CompTIA Security+ Exam Prep Add-On

Foundational vocabulary the rest of the exam builds on. Security controls (technical, managerial, operational, physical), the CIA triad with non-repudiation, change management, and cryptographic primitives.

• ++Control categories: technical, managerial, operational, physical, and the matching control types (preventive, deterrent, detective, corrective, compensating, directive)
• ++CIA triad plus authentication, authorization, accounting, and non-repudiation
• ++Change management: approval, scheduling, version control, rollback, ownership
• ++Cryptographic primitives: symmetric vs asymmetric, hashing, digital signatures, certificates, PKI, key escrow, key stretching
• ++Zero trust: control plane, data plane, policy decision point, policy enforcement point, adaptive identity

Primary sources:

• CompTIA Security+ SY0-701 Exam Objectives (official PDF)
• NIST SP 800-53 Rev. 5: Security and Privacy Controls
• NIST SP 800-207: Zero Trust Architecture

The largest single domain on the exam. Threat actors, motivations, vectors, common malicious software, application vulnerabilities, and the matching mitigation patterns.

• ++Threat actor categories: nation-state, organized crime, hacktivist, insider, unskilled attacker, and the matching motivations
• ++Attack vectors: message-based, image-based, file-based, voice call, removable media, vulnerable software, unsecured networks, open service ports, default credentials, supply chain
• ++Malware: virus, worm, trojan, ransomware, spyware, bloatware, keylogger, rootkit, logic bomb
• ++Application vulnerabilities: memory injection, buffer overflow, race conditions (TOCTOU), malicious update, hardware (firmware) vulnerabilities
• ++Mitigation techniques: segmentation, access control (ACL), application allow list, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, hardening

Primary sources:

• MITRE ATT&CK framework
• OWASP Top 10
• NIST SP 800-115: Technical Guide to Information Security Testing

How architectural choices shape the security posture. Cloud and virtualization, network architecture, infrastructure, secure data design, data states, and resilience.

• ++Architecture models: cloud, serverless, microservices, network infrastructure, IaC, on-premises, centralization vs decentralization, containerization, virtualization, IoT, ICS/SCADA, RTOS, embedded systems, high availability
• ++Network considerations: availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, ease of recovery, patch availability, inability to patch, power, compute
• ++Secure infrastructure: device placement, security zones, attack surface, connectivity (firewall, IDS/IPS, load balancer, sensors, proxy, gateway, jump server)
• ++Data classification, data states (in transit, at rest, in use), data types (sensitive, regulated, intellectual property, legal), data sovereignty
• ++Resilience and recovery: site redundancy (geographic dispersion, hot, warm, cold), platform diversity, multi-cloud, backups, capacity planning, testing (tabletop, fail-over, simulation, parallel processing)

Primary sources:

• NIST SP 800-145: The NIST Definition of Cloud Computing
• NIST SP 800-160 Vol. 1 Rev. 1: Engineering Trustworthy Secure Systems
• Cloud Security Alliance: Cloud Controls Matrix v4

The largest domain by weight. Day-to-day defense: hardening, security techniques across the infrastructure, identity and access, automation, incident response, and digital forensics.

• ++Hardening targets: mobile, workstation, switch, router, cloud, server, ICS, IoT, embedded systems
• ++Wireless security: WPA3, AAA / RADIUS, cryptographic protocols, authentication protocols (PEAP, EAP-TLS, EAP-TTLS), site surveys, heat maps
• ++Application security: input validation, secure cookies, static analysis (SAST), code signing, sandboxing, monitoring
• ++Vulnerability management: discovery (scanner, agent, OSINT, static / dynamic analysis, bug bounty, penetration testing), analysis (CVSS, CVE), validation (false positive), reporting
• ++Identity and access: provisioning, deprovisioning, federation (SAML, OIDC), SSO, LDAP, OAuth, MFA factors (something you know / have / are / where you are / what you do), password policies, password managers, passwordless, privileged access (just-in-time, password vaulting, ephemeral credentials)
• ++Incident response: preparation, detection, analysis, containment, eradication, recovery, lessons learned (NIST SP 800-61 Rev 2 lifecycle)
• ++Digital forensics: legal hold, chain of custody, acquisition, reporting, preservation, e-discovery

Primary sources:

• NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide
• NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management
• NIST SP 800-92: Guide to Computer Security Log Management

The governance and risk-management view. Security governance, risk-management process, third-party risk, compliance, audit, and security awareness.

• ++Security governance: policies, standards, procedures, guidelines, external considerations (regulatory, legal, industry, local / regional / national / global)
• ++Risk-management process: risk identification, assessment (qualitative, quantitative, SLE, ALE, ARO), analysis, treatment (transfer, accept, avoid, mitigate), reporting
• ++Third-party risk: vendor selection (due diligence, conflict of interest), agreements (SLA, MOA, MOU, MSA, WO/SOW, NDA, BPA), monitoring, questionnaires, rules of engagement
• ++Compliance: regulated industries, reporting (internal, external), monitoring, attestation, automation, due diligence, due care, attestation, acknowledgement
• ++Audit and assessment: internal vs external attestation, examinations, penetration testing (physical, offensive, defensive, integrated, known / partially known / unknown environment), reconnaissance (passive, active)
• ++Security awareness: phishing, recognizing a phishing attempt, anomalous behavior recognition (risky, unexpected, unintentional), user guidance and training

Primary sources:

• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
• NIST SP 800-37 Rev. 2: Risk Management Framework
• ISO/IEC 27001:2022 (overview via ISO)