacks and how to stop them.
• Cryptographic terms and ciphers
• Hashing algorithms
• Symmetric and asymmetric algorithms
• Diffie-Hellman and elliptic curve cryptography
• Transport encryption
• Cryptographic attacks
• PKI standards, digital certificates and certificate authorities
• Implementing PKI and managing keys
• Key status and revocation
• PKI trust models
• PGP and GPG

• Learning goal: Learn authentication and authorization design, account management controls, and directory services such as LDAP and Active Directory.
• Access control systems
• Identification and authentication
• Kerberos, NTLM, PAP, CHAP and MS-CHAP
• Password attacks
• Token-based and biometric authentication
• Authorization and access control models
• Directory services, RADIUS and TACACS+
• Federation and federated identity protocols
• Windows Active Directory
• Account types, policies and credential management
• Accounting and auditing

• Learning goal: Learn network security, implement secure network designs, and install and configure security appliances.
• Network zones and segmentation
• Subnetting
• Switching infrastructure, attacks and hardening
• Endpoint security and network access control
• Routing infrastructure and NAT
• Software-defined networking
• Firewalls, web application firewalls and proxies
• Denial-of-service attacks
• Load balancers

• Learning goal: Learn wireless security, system and host hardening, and the security of embedded and specialized systems.
• Wireless LANs, WEP, WPA2 and WPA3
• Wi-Fi authentication and EAP
• Wi-Fi site security
• Personal area networks
• Trusted computing and hardware/firmware security
• Peripheral device security
• Secure configurations and OS hardening
• Patch management
• Embedded system security

• Learning goal: Learn the key security protocols, secure network access, and how to secure network applications.
• DHCP and DNS security
• Network management protocols
• HTTP, web servers, SSL/TLS and HTTPS
• Web security gateways
• Email services and S/MIME
• Secure file transfer
• Voice, video and VoIP security
• Remote access, VPNs, IPsec and IKE
• Remote administration tools
• Hardening remote access infrastructure

• Learning goal: Learn cloud computing basics, mobile and virtualization security, cloud security solutions and physical security controls.
• Mobile device deployment models and connection methods
• Mobile access control, enforcement and monitoring
• Virtualization technologies and security best practices
• Cloud computing and cloud security best practices
• Site layout, access, gateways and locks
• Alarm systems and surveillance
• Hardware security and environmental controls

• Learning goal: Learn risk management, secure application development and deployment, and the regulations, standards and frameworks that apply to applications.
• Business impact analysis
• Identifying critical systems
• Risk assessment and risk mitigation
• Application vulnerabilities and exploits
• Web browser exploits
• Secure application design and secure coding
• Auditing applications
• Secure DevOps

• Learning goal: Learn cybersecurity resilience, disaster recovery, organizational security, privacy, data handling and digital forensics.
• Continuity of operations and disaster recovery planning
• Resiliency strategies, recovery sites and backups
• Corporate security and personnel policies
• Interoperability agreements
• Data roles, sensitivity labeling and handling
• Data wiping and disposal
• Privacy, employee conduct and security training
• Forensic procedures and collecting evidence
• Capturing system images and analyzing evidence