SY0-701 CERTIFICATION PREP

CompTIA Security+ Study Guide

SYNTHESIZED FROM STAR V LEARNING CENTERS COURSE MATERIALS · JACKSONVILLE, FL

17 Chapters 5 Exam Domains Exam SY0-701 Max 90 Questions v2 Gaps Patched

// Exam Domain Weights (SY0-701)

1. General Security Concepts
12%
2. Threats, Vulnerabilities & Mitigations
22%
3. Security Architecture
18%
4. Security Operations
28%
5. Security Program Management & Oversight
20%
CH 01

Today's Security Professional

Domain 1 · Obj 1.1, 1.2
CIA Triad — The Foundation
ConfidentialityOnly authorized users can access data. Enforced by encryption, access controls, and authentication. Violated by data breaches, eavesdropping, and unauthorized disclosure. IntegrityData has not been tampered with or altered without authorization. Enforced by hashing, digital signatures, and checksums. Violated by man-in-the-middle attacks, corruption, and unauthorized modification. AvailabilitySystems and data are accessible when needed by authorized users. Enforced by redundancy, backups, and failover systems. Violated by DoS/DDoS attacks, hardware failure, and natural disasters. NonrepudiationSomeone who performed an action cannot later deny having done so. Enforced by digital signatures, audit logs, and certificates. Achieved through asymmetric cryptography.
The DAD Triad is the opposite of CIA: Disclosure (violates Confidentiality), Alteration (violates Integrity), Denial (violates Availability). Know both triads and what attacks map to which principles.
Security Control Categories
TechnicalControls implemented through technology. Firewalls, encryption, IDS/IPS, access control lists, authentication systems. ManagerialAdministrative controls. Policies, procedures, risk assessments, security awareness training, background checks. OperationalDay-to-day controls implemented by people. Security guards, user training, change management, incident response procedures. PhysicalControls protecting physical space and hardware. Locks, bollards, fences, cameras, access control vestibules, security guards.
Security Control Types
PreventiveStop a security issue before it occurs. Firewalls, encryption, locked doors, access controls. Acts before an attack. DeterrentDiscourage an attacker from attempting an attack. Barbed wire, warning signs, guard dogs, visible cameras. Reduces likelihood of attempt. DetectiveIdentify security events that have already occurred. IDS, security cameras, audit logs, SIEM. Monitoring after the fact. CorrectiveRemediate security issues after they occur. Restoring backups after ransomware, patching after exploitation, disabling compromised accounts. CompensatingAlternative control when the primary control cannot be implemented. Must meet the intent and rigor of the original requirement and provide a similar level of defense. Common in PCI DSS compliance. DirectiveInform and instruct employees what they should do. Policies, procedures, acceptable use agreements, security awareness training materials.
Control categories (Technical/Managerial/Operational/Physical) describe HOW the control is implemented. Control types (Preventive/Deterrent/Detective/Corrective/Compensating/Directive) describe WHAT the control does. A firewall can be both Technical AND Preventive.
Gap Analysis

A gap analysis reviews all security controls and objectives to identify where a control does not meet the objective — a "gap" in security posture. The process compares the current state of security against a desired target state (compliance framework, internal policy, or industry standard). Gaps found are prioritized for remediation.

AAA Framework
AuthenticationProving who you are. Passwords, biometrics, tokens, certificates. Verifies identity claim. AuthorizationWhat you are permitted to do after authentication. Permissions, roles, ACLs. AccountingTracking what authenticated users do. Audit logs, SIEM, event records. "Who did what and when."
Breach Impact Categories
FinancialDirect monetary losses, regulatory fines, legal fees, notification costs. StrategicOrganization becomes less effective at meeting business goals due to breach. ComplianceBreach causes violations of legal or regulatory requirements (HIPAA, PCI DSS, GDPR). OperationalDay-to-day functions disrupted. Manual workarounds, delayed processes, reduced capacity. ReputationalLoss of customer trust, media coverage, damage to brand. Often the hardest to quantify and recover.
CH 02

Cybersecurity Threat Landscape

Domain 2 · Obj 2.1, 2.2
Threat Actors
Script Kiddies (Unskilled)Use pre-built tools without understanding how they work. Low sophistication, low resources. Unpredictable and numerous. Motivated by thrills or notoriety. HacktivistsUse hacking to promote political or social causes. Variable skill levels. Examples: Anonymous. Motivated by ideology, not money. Insider ThreatsCurrent or former employees, contractors, or vendors with authorized access. Dangerous because they already have access and knowledge. Motivations: revenge, financial gain, ideology. Must use least privilege and audit logs to detect. Organized CrimeProfessional criminal organizations. High sophistication, significant resources. Primary motivation: financial gain. Common tactics: ransomware, fraud, data theft for sale. Nation-State / APTGovernment-sponsored attackers. Highest sophistication and unlimited resources. Advanced Persistent Threats (APTs) use unknown/novel techniques over extended periods. Motivations: espionage, sabotage, disruption. Example: Stuxnet (Iran nuclear enrichment). Shadow ITUnsanctioned technology used within an organization without IT approval. Creates security blind spots. Not malicious by intent but creates risk through unmanaged systems.
APT characteristics: (1) Uses advanced techniques not just downloaded tools. (2) Persistent — attacks over a significant time period. Nation-state actors are the most capable and well-funded threat actors on the exam.
The Hacker Hats
White HatAuthorized security professionals. Hired or employed to find vulnerabilities. Penetration testers, security researchers. Legal, ethical, sanctioned. Black HatUnauthorized attackers with malicious intent. Goal is to exploit systems for personal gain. Criminal activity. Gray HatAct without authorization but claim good intent (informing the target of vulnerabilities). Good intent does not make it legal — still potentially criminal.
Threat Intelligence
Open-Source Intelligence (OSINT)Publicly available information. News, social media, public databases, government reports, academic publications. Free but requires effort to process. Closed/Proprietary IntelligenceCommercial threat feeds, internal security data, vendor reports. Not publicly available. More targeted and curated. Examples: vendor threat intelligence subscriptions. ISACsInformation Sharing and Analysis Centers. Sector-specific (healthcare, financial, energy) organizations that share threat intelligence between member organizations and government agencies. Zero-Day AttackExploits a previously unknown vulnerability with no available patch. No existing signature for detection tools. Extremely dangerous — no defense except behavioral detection. TTPsTactics, Techniques, and Procedures. The behavior patterns of threat actors. Understanding TTPs enables defenders to detect and respond to attacks even when specific indicators are unknown.
Attack Motivations
Data Exfiltration Financial Gain Espionage Service Disruption Blackmail Political / Philosophical Revenge Chaos / Disruption Cyberwarfare
CH 03

Malicious Code

Domain 2 · Obj 2.4
Malware Types
VirusSelf-replicating malware that attaches to legitimate files. Requires user action to spread (running infected file). Types: boot sector, macro, email, memory-resident, fileless. Fileless VirusOperates entirely in memory — no file written to disk. Exploits browser plugins, interpreters, or living-off-the-land techniques. Evades traditional signature-based antivirus. Extremely hard to detect. WormSelf-replicates AND self-spreads without user action. Propagates across networks via email attachments, network shares, or vulnerabilities. No host file needed. Trojan HorseDisguises itself as legitimate software. Relies on social engineering — user installs it willingly. Creates backdoors, steals data, or downloads additional malware. Does NOT self-replicate. RansomwareEncrypts victim's files and demands payment for the decryption key. Effective offline backup to a separate location is the primary defense. Crypto ransomware (encrypts files) vs locker ransomware (locks screen). SpywareSecretly monitors user activity and collects information without consent. May capture keystrokes, screenshots, browsing history. Often bundled with free software. AdwareDisplays unwanted advertisements. Often installed as part of free software bundles. May redirect browser, inject ads. Not always malicious but undesirable. PUP (Potentially Unwanted Program)Software installed without full user awareness, often bundled with legitimate software. Not clearly malicious but undesirable. Remove with anti-malware tools and user education. RootkitProvides persistent, covert backdoor access while hiding its presence from the OS and security tools. May operate at kernel level. Prevention: patching, secure configurations, Secure Boot, privilege management. BackdoorBypasses normal authentication to allow covert access. Can be hardware or software-based. Often included in Trojans and rootkits. May be intentionally left by developers or maliciously installed. Bot / BotnetBot = a compromised system under remote attacker control. Botnet = a network of bots. Used for DDoS attacks, spam relay, cryptocurrency mining, and additional attacks. Models: client-server (C2 server) and peer-to-peer. KeyloggerCaptures keystrokes to harvest credentials, personal information, and sensitive data. Transmitted back to attacker. Prevents defenses include MFA, screen keyboards, and anti-malware. Logic BombCode embedded in legitimate software that activates when specific conditions are met (date, user action, system state). Often planted by disgruntled insiders. Hard to detect before triggering.
Virus vs Worm: A virus needs a host file AND user action to spread. A worm spreads itself automatically with no user action. Trojan vs Virus: A Trojan does NOT self-replicate — it relies entirely on the user running it. Ransomware defense: offline backups are the most effective mitigation.
CH 04

Social Engineering & Password Attacks

Domain 2 · Obj 2.2, 2.4
Seven Principles of Social Engineering
Authority Intimidation Consensus / Social Proof Scarcity Familiarity / Liking Urgency Trust

Attackers exploit these psychological principles to manipulate users into taking actions that compromise security. The best defense is security awareness training.

Social Engineering Techniques
PhishingMass email attack. Generic lure targeting many people. "Verify your account" or "You've won a prize." Casts a wide net — success through volume. Spear PhishingTargeted phishing using personal details about the victim (name, employer, colleagues). Much higher success rate than generic phishing. WhalingSpear phishing targeting executives (CEO, CFO, CTO). High-value targets. Often requests wire transfers, credential disclosure, or confidential data. VishingVoice phishing. Phone call impersonating IT support, banks, government agencies. Uses urgency and authority to extract information. SmishingSMS phishing. Text messages containing malicious links or requests for information. PretextingCreating a fabricated scenario (pretext) to extract information. Attacker poses as IT support, auditor, or other trusted role. BaitingLeaving infected USB drives in parking lots or public areas. Curiosity leads victims to plug them in, infecting their systems. Tailgating / PiggybackingFollowing an authorized person through a secure door. Mitigate with access control vestibules (mantraps) and security awareness. Shoulder SurfingObserving someone enter credentials or sensitive information. Mitigate with privacy screens and awareness. Dumpster DivingSearching trash for sensitive information (documents, hardware). Mitigate with shredding and clean desk policy. Watering Hole AttackAttacker compromises a website frequently visited by the target group. Victims are infected when they visit the site they already trust.
Password Attacks
Dictionary AttackTries words from a dictionary file. Tools like John the Ripper. Common passwords and variations. Fast but limited to the dictionary's contents. Brute ForceTries every possible combination of characters. Guaranteed to succeed eventually but extremely slow for long passwords. Time increases exponentially with password length. Rainbow Table AttackPre-computed hash-to-password lookup table. Trades storage for speed — no need to compute hashes in real time. Defeated by salting (adding random data before hashing). Credential StuffingUses username/password pairs leaked from other breaches. Relies on password reuse. Automated tool tries thousands of credentials across many sites. Password SprayingTries a few common passwords against many accounts. Avoids account lockout by not hammering a single account. Common passwords: Summer2024!, Password1, Welcome1. SaltingAdding a random value to a password before hashing. Makes rainbow table attacks infeasible — same password produces different hash for each user. Stored alongside the hash. Key StretchingApplying a hash function many thousands of times to make brute force attacks slower. bcrypt, scrypt, PBKDF2 use key stretching. Increases attacker's computation time.
CH 05

Security Assessment & Testing

Domain 4 · Obj 4.1, 4.2, 4.3
Vulnerability Assessment Types
Passive AssessmentSniffs network traffic without sending packets. Discovers active systems and services without interaction. Minimal disruption risk. Active AssessmentSends packets and probes to systems. More thorough but risks disruption on production systems. Credentialed (Authenticated)Scanner logs into systems with valid credentials. Discovers internal vulnerabilities not visible from outside. More thorough than non-credentialed. Non-CredentialedScans without system credentials. Tests what an external attacker would see. Misses internal configuration issues. Internal AssessmentScans the internal network infrastructure. Identifies internal vulnerabilities and misconfigurations. External AssessmentScans from outside the network perimeter. Tests what is exposed to the internet. Agent-BasedSoftware agent installed on each system. Continuous monitoring. More detailed. Does not require network connectivity to scanner. Network-BasedScanner on the network probes systems. No agent required. Scans from a central point.
CVSS — Common Vulnerability Scoring System

CVSS provides a standardized way to measure and communicate the severity of security vulnerabilities. Used to prioritize remediation efforts.

CVSS Score Ratings

ScoreRatingPriority
0.0NoneInformational only
0.1 – 3.9LowAddress when time permits
4.0 – 6.9MediumAddress within 30 days typically
7.0 – 8.9HighAddress within 7 days typically
9.0 – 10.0CriticalImmediate remediation

Key CVSS Metrics

Attack Vector (AV)How attacker exploits: Physical (0.20) → Local (0.55) → Adjacent Network (0.62) → Network (0.85). Network = highest score (remotely exploitable). Attack Complexity (AC)High (0.44) = specialized conditions required. Low (0.77) = no special conditions. Low = easier to exploit. Privileges Required (PR)High (0.27) = admin required. Low (0.62) = basic user. None (0.85) = no auth required. None = most severe. User Interaction (UI)None (0.85) = no user action needed. Required (0.62) = victim must take action. Scope (S)Unchanged = only affects same system. Changed = can affect other systems/components. CIA ImpactConfidentiality, Integrity, Availability each scored: None (0.00), Low (0.22), High (0.56).
Scan result types: True Positive = correctly identified vulnerability. True Negative = correctly identified clean. False Positive = reports vulnerability that doesn't exist (waste of time). False Negative = misses a real vulnerability (dangerous). False negatives are the most dangerous scan outcome.
Penetration Testing
Black BoxTester has no prior knowledge of the target. Simulates external attacker. Most realistic but slowest and most expensive. White BoxFull knowledge provided (source code, architecture, credentials). Most thorough. Simulates insider or post-breach scenario. Gray BoxPartial knowledge. Simulates insider with limited access or attacker who has done some reconnaissance. Balance of realism and efficiency. Rules of EngagementFormal agreement defining scope, timing, authorized targets, authorized techniques, and escalation procedures. Must be documented before testing begins. ReconnaissanceInformation gathering phase. Passive (OSINT, public records) and active (scanning, probing). Comes before exploitation.
Pentest types: Physical, Network, Wireless, Application, Social Engineering, Cloud. A vulnerability scan identifies vulnerabilities. A penetration test actively exploits them to demonstrate real-world impact. Both are different from a security audit.
Vulnerability Management Life Cycle
Identify Assets and Create Baseline — Know what you have before you can protect it.
Vulnerability Scan — Run scans using tools like Nessus, Qualys, OpenVAS, or Nikto.
Risk Assessment — Prioritize findings using CVSS scores and business context.
Remediation — Patch, configure, or mitigate identified vulnerabilities.
Verification — Rescan to confirm vulnerabilities were successfully remediated.
Monitor — Continuously monitor for new vulnerabilities and changes.
Common Vulnerability Scanning Tools
NessusIndustry-leading vulnerability scanner. Comprehensive plugin library. Available as professional and essentials (free) editions. Tenable product. QualysCloud-based platform. Continuous monitoring. Asset inventory, vulnerability management, compliance scanning. OpenVASOpen-source vulnerability scanner. Community-maintained. Comprehensive scanning with no license cost. NiktoOpen-source web application scanner. CLI-based. Tests for SQL injection, XSS, CSRF, and other web vulnerabilities. MetasploitPenetration testing framework. Contains exploits, payloads, and auxiliary modules. Used after vulnerability discovery to demonstrate exploitability. Burp SuiteWeb application security testing platform. Proxy intercepts HTTP/HTTPS traffic. Used for manual web app testing and automated scanning.
SCAP & Vulnerability Databases
SCAPSecurity Content Automation Protocol. NIST framework that standardizes how security tools communicate vulnerability and configuration information. Enables automated compliance checking and vulnerability management across different vendor tools. CVECommon Vulnerabilities and Exposures. Publicly disclosed cybersecurity vulnerabilities, each assigned a unique identifier (CVE-YEAR-NNNNN). Maintained by MITRE. The universal reference for known vulnerabilities. Example: CVE-2021-44228 = Log4Shell. NVDNational Vulnerability Database. NIST's public repository of CVEs enriched with CVSS scores, impact ratings, and remediation guidance. Where security teams look up CVE details. CWECommon Weakness Enumeration. Categorizes software and hardware weaknesses (design and coding flaws) that lead to vulnerabilities. CVE describes a specific instance; CWE describes the class of vulnerability. Example: CWE-79 = Cross-Site Scripting. CCECommon Configuration Enumeration. Assigns identifiers to system configuration issues. Used with SCAP to standardize configuration checks across tools. OVALOpen Vulnerability and Assessment Language. XML schema used by SCAP to describe system state and check conditions. Machine-readable vulnerability definitions that tools can process automatically. XCCDFExtensible Configuration Checklist Description Format. SCAP component. Machine-readable security checklists (like DISA STIGs). Automates compliance verification against benchmarks.
CVE = specific known vulnerability instance (has a unique ID). CWE = category of weakness (e.g., "buffer overflow" is CWE-120). CVE has CVSS scores. SCAP ties CVE, CWE, CCE, OVAL, and XCCDF together into an automated compliance and vulnerability assessment framework. Expect scenario questions where you pick the right database/standard.
Application Testing Techniques
SAST (Static Analysis)Static Application Security Testing. Analyzes source code, bytecode, or binaries WITHOUT executing the program. "White-box" testing. Can catch vulnerabilities early in development (shift-left). Tools: SonarQube, Checkmarx, Veracode. Cannot detect runtime issues. DAST (Dynamic Analysis)Dynamic Application Security Testing. Tests the running application from the outside — no source code needed. "Black-box" testing. Simulates attacker perspective. Catches runtime vulnerabilities SAST misses. Tools: OWASP ZAP, Burp Suite. Cannot pinpoint exact code location of flaws. IAST (Interactive)Interactive Application Security Testing. Agents inside the running application monitor it from within during normal use or automated testing. Combines SAST and DAST advantages — sees both code and runtime behavior. More accurate, fewer false positives. SCA (Software Composition Analysis)Identifies open-source components and third-party libraries in an application. Checks each component against vulnerability databases. Flags known-vulnerable dependencies. Critical for supply chain security. Fuzzing (Fuzz Testing)Sends random, malformed, or unexpected input data to an application to find crashes, memory corruption, and unexpected behavior. Discovers edge cases and vulnerabilities that manual review misses. Types: dumb fuzzing (random), smart fuzzing (structured/protocol-aware), mutation-based, generation-based. Manual Code ReviewHuman expert reads source code looking for security flaws. Fagan inspection = formal structured review. Most thorough but most expensive and time-consuming. Catches logic flaws automated tools miss.
SAST = source code, no execution (white-box). DAST = running app, no source code (black-box). IAST = agent inside running app (both). Fuzzing = random/malformed input looking for crashes. The exam loves asking which type of testing requires source code access (SAST) vs which doesn't (DAST).
Threat Modeling
Threat ModelingStructured process of identifying, assessing, and prioritizing potential threats to a system during design — before development. Cheaper to fix design flaws early than after deployment. Used in DevSecOps and secure SDLC. STRIDEMicrosoft's threat modeling framework. Six threat categories: Spoofing (identity), Tampering (data), Repudiation (denying actions), Information Disclosure (data exposure), Denial of Service (availability), Elevation of Privilege (unauthorized access). Each maps to a CIA/AAA principle violation. PASTAProcess for Attack Simulation and Threat Analysis. Risk-centric, attacker-focused. Seven stages from business objectives to attack simulation. Produces actionable risk assessment. Attack SurfaceAll points where an attacker could try to interact with a system — ports, interfaces, APIs, user inputs, physical access points. Goal: minimize the attack surface. Removing unused services, ports, and accounts reduces attack surface. Attack VectorThe path or means by which an attacker exploits a vulnerability. Network, Adjacent, Local, Physical (CVSS AV metric). Different from attack surface — vector is the method, surface is the available targets.
CH 06

Application Security

Domain 2 · Obj 2.3, 2.5
Software Development Life Cycle (SDLC)
WaterfallLinear sequential phases. Each phase must complete before the next begins. Planning → Analysis → Design → Development → Testing → Deployment → Maintenance. Poor at handling changing requirements. AgileIterative, collaborative development. Short sprints (2–4 weeks). Continuous feedback and adaptation. Better for changing requirements. Security can be integrated at each sprint. SpiralCombines iterative development with risk management. Each cycle: plan → risk analysis → develop → evaluate. Good for large, high-risk projects. DevSecOpsIntegrates security directly into the DevOps pipeline. Security testing at every stage — not bolted on at the end. "Shift left" = address security issues earlier in development.

SDLC Environments

DevelopmentWhere code is written. Developers have significant access. Not production data. Test / QAWhere code is tested. Quality assurance activities. Validates functionality. StagingPre-production environment. Final validation before deployment. Mirrors production closely. ProductionLive system. Must follow change management. Direct access should be very limited.
Common Application Vulnerabilities
SQL Injection (SQLi)Attacker injects SQL commands into input fields that are processed by the database. Can read, modify, or delete data. Defense: parameterized queries / prepared statements. Content-based (returns data) and blind (infers data from behavior). Cross-Site Scripting (XSS)Attacker injects malicious scripts into web pages viewed by other users. Types: Reflected (script in URL, executed immediately), Stored/Persistent (script saved to server, executed when page loads), DOM-based. Defense: input validation, output encoding. Cross-Site Request Forgery (CSRF)Tricks authenticated user's browser into sending unauthorized requests to a web application. Defense: CSRF tokens, same-site cookie attribute, requiring re-authentication for sensitive actions. Directory TraversalAttacker accesses files outside the web root by using ../ sequences. Example: ../../etc/passwd. Defense: input validation, chrooted environments. Buffer OverflowWriting more data to a buffer than it can hold, overwriting adjacent memory. Can allow arbitrary code execution. Defense: bounds checking, ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention). Race ConditionExploit timing window between check and use of a resource. TOCTOU (Time-of-Check-Time-of-Use). Defense: atomic operations, proper locking mechanisms. Memory LeakApplication allocates memory and never releases it. Eventually exhausts available memory, causing crashes. Defense: proper memory management, code review. Hard-Coded CredentialsUsernames or passwords embedded directly in source code. Can be discovered through source code review or reverse engineering. Defense: use configuration files, secrets managers, environment variables.
Stored XSS is more dangerous than reflected XSS because it persists on the server and affects every user who visits the page. Reflected XSS requires a victim to click a specific malicious link. Both steal session cookies or execute code in the victim's browser.
Secure Coding Practices
  • Parameterized Queries — Separate code from data. Primary defense against SQL injection.
  • Input Validation — Validate all user input on the server side (not just client side). Whitelist acceptable values.
  • Output Encoding — Encode output before rendering in browser. Primary defense against XSS.
  • Error Handling — Never reveal stack traces, database errors, or internal paths to users. Log internally, show generic messages.
  • Code Signing — Digitally sign code so users can verify it hasn't been tampered with.
  • Code Review — Manual (Fagan inspection) or automated (SAST tools) review of source code for vulnerabilities before deployment.
  • OWASP Top 10 — OWASP (Open Web Application Security Project) publishes the most critical web application security risks. The Top 10 is the exam's reference for web vulnerability priorities.
OWASP Web Application Top 10
The OWASP Top 10 is the most widely referenced list of critical web application security risks. Updated periodically — testable version is 2021. The exam expects you to recognize which category a described vulnerability falls into.
A01 — Broken Access Control#1 risk. Users can act outside their intended permissions. Examples: accessing another user's account by changing the URL ID, viewing admin pages as a regular user, insecure direct object references (IDOR). Prevention: deny by default, enforce access controls server-side. A02 — Cryptographic FailuresPreviously called "Sensitive Data Exposure." Weak or missing encryption for data at rest or in transit. Examples: transmitting passwords over HTTP, storing passwords in plaintext, using MD5 for password hashing, using DES or RC4. Prevention: TLS everywhere, strong hashing (bcrypt, SHA-256), encrypt sensitive data at rest. A03 — InjectionAttacker sends untrusted data that is interpreted as code or commands. Includes SQL injection, command injection, LDAP injection, and XXE. Prevention: parameterized queries, input validation, allowlisting. A04 — Insecure DesignFlaws in architecture and design — not just implementation bugs. Cannot be fixed by patching — requires redesign. Prevention: threat modeling during design, secure design patterns, reference architectures. A05 — Security MisconfigurationMost commonly seen issue in practice. Default credentials, unnecessary features enabled, verbose error messages revealing stack traces, open cloud storage buckets, missing security headers. Prevention: hardening guides, automated configuration scanning, disable default accounts. A06 — Vulnerable & Outdated ComponentsUsing libraries, frameworks, or software with known vulnerabilities. SCA (Software Composition Analysis) tools detect this. Examples: running Log4j with Log4Shell vulnerability, outdated jQuery with known XSS. Prevention: inventory all components, subscribe to vulnerability alerts, patch promptly. A07 — Identification & Authentication FailuresPreviously "Broken Authentication." Weak passwords allowed, missing MFA, session IDs exposed in URLs, sessions not invalidated on logout, credential stuffing not prevented. Prevention: MFA, strong password policies, secure session management. A08 — Software & Data Integrity FailuresAssuming that software updates and data are trustworthy without verification. Includes insecure deserialization and CI/CD pipeline attacks (e.g., SolarWinds supply chain attack). Prevention: digital signatures on updates, verify checksums, secure CI/CD pipeline. A09 — Security Logging & Monitoring FailuresInsufficient logging means attacks go undetected. Without logs: you can't detect breaches, investigate incidents, or meet compliance requirements. Prevention: log all authentication events, failures, and high-value transactions. Centralize in SIEM. Set alerting thresholds. A10 — Server-Side Request Forgery (SSRF)Application fetches a remote resource based on user-supplied URL. Attacker can make the server send requests to internal systems (bypassing firewalls), cloud metadata endpoints (stealing credentials), or internal services not exposed externally. Prevention: allowlist approved URLs/IPs, disable HTTP redirects, validate all user-supplied URLs.
The four most exam-relevant OWASP Web Top 10 entries: A01 Broken Access Control (#1 and rising), A03 Injection (the classic), A05 Security Misconfiguration (most common in the real world), A07 Identification & Authentication Failures (MFA and session management). SSRF (A10) is newer and increasingly tested — know what it is.
Application Security Controls
WAF (Web Application Firewall)Inspects HTTP/HTTPS traffic to web applications. Filters out SQLi, XSS, and other web attacks. Works at Layer 7. Can be hardware, software, or cloud-based. TokenizationReplaces sensitive data with a non-sensitive placeholder (token). The real data is stored securely elsewhere. Common for payment cards (PCI DSS). Data MaskingObscures sensitive data by substituting characters. Used in non-production environments so developers work with realistic data without exposure. Example: 4532-****-****-1234. NormalizationDatabase design process that reduces redundancy and prevents anomalies. Structured correctly, prevents some injection paths.
Injection Attack Types
SQL InjectionMost common injection type. Attacker inserts SQL commands into user input fields that get executed by the database. Prevent with parameterized queries/prepared statements and stored procedures. Command InjectionAttacker injects OS-level commands through application inputs. Application passes user input directly to a shell. Example: entering ; rm -rf / in a ping field. Prevent with input validation and avoiding shell calls with user input. LDAP InjectionInjects LDAP filter characters to manipulate directory queries. Can allow authentication bypass or unauthorized directory data access. Prevent with input sanitization of LDAP special characters. XML Injection / XXEXML External Entity injection. Attacker sends malicious XML referencing external entities. Can read local files, perform SSRF, or cause DoS. Prevent by disabling external entity processing in XML parsers. HTML / Template InjectionInjects HTML or template syntax that gets rendered by the server or browser. Can lead to XSS or Server-Side Template Injection (SSTI) — which can execute arbitrary code on the server.
API Security
API (Application Programming Interface)Interface allowing applications to communicate with each other. REST, SOAP, and GraphQL are common types. APIs are a major and growing attack surface — they often bypass traditional web application controls. API KeysTokens used to authenticate API calls. Must be protected like passwords — never hard-coded in source code, never exposed in URLs. Rotate regularly. Store in secrets managers. Rate LimitingRestricts how many API requests a client can make in a given time period. Prevents brute force, DoS, and data scraping via API. Returns HTTP 429 (Too Many Requests) when exceeded. Broken Object Level AuthorizationOWASP API #1 risk. API returns data for objects the requesting user doesn't have permission to access. Validate that the requesting user is authorized for each specific object, not just the endpoint. Security HeadersHTTP response headers that improve security. Key headers: Content-Security-Policy (CSP, prevents XSS), X-Frame-Options (prevents clickjacking), HSTS (forces HTTPS), X-Content-Type-Options (prevents MIME sniffing).
APIs are tested heavily in SY0-701. The OWASP API Security Top 10 is separate from the OWASP Web Top 10. Broken Object Level Authorization (BOLA) = insecure direct object reference in API context. Treat every API endpoint as a potential attack surface requiring its own authorization check.
OWASP API Security Top 10
Separate from the Web Top 10 — specifically for API vulnerabilities. APIs have unique risks not covered by traditional web app testing. SY0-701 explicitly tests API security, and this list maps directly to exam scenarios.
API1 — Broken Object Level AuthorizationMost critical API risk. API returns data for objects the requesting user shouldn't have access to. Attacker changes an object ID in the request (e.g., /api/users/123 → /api/users/124) and retrieves another user's data. Server doesn't verify the requesting user owns that object. Prevention: validate authorization for every object access, not just the endpoint. API2 — Broken AuthenticationWeak or missing authentication on API endpoints. Missing tokens, weak API keys, no rate limiting on auth endpoints enabling brute force. Prevention: strong API keys or OAuth tokens, MFA where applicable, rate limit authentication endpoints. API3 — Broken Object Property Level AuthorizationAPI returns more data than the user needs (over-exposure) or allows updating fields the user shouldn't control (mass assignment). Example: user updates their profile but the API allows setting isAdmin=true. Prevention: explicitly define what fields each user role can read and write. API4 — Unrestricted Resource ConsumptionNo rate limiting, quotas, or size limits on API requests. Enables DoS via resource exhaustion and financial damage on consumption-based services. Prevention: rate limiting, request size limits, query complexity limits (for GraphQL). API5 — Broken Function Level AuthorizationUsers can access admin functions by guessing or predicting API endpoint names (e.g., /api/admin/deleteUser). Relies on obscurity rather than authorization. Prevention: deny all admin functions by default, enforce role checks on every endpoint. API6 — Unrestricted Access to Sensitive Business FlowsAutomation exploits legitimate API flows at machine speed — bulk ticket purchasing bots, credential stuffing, fraudulent account creation. No technical vulnerability — the flow itself is abused. Prevention: CAPTCHA, device fingerprinting, rate limiting on sensitive flows. API7 — Server-Side Request Forgery (SSRF)API fetches a resource from a URL provided by the client. Attacker points it at internal services or cloud metadata endpoints. Same as Web Top 10 A10 but particularly dangerous in APIs that integrate with other services. API8 — Security MisconfigurationDefault credentials, unnecessary HTTP methods enabled (e.g., DELETE when only GET is needed), verbose error messages, missing CORS policy, outdated TLS. Prevention: security hardening, disable unused HTTP methods, suppress detailed errors. API9 — Improper Inventory ManagementShadow APIs — undocumented, forgotten, or deprecated endpoints still running in production. Old API versions with weaker security remain accessible. Prevention: maintain a complete API inventory, version APIs, decommission old endpoints. API10 — Unsafe Consumption of APIsTrusting data from third-party APIs without validation. If a third-party API you call is compromised, malicious data enters your system. Prevention: validate and sanitize all data received from external APIs, treat third-party API data as untrusted input.
API1 (Broken Object Level Authorization) is #1 for a reason — it's extremely common and easy to exploit. The classic example: change a user ID in an API call and get someone else's data. For the exam, if a scenario describes accessing another user's data by modifying a request parameter — that's BOLA/IDOR. SSRF appears on both lists (Web A10 and API7) — high priority to know.
CH 07

Cryptography & PKI

Domain 1 · Obj 1.4
Symmetric vs Asymmetric Encryption
FeatureSymmetricAsymmetric
KeysSingle shared keyPublic/private key pair
Key ExchangeOut-of-band (must share key securely)In-band (public key is shared openly)
SpeedFastSlow
ScalabilityNot scalableScalable
Use CasesBulk data encryption, disk encryptionKey exchange, digital signatures, certificates, small blocks
ProvidesConfidentiality, IntegrityConfidentiality, Integrity, Authentication, Nonrepudiation
ExamplesAES, 3DES, DESRSA, ECC, Diffie-Hellman
In practice, TLS uses BOTH: asymmetric crypto to securely exchange a symmetric session key, then symmetric crypto for the bulk data. This hybrid approach gets the security of asymmetric with the speed of symmetric.
Encryption Algorithms
AESAdvanced Encryption Standard. Symmetric block cipher. Key sizes: 128, 192, or 256 bits. Current gold standard for symmetric encryption. Used in WPA2, TLS, disk encryption. 3DES (Triple DES)Applies DES three times. Legacy algorithm. Slower than AES. Being phased out. Still seen in older systems. RSAAsymmetric. Based on difficulty of factoring large prime numbers. Key sizes: 2048 or 4096 bits for modern security. Used for key exchange and digital signatures. ECC (Elliptic Curve)Asymmetric. Based on elliptic curve mathematics. Much smaller key sizes for equivalent security. 256-bit ECC ≈ 3072-bit RSA. More efficient. Used in mobile devices and modern TLS. Diffie-HellmanKey exchange protocol — allows two parties to establish a shared secret over an insecure channel without prior shared secret. Used when no other key distribution method is available. DH Ephemeral (DHE/ECDHE)Generates a new key pair for each session. Provides Perfect Forward Secrecy (PFS) — compromise of long-term key doesn't expose past sessions.
Hashing
Hash FunctionOne-way mathematical function. Produces fixed-length output (digest) from any input. Same input = same output always. Cannot be reversed. Used for integrity verification. MD5Produces 128-bit hash. Known vulnerable to collisions — two different inputs can produce the same hash. DO NOT use for security purposes. Legacy only. SHA-1160-bit hash. Deprecated — collision attacks demonstrated. No longer acceptable for security use. SHA-256256-bit hash. Part of SHA-2 family. Current standard for most security applications. SHA-3Latest NIST standard. Completely different design from SHA-2 (Keccak algorithm). Available as backup if SHA-2 vulnerabilities discovered. HMACHash-based Message Authentication Code. Combines hash function with a shared secret key. Provides integrity AND authentication but NOT nonrepudiation (requires shared key). CollisionWhen two different inputs produce the same hash output. Makes the hash function unusable for integrity verification. MD5 and SHA-1 are vulnerable to collisions.
Hashing ≠ Encryption. Hashing is one-way — you cannot reverse it. Encryption is two-way — you can decrypt with the key. Hashing verifies INTEGRITY. Encryption provides CONFIDENTIALITY. Never confuse the two on the exam.
Digital Signatures

Digital signatures provide authentication, integrity, and nonrepudiation. Process:

Sender hashes the message with a hashing algorithm (SHA-256).
Sender encrypts the hash with their private key — this is the digital signature.
Sender sends message + signature to recipient.
Recipient decrypts the signature using sender's public key to get the hash.
Recipient independently hashes the received message.
If both hashes match: message is authentic and unaltered. Sender cannot deny sending it (nonrepudiation).
Public Key Infrastructure (PKI)
CA (Certificate Authority)Trusted third party that issues and signs digital certificates. Root CA → Intermediate CA → End-entity certificates (trust chain). Examples: DigiCert, Let's Encrypt, VeriSign. X.509Standard defining the format of digital certificates. Contains: version, serial number, issuer, validity period, subject, subject's public key, and CA digital signature. Certificate TypesDV (Domain Validation), OV (Organization Validation), EV (Extended Validation). Wildcard cert (*. domain.com) covers all subdomains. SAN cert covers multiple specific domains. CSRCertificate Signing Request. Created by the entity requesting a certificate. Contains their public key and identity info. Sent to CA for signing. CRL (Certificate Revocation List)Published list of revoked certificate serial numbers. Client downloads the list and checks against it. Can be outdated between publications. OCSPOnline Certificate Status Protocol. Real-time validation of a certificate's status. Client queries OCSP responder → gets signed "good" or "revoked" response. Faster and more current than CRL. Certificate StaplingServer pre-fetches and caches the OCSP response, then "staples" it to the TLS handshake. Client doesn't need to query OCSP separately. Reduces latency and improves privacy. TPMTrusted Platform Module. Hardware chip securely storing encryption keys, certificates, and cryptographic measurements. Used by BitLocker, Secure Boot, Windows 11 requirement. HSMHardware Security Module. Dedicated removable device for cryptographic key storage and operations. Tamper-resistant. Enterprise-grade. More capable and portable than TPM. Key EscrowCopies of encryption keys held by a third party (escrow agent). Allows recovery if key is lost. Government requirement in some contexts. "Fair cryptosystem" approach.
Obfuscation Techniques
SteganographyHides data within seemingly harmless carrier files (images, audio, video). The existence of the hidden data itself is concealed. Different from encryption — doesn't make data unreadable, makes it invisible. TokenizationReplaces sensitive data with a non-sensitive token. Mapping stored in secure vault. Used in PCI DSS for card numbers. Data MaskingReplaces real data with realistic but fictional data. Used in test/development environments. Preserves format and structure.
Cipher Modes of Operation
ECB (Electronic Codebook)Simplest mode. Each block encrypted independently with the same key. Identical plaintext blocks produce identical ciphertext blocks — patterns are preserved. Insecure — never use for sensitive data. The famous "ECB penguin" demonstrates this flaw visually. CBC (Cipher Block Chaining)Each plaintext block XORed with previous ciphertext block before encryption. Requires an Initialization Vector (IV) for the first block. Identical plaintexts produce different ciphertexts. Secure but sequential — cannot be parallelized for encryption. CTR (Counter)Converts block cipher into a stream cipher using a counter. Fully parallelizable — fast. No padding needed. IV + counter encrypted, then XORed with plaintext. Widely used in modern systems. GCM (Galois/Counter Mode)CTR mode + built-in authentication tag (GHASH). Provides both encryption AND integrity/authenticity simultaneously. AEAD (Authenticated Encryption with Associated Data). Current gold standard — used in TLS 1.3 and AES-GCM. Stream CipherEncrypts data one bit or byte at a time using a keystream. Fast, good for real-time communications. Examples: RC4 (deprecated — weak), ChaCha20 (modern, used in TLS as alternative to AES). No padding needed.
ECB is always the wrong answer for secure encryption — it leaks patterns. GCM is preferred for authenticated encryption because it provides confidentiality AND integrity in one operation. TLS 1.3 exclusively uses AEAD ciphers (AES-GCM and ChaCha20-Poly1305) — no CBC, no RC4.
Advanced Cryptographic Concepts
Perfect Forward Secrecy (PFS)Each session uses a unique ephemeral key. Compromise of the long-term private key does NOT expose past sessions. Achieved with DHE or ECDHE key exchange. Enabled by default in TLS 1.3. Critical for long-term confidentiality. Post-Quantum CryptographyAlgorithms designed to resist attacks from quantum computers. Quantum computers break RSA and ECC using Shor's algorithm. NIST selected post-quantum standards in 2024: CRYSTALS-Kyber (key encapsulation), CRYSTALS-Dilithium (digital signatures). Organizations should begin planning migration now. Quantum Key Distribution (QKD)Uses quantum mechanics to distribute cryptographic keys. Any eavesdropping attempt physically disturbs the quantum state and is detectable. Theoretically unbreakable key exchange. Currently limited by distance and infrastructure requirements. Homomorphic EncryptionAllows computation on encrypted data without decrypting it first. Results when decrypted equal the result of operations on the plaintext. Enables privacy-preserving cloud computing and secure data analysis. BlockchainDistributed, immutable ledger. Each block contains data, its own hash, and the previous block's hash — forming a chain. Tampering with any block invalidates all subsequent blocks. Uses consensus mechanisms for validation. Provides integrity and nonrepudiation without central authority. Cryptographic AgilitySystem's ability to switch between cryptographic algorithms without major redesign. Important as algorithms age and become vulnerable. Build systems to be algorithm-agnostic so you can update without replacing the entire security infrastructure.
Cryptographic Attacks
Birthday AttackExploits the birthday paradox — the probability of two inputs producing the same hash (collision) is much higher than expected. Target: weak hash functions (MD5, SHA-1). Defense: use larger hash outputs (SHA-256+). Downgrade AttackForces a connection to use an older, weaker protocol or cipher suite. Examples: POODLE (SSLv3), BEAST (TLS 1.0). Defense: disable legacy protocols (SSLv2/v3, TLS 1.0/1.1), enforce minimum TLS 1.2. Pass the HashAttacker captures a password hash and uses it directly to authenticate without knowing the plaintext password. Exploits NTLM authentication. Defense: credential guard, network segmentation, privileged access workstations. Replay AttackAttacker captures valid authentication data and retransmits it later. Defense: session tokens with expiration, timestamps, nonces (number used once).
CH 08

Identity & Access Management

Domain 4 · Obj 4.6
Authentication Protocols
PAPPassword Authentication Protocol. Username and password sent in plaintext over PPP. Completely insecure. Never use. CHAPChallenge-Handshake Authentication Protocol. Three-way handshake. Server sends challenge → client hashes it with password → server verifies. Sends hash, not password. Re-authenticates periodically during session. EAPExtensible Authentication Protocol. Framework supporting multiple authentication methods. Used with 802.1X for network access control. Many variants: EAP-TLS, PEAP, EAP-TTLS. RADIUSRemote Authentication Dial-In User Service. Centralizes authentication. Port 1812/1813. UDP. Encrypts password only. Used for Wi-Fi, VPN, and network access. AAA protocol. TACACS+Terminal Access Controller Access-Control System Plus. Port 49. TCP. Encrypts entire session. Cisco-preferred for device administration. Separates authentication, authorization, and accounting. KerberosTicket-based authentication for Active Directory. Port 88. KDC (Key Distribution Center) issues tickets. TGT (Ticket Granting Ticket) → Service Ticket. Mutual authentication — client and server both verify each other. Vulnerable to Pass-the-Ticket and Golden Ticket attacks. LDAP / LDAPSLightweight Directory Access Protocol. Port 389 (plain) / 636 (TLS). Queries directory services (Active Directory). LDAPS adds TLS encryption. SAMLSecurity Assertion Markup Language. XML-based. Enables Single Sign-On between identity providers (IdP) and service providers (SP). Common in enterprise web SSO. OAuth 2.0Authorization framework (not authentication). Allows apps to access resources on behalf of a user without sharing credentials. "Sign in with Google" uses OAuth. OpenID ConnectAuthentication layer built on top of OAuth 2.0. Adds identity verification to OAuth's authorization. Provides ID tokens. Used alongside OAuth.
Multifactor Authentication (MFA)
Something You KnowPassword, PIN, passphrase, security questions. Easiest factor to compromise (phishing, brute force). Something You HaveSmart card, hardware token (RSA SecurID), TOTP app (Google Authenticator), USB security key (YubiKey), phone (SMS code). Something You AreBiometrics: fingerprint, retinal scan, facial recognition, voice recognition, hand geometry. Hardest to replicate. Somewhere You AreGeolocation. Adaptive authentication considers login location. Impossible travel detection. TOTPTime-Based One-Time Password. Generated from shared secret + current time. Valid for 30 seconds typically. Google Authenticator, Authy. More secure than SMS. HOTPHMAC-Based One-Time Password. Counter-based. Valid until used. Less time-sensitive than TOTP.
Password + PIN = NOT MFA (both "something you know"). Smartcard + fingerprint = TRUE MFA ("have" + "are"). Password + security question = NOT MFA (both "know"). True MFA requires factors from two DIFFERENT categories.
Biometrics
FAR (False Acceptance Rate)Rate at which imposters are incorrectly accepted. High FAR = system is too lenient. Security risk. FRR (False Rejection Rate)Rate at which legitimate users are rejected. High FRR = system is too strict. Usability problem. Crossover Error Rate (CER/EER)Point where FAR = FRR. The lower the CER, the more accurate the biometric system. Best single metric for comparing biometric systems.
Access Control Models
DAC (Discretionary)Resource owner decides who gets access. Standard NTFS permissions. Flexible but dependent on owner decisions. Most common in business environments. MAC (Mandatory)System enforces access based on classification labels. Users cannot override. Confidential/Secret/Top Secret. Used in government and military. SELinux implements MAC. RBAC (Role-Based)Permissions assigned to roles, roles assigned to users. Access based on job function. Easier to manage than per-user permissions. Most common enterprise model. ABAC (Attribute-Based)Access based on attributes of user, resource, and environment. Most flexible and granular. Time of day, location, device type can all be attributes. Rule-BasedStatic rules define access. Firewall ACLs are a common example. Not the same as RBAC despite similar name.
Federation & SSO
SSOSingle Sign-On. One authentication grants access to multiple systems. Reduces password fatigue. Kerberos implements SSO in Active Directory environments. FederationExtends SSO across organizational boundaries. Different organizations with separate identity systems trust each other's authentication. Enables "login with Google/Microsoft/GitHub." Identity Provider (IdP)System that creates, maintains, and manages identity information and authenticates users. Examples: Microsoft Azure AD, Okta, Google Workspace. Service Provider (SP)Application or service that relies on the IdP for authentication. Does not manage user credentials itself.
Privileged Access Management
Password VaultingCentralized, encrypted storage for privileged account credentials. Vault manages access, rotates passwords automatically, and logs all credential use. Examples: CyberArk, HashiCorp Vault, Thycotic. Eliminates shared admin passwords known by multiple people. Just-in-Time (JIT) AccessPrivileged access granted only for the duration of a specific task, then automatically revoked. Minimizes the window of exposure for highly privileged accounts. No standing admin access — privilege granted when needed, removed when done. PAW (Privileged Access Workstation)Dedicated, hardened workstation used exclusively for admin tasks. Never used for browsing, email, or general work. Isolated from regular user network. Prevents credential theft via malware on general-use systems. Ephemeral CredentialsShort-lived, single-use credentials. Automatically expire after a time limit or single use. Used with cloud services and JIT access. Minimizes damage if compromised. Separation of DutiesNo single person controls an entire critical process. Requires multiple people to complete sensitive tasks. Reduces fraud, insider threats, and accidental errors. Example: one person requests access, another approves it. Dual ControlTwo authorized people must both be present and agree to perform a critical action. Common in nuclear launch, banking wire transfers, and master key management.
Password vaulting, JIT access, and PAWs are all covered in SY0-701 under privileged access management. The key concept: standing admin access (always-on admin credentials) is a significant risk. JIT + vaulting + PAW together form defense-in-depth for privileged accounts.
CH 09

Resilience & Physical Security

Domain 3 · Obj 3.1, 3.4
Redundancy & High Availability
Geographic DispersionDistributing systems and data across multiple physical locations. Protects against site-level disasters and regional outages. Multi-path NetworksRedundant network paths between systems. No single point of failure in network connectivity. ReplicationContinuously duplicating data to a separate location. Synchronous (no data loss, higher latency) vs Asynchronous (slight data loss risk, lower latency impact). ClusteringMultiple servers working as one logical unit. Active-Active: all handle load simultaneously. Active-Passive: standby takes over on failure. Load BalancingDistributes traffic across multiple servers. Prevents overload. Also improves availability — if one server fails, others absorb load. Platform DiversityUsing different vendors, OS, or hardware for redundant systems. Prevents a single vulnerability from taking down all backup systems simultaneously.
Backup Types
TypeBacks UpArchive BitBackup SpeedRestore Speed
FullEverythingClearedSlowestFastest (1 set)
IncrementalChanged since last backup (full or incremental)ClearedFastestSlowest (needs all incrementals)
DifferentialChanged since last FULL onlyNOT clearedMedium (grows over time)Medium (full + latest diff)
SnapshotPoint-in-time stateN/AInstantFast
Disaster Recovery Sites
Site TypeEquipmentData CurrencyRecovery TimeCost
Hot SiteFully operational mirrorReal-time/near-real-timeMinutes to hoursHighest
Warm SiteInfrastructure ready, not activeRestore from recent backupHours to daysMedium
Cold SitePhysical space onlyFull restore from backupWeeksLowest

Site Restoration Order

  • Restore the most critical systems first. Establish communications → core infrastructure (DNS, AD) → business-critical applications → secondary systems.
  • Document the restoration order in the Disaster Recovery Plan (DRP) before an incident — not during.
Resilience Testing Methods
Tabletop ExerciseDiscussion-based scenario walkthrough. Key personnel talk through response to a simulated event. No systems touched. Cheapest and easiest. Good starting point. SimulationComputer-modeled scenarios or partial system simulations. No live systems at risk. Parallel ProcessingHot site or alternate system validated while production continues. Tests backup system without taking down primary. Failover ExerciseActual planned failover to the backup system. Most realistic test. Production traffic moved to DR site. Higher risk but most comprehensive.
Business Impact Analysis (BIA)
BIABusiness Impact Analysis. Identifies and quantifies the impact of disruptions to business functions. Determines which systems and processes are most critical. Foundation of all DR and BCP planning — must be done first. Mission-Essential FunctionsThe functions an organization must continue during a disruption to remain viable. Examples: payment processing, emergency services dispatch, patient care. Everything in the BCP is built around protecting these. RTO (Recovery Time Objective)Maximum acceptable downtime after a disruption. "How long can we be offline?" Low RTO = need hot site or automated failover. Drives DR site selection and architecture decisions. RPO (Recovery Point Objective)Maximum acceptable data loss measured in time. "How much data can we lose?" Low RPO = need frequent backups or synchronous replication. An RPO of 1 hour means you must back up at least every hour. MTBF (Mean Time Between Failures)Average time a component or system operates before failing. Higher MTBF = more reliable hardware. Used to predict failure rates and plan maintenance cycles. A component with MTBF of 50,000 hours is more reliable than one with 10,000 hours. MTTR (Mean Time to Repair)Average time to restore a failed component or system. Lower MTTR = faster recovery. Drives decisions about spare parts, staff training, and vendor support contracts. MTTF (Mean Time to Failure)Expected operational lifetime of a non-repairable component (like an HDD). After failure, the component is replaced, not repaired. Used in storage and hardware lifecycle planning.
BIA comes FIRST in DR planning — before choosing a DR site or writing the plan. BIA identifies what matters most and how long you can be without it (RTO/RPO). MTBF is about reliability (how long before it breaks). MTTR is about recovery (how long to fix it). Lower MTTR + higher MTBF = highest availability.
Business Continuity Planning (BCP)
BCP vs DRPBCP = Business Continuity Plan. Covers how the business continues operating during and after a disruption (people, processes, facilities). DRP = Disaster Recovery Plan. Technical subset of BCP focused on restoring IT systems and data. COOPContinuity of Operations Plan. Government/military term equivalent to BCP. Ensures essential functions continue during emergencies. Identifies alternate facilities, personnel, and communication channels. Succession PlanningIdentifies and prepares backup personnel for key roles. If a critical staff member is unavailable during a disaster, someone else knows how to perform their functions. Documented, not just assumed. Alternate SitesPre-designated alternate locations where operations can continue if primary facility is unavailable. May be owned by the organization or contracted with a DR services provider.
Physical Security Controls
Access Control Vestibule (Mantrap)Two-door airlock. First door must close before second opens. Prevents tailgating. Required at high-security facility entrances. BollardsShort sturdy posts that prevent vehicle ramming. Steel or concrete. Protect building perimeter. FencingPerimeter control. Height, visibility, and material determine deterrence level. Topped with barbed wire or concertina wire for higher security. Security GuardsHuman element. Can respond, adapt, and make decisions. Expensive. Complement with technology controls. Cameras / CCTVDeterrent and detective control. PTZ (Pan-Tilt-Zoom) for coverage flexibility. Motion-triggered recording for storage efficiency. LightingReduces concealment. Deters physical intrusion attempts. Enables effective camera monitoring. SensorsInfrared (body heat/motion), Pressure (weight), Microwave (movement), Ultrasonic (sound waves reflected off objects). Access BadgesRFID or smart card based. Tied to identity. Can be immediately revoked. Logs entries and exits for audit.
CH 10

Cloud & Virtualization Security

Domain 3 · Obj 3.5, 3.6
Cloud Service Models
ModelYou ManageProvider ManagesExamples
IaaSOS, apps, data, runtimeHardware, network, virtualizationAWS EC2, Azure VMs
PaaSApps and data onlyOS, hardware, runtimeAWS Elastic Beanstalk, Google App Engine
SaaSNothing — just use itEverythingOffice 365, Salesforce
FaaSFunction code onlyRuntime, infrastructure, scalingAWS Lambda, Azure Functions
Shared Responsibility Model
CSP Responsible ForSecurity of the cloud. Physical security of data centers, hardware maintenance, hypervisor security, availability of services. Infrastructure layer. Customer Responsible ForSecurity in the cloud. Data security, identity management, OS patching (in IaaS), application security, encryption configuration, access controls.
The shared responsibility line shifts based on service model. In SaaS, the customer is responsible for almost nothing. In IaaS, the customer manages the OS and above. Misconfigured S3 buckets and security groups are customer failures — not CSP failures.
Virtualization Security
Type 1 HypervisorBare-metal. Runs directly on hardware. More secure and performant. Examples: VMware ESXi, Hyper-V Server, Proxmox. Type 2 HypervisorHosted. Runs on top of a host OS. Less secure (more attack surface). Examples: VirtualBox, VMware Workstation. VM EscapeCritical security concern. Attacker breaks out of a VM and accesses the hypervisor or other VMs. Rare but catastrophic if successful. Requires prompt hypervisor patching. VM SprawlUncontrolled proliferation of VMs. Forgotten VMs miss patches, consume resources, create unmanaged attack surfaces. Control with lifecycle management policies. Container SecurityContainers share the host OS kernel — less isolation than VMs. If container runtime is compromised, all containers on that host are at risk. Use container-specific security tools (Falco, Trivy). VPC (Virtual Private Cloud)Cloud equivalent of a VLAN. Logically isolated section of the cloud. Public subnets (internet-accessible) and private subnets (internal only). Provides network segmentation in the cloud. Security GroupsCloud-native virtual firewall. Controls traffic to/from cloud resources. Stateful — return traffic automatically allowed. Applied at the instance level. CASBCloud Access Security Broker. Intermediary between users and cloud services. Enforces security policies, provides visibility into shadow IT cloud usage, DLP, threat protection.
Cloud Security Issues
  • Misconfiguration — #1 cause of cloud breaches. Publicly exposed storage buckets, overly permissive security groups, unencrypted data. Always configure least privilege.
  • Data Sovereignty — Data stored in foreign countries may be subject to foreign laws. Know where your cloud provider stores data.
  • Insecure APIs — Cloud services managed through APIs. Unprotected APIs = direct attack surface. Require authentication and monitor API usage.
  • Insufficient Identity Management — Weak or overly broad IAM permissions. Apply principle of least privilege rigorously in cloud IAM.
  • Cloud Scaling — Vertical = add resources to existing server. Horizontal = add more servers. Elasticity = automatically scale based on demand (short-term). Scalability = capacity for long-term growth.
Modern Cloud Architecture Security
MicroservicesApplication broken into small, independently deployable services that communicate via APIs. Security implication: large number of inter-service API calls create a significant internal attack surface. Each service must authenticate with others. Lateral movement risk if one service is compromised. ServerlessCode runs in stateless functions (FaaS) managed entirely by the CSP. No server OS to patch. Security shifts to: function code vulnerabilities, event injection attacks (malicious input triggers function), over-permissive IAM roles assigned to functions, and dependency vulnerabilities in function packages. Infrastructure as Code (IaC)Provisioning infrastructure via code/configuration files (Terraform, Ansible, CloudFormation). Security benefits: versioned, auditable, repeatable. Security risks: hardcoded credentials in IaC files, misconfigured templates replicated at scale, secrets in version control. Use secrets managers, not IaC files, for credentials. CI/CD Pipeline SecurityContinuous Integration/Continuous Delivery pipeline automates build, test, and deployment. Security concerns: supply chain attacks injecting malicious code into the pipeline, insecure build artifacts, insufficient testing gates. Integrate SAST/DAST into the pipeline. Sign all artifacts. Software-Defined Networking (SDN)Decouples network control plane from data plane. Centralized controller manages all traffic decisions. Security benefit: programmable, consistent policy enforcement. Security risk: controller is a single point of failure and high-value target. SASE (Secure Access Service Edge)Converges SD-WAN with cloud-delivered security services (CASB, SWG, ZTNA, FWaaS). Secures access for remote users and branch offices from a cloud-native platform. Identity-driven rather than perimeter-driven security model.
CH 11

Endpoint Security

Domain 4 · Obj 4.1
Endpoint Hardening
  • Close Unused Ports — Every open port is an attack surface. Verify with netstat and firewall rules.
  • Disable Unused Services — Services.msc (Windows) / systemctl (Linux). Every running service is a potential entry point.
  • Patch Management — Apply OS and application patches promptly. WSUS (Windows Server Update Services) for centralized Windows patching.
  • Remove Default Credentials — Always change default usernames and passwords on all systems and devices.
  • Disable Unnecessary Features — Disable Bluetooth, IR, and NFC if not required.
  • Enable Host-Based Firewall — Windows Firewall, iptables/nftables on Linux.
  • Secure Boot — UEFI feature ensuring only signed, trusted software loads at boot. Prevents bootloader malware.
  • Measured Boot — UEFI hashes firmware, bootloader, and drivers at each boot. Results stored in TPM. Used to detect unauthorized changes to the boot process.
  • Full Disk Encryption (FDE) — BitLocker (Windows), FileVault (macOS), LUKS (Linux). Protects data if hardware is stolen.
Endpoint Security Tools
Antivirus / Anti-MalwareSignature-based detection of known threats. Requires up-to-date signatures. Misses zero-days and novel threats. EDR (Endpoint Detection & Response)Advanced endpoint security. Behavioral monitoring, threat hunting, incident response capabilities. Detects threats that bypass traditional AV. HIDS (Host-based IDS)Monitors system activity and alerts on suspicious behavior. Passive — does not block. Good for detecting insider threats and malware after installation. HIPS (Host-based IPS)Like HIDS but actively blocks detected threats. Risk of false-positive blocks on legitimate activity. DLP (Data Loss Prevention)Monitors and prevents unauthorized transfer of sensitive data. Can block USB transfers, email attachments, or cloud uploads based on content classification.
Embedded & Specialized Systems
Embedded SystemsSpecialized computers integrated into a device to perform a specific function. Limited resources, often no user interface. Assessment requires understanding specific interfaces and update mechanisms. SCADA / ICSSupervisory Control and Data Acquisition / Industrial Control Systems. Controls critical infrastructure (power, water, manufacturing). Uses RTUs (Remote Telemetry Units) and PLCs (Programmable Logic Controllers). High-value attack target — never directly internet-exposed. IoT SecurityInternet of Things. Often weak security by design — limited processing, infrequent updates, default credentials. Mitigations: change defaults, segment on dedicated VLAN, keep firmware updated, disable unneeded features. FirmwareEmbedded software enabling device operation. Attack vectors: malicious firmware updates, user-space attacks, remote attacks if network-connected. End-of-life firmware with no update support = significant risk.
CH 12

Network Security

Domain 3 · Obj 3.2, 3.3
Network Security Architecture
Network SegmentationDividing a network into smaller segments. Limits lateral movement after a breach. VLANs, subnets, and DMZ are common techniques. DMZDemilitarized Zone. Separate network segment between external and internal networks. Public-facing servers (web, email, DNS) go here. Isolated from internal LAN — a breach of DMZ doesn't equal internal access. Zero TrustNever trust, always verify. No implicit trust based on network location. Every access request authenticated and authorized. Key components: subjects, policy engines, policy administrators, policy enforcement points. Relies on: adaptive identity, least privilege, policy-driven access control. Fail OpenWhen security device fails, all traffic is allowed through. Prioritizes availability over security. Used for high-availability requirements. Fail ClosedWhen security device fails, no traffic passes. Prioritizes security over availability. Used when security is paramount. NAC (Network Access Control)Determines whether a device should be allowed on the network based on posture (patch level, AV status, encryption). Pre-admission (before connecting) or post-admission (after connecting). Agent-based or agentless.
Network Security Tools
IDS (Intrusion Detection System)Monitors and alerts on suspicious traffic. Passive — does NOT block. Out-of-band deployment — traffic copy sent to IDS. Network-based (NIDS) or Host-based (HIDS). IPS (Intrusion Prevention System)Inline deployment — monitors AND blocks in real time. Must be in traffic path. Risk of blocking legitimate traffic (false positives). Network-based (NIPS) or Host-based (HIPS). NGFWNext-Generation Firewall. Layer 7 inspection (deep packet inspection), application awareness, user identity, built-in IPS. Combines traditional firewall + IPS + application control. Port Mirroring / SPANCopy of network traffic from one port sent to another port (monitor port). Used to connect IDS, packet analyzers, or monitoring tools without being inline. Out-of-band. HoneypotDecoy system designed to attract attackers. Appears valuable but is monitored. Provides intelligence on attack techniques. Isolated from real systems. HoneynetNetwork of honeypots simulating an entire enterprise environment. Honeytoken / HoneyfileFake credentials or files that trigger an alert when accessed. Detect insider threats and exfiltration attempts.
Network Access & Management Controls
Jump Server / Bastion HostHardened, monitored server that acts as the single entry point for administrative access to systems in a protected network segment. Admins connect to the jump server first, then to target systems. All admin sessions logged. Reduces attack surface by eliminating direct admin access from external networks. Out-of-Band ManagementSeparate dedicated management network for administrative access to network devices. Management traffic never shares the production network. If production network goes down, admin can still access devices. Uses dedicated management interfaces, serial console servers, or cellular backup links. In-Band ManagementAdministrative access uses the same network as production traffic. Simpler to set up but less secure — management traffic travels alongside user data. Can be secured with VLANs and encryption but is less resilient than out-of-band. Network Access Control (NAC)Verifies device security posture before granting network access. Checks: AV status, patch level, encryption, domain membership. Non-compliant devices quarantined. Agent-based (software on device) or agentless (network fingerprinting). SD-WANSoftware-Defined WAN. Centrally manages multiple WAN links (MPLS, broadband, LTE). Routes traffic over best available path. Reduces reliance on expensive MPLS. Security consideration: traffic may traverse untrusted internet links — must be encrypted. SASESecure Access Service Edge. Converges SD-WAN with cloud-delivered security (CASB, SWG, ZTNA). Identity-centric. Secures users and devices regardless of location without backhauling traffic through a central data center.
Jump server = the only way in to admin a protected segment. Bastion host = same concept. All admin sessions through the jump server are logged. Out-of-band management = separate network for device management. If an exam question asks how to maintain admin access when production network fails — the answer is out-of-band management.
Secure vs Insecure Protocols
Insecure ProtocolPortSecure ReplacementSecure Port
TelnetTCP 23SSHTCP 22
FTPTCP 20/21SFTP (SSH) / FTPS (TLS)TCP 22 / 990
HTTPTCP 80HTTPS (TLS)TCP 443
SMTPTCP 25SMTPSTCP 465/587
POP3TCP 110POP3STCP 995
IMAPTCP 143IMAPSTCP 993
LDAPTCP 389LDAPSTCP 636
SNMP v1/v2UDP 161/162SNMPv3UDP 161/162
DNSUDP/TCP 53DNSSEC / DoT / DoHUDP/TCP 53 / 853 / 443
RTP (VoIP)UDP 16384–32767SRTPUDP 5004
Email Security Protocols
SPF (Sender Policy Framework)DNS record listing all authorized mail servers for a domain. Receiving mail server checks if sending server is on the list. Rejects or flags emails from unauthorized servers. Prevents email spoofing. DKIM (DomainKeys Identified Mail)Digitally signs email body and key headers with private key. Public key published in DNS. Receiving server verifies signature. Ensures message wasn't altered in transit. DMARCDomain-based Message Authentication Reporting and Conformance. Uses SPF and DKIM results to determine what to do with messages that fail authentication: none (monitor), quarantine, or reject. Provides reporting to domain owner.
SPF = authorized server list. DKIM = message signature. DMARC = policy for handling failures + reporting. All three should be deployed together. SPF and DKIM alone without DMARC don't provide enforcement. The order: SPF and DKIM check authenticity → DMARC determines the action.
Network Attacks
DDoSDistributed Denial of Service. Overwhelming a target with traffic from many sources (botnet). Volumetric (bandwidth), Protocol (state table exhaustion), Application layer (Layer 7 attacks). SYN FloodAttacker sends many SYN packets but never completes the handshake. Server exhausts half-open connection table. Mitigate with SYN cookies. On-Path Attack (MITM)Attacker intercepts and optionally modifies communication between two parties. Both parties believe they're talking to each other. Enables eavesdropping, credential theft, and data manipulation. DNS PoisoningInjecting false DNS records into a resolver's cache. Victims are redirected to attacker-controlled servers. Mitigate with DNSSEC. ARP PoisoningSending fake ARP replies to associate attacker's MAC with legitimate IP. Enables MITM on the local network segment. Mitigate with Dynamic ARP Inspection (DAI).
CH 13

Wireless & Mobile Security

Domain 3 · Obj 3.4
Wi-Fi Security Protocols
ProtocolEncryptionAuth ModeStatus
WEPRC4 (40/128-bit)Open / Shared KeyBroken. Never use. Crackable in minutes.
WPATKIP (RC4-based)PSK / EnterpriseLegacy. Phased out. Weak.
WPA2AES-CCMPOpen / PSK / EnterpriseCurrent standard. Strong but older. Vulnerable to KRACK attack on implementation.
WPA3GCMP-256 / AES-CCMPOpen / SAE / EnterpriseNewest. SAE replaces PSK. Resistant to offline dictionary attacks. Forward secrecy.
WPA3's SAE (Simultaneous Authentication of Equals) replaces PSK in personal mode. SAE provides resistance to offline brute-force and dictionary attacks because the attacker must interact with the network for each guess. WPA2 PSK captured handshakes can be cracked offline — SAE prevents this.
Enterprise Wireless Authentication
Enterprise ModeUses RADIUS server for authentication. Each user has unique credentials. Supports EAP protocols. Required for corporate/government environments. EAP-TLSMost secure EAP variant. Both client and server use certificates. Mutual authentication. Requires client certificate deployment (complex to manage). PEAPProtected EAP. Only server uses certificate. Client uses username/password inside TLS tunnel. Easier to deploy than EAP-TLS. EAP-TTLSEAP Tunneled TLS. Similar to PEAP. Server-only certificate. Various inner authentication methods supported. Captive PortalWeb page on first connection requiring credentials or agreement. Common in hotels, airports, guest networks. Not secure on its own — use with VPN.
Wireless Attacks
Evil TwinRogue AP broadcasting same SSID as legitimate network. Victims connect to attacker's AP. Enables MITM for credential theft. Mitigate with certificate-based auth (EAP-TLS). Rogue APUnauthorized access point connected to corporate network. May not impersonate legitimate SSID. Creates unsecured entry point. Detect with wireless IDS/IPS. Deauthentication AttackSends spoofed deauth frames to disconnect clients from legitimate AP. Can force client to reconnect (capturing 4-way handshake for WPA2 cracking). Mitigate with 802.11w (Management Frame Protection). JammingRadio frequency interference disrupts wireless communications. DoS attack against wireless. Difficult to prevent — detect and locate the source. WardrivingDriving around to discover and map wireless networks. Identifies networks with weak or no security for targeting.
Bluetooth & Near-Field Attacks
BluejackingSending unsolicited messages to discoverable Bluetooth devices. Annoying but generally harmless — no data is stolen. Range: ~10m. Mitigate: disable Bluetooth discoverability when not pairing. BluesnarfingUnauthorized access to data on a Bluetooth device — contacts, emails, messages, photos. Exploits Bluetooth vulnerabilities without pairing. More serious than bluejacking. Mitigate: keep Bluetooth patched, use non-discoverable mode. BluebuggingTakes full control of a Bluetooth device — can make calls, send messages, access data. Most serious Bluetooth attack. Requires being within Bluetooth range. NFC AttacksNFC range is ~4cm but attackers with specialized antennas can extend range. Eavesdropping (capture NFC data), relay attacks (extend effective range to fool proximity check), data manipulation (modify NFC data in transit). Mitigate: disable NFC when not in use.
Physical & Hardware Attacks
USB Drop Attack (Baiting)Leaving infected USB drives in parking lots or common areas. Curiosity or good intent causes employees to plug them in. Can auto-execute malware via HID (Human Interface Device) emulation — the USB pretends to be a keyboard and types malicious commands faster than humans can see. Mitigate: disable AutoRun, USB port control via MDM/GPO, security awareness training. O.MG / Rubber DuckyMalicious USB devices disguised as ordinary cables or flash drives. Emulate keyboards to inject keystrokes at machine speed. Can exfiltrate data, create backdoors, or install malware in seconds. Mitigate: physical port controls, USB allowlisting. Evil Maid AttackPhysical access to an unattended device. Attacker installs hardware keylogger, boots from external media to bypass disk encryption, or modifies the bootloader. Named for hotel maids who have physical access to rooms. Mitigate: full disk encryption, Secure Boot, BIOS passwords, device tracking. Supply Chain AttackCompromising hardware or software before it reaches the target organization. Examples: malicious firmware in routers/servers during manufacturing or shipping, malicious code injected into software updates (SolarWinds, NotPetya). Extremely difficult to detect. Mitigate: vendor risk management, hardware attestation, software signing and verification.
Bluejacking = sends messages (harmless). Bluesnarfing = steals data (harmful). Bluebugging = full device control (most harmful). The "snarf" in bluesnarfing = snatching data. USB drop attacks exploit HID emulation — the drive acts as a keyboard, not just storage, bypassing many controls.
Mobile Device Management
MDM (Mobile Device Management)Centrally manages mobile devices. Enforces policies: passcode requirements, encryption, remote wipe, application control, screen lock. Administers both corporate and personal devices. BYODBring Your Own Device. User owns and maintains the device. Cheapest but least secure — organization has limited control. Higher risk of data exposure. COPECorporate Owned, Personally Enabled. Organization owns device, allows reasonable personal use. Best balance of control and user flexibility. CYODChoose Your Own Device. Organization owns device, user selects from approved list. Maintains control while giving user some choice. Remote WipeErase all data on a lost or stolen device remotely. Critical security control. Full wipe (everything) or selective wipe (corporate data only). SideloadingInstalling apps from outside the official app store. Bypasses app vetting process. MDM can prevent sideloading. Common way to install malicious apps. Jailbreaking / RootingRemoving OS manufacturer restrictions. iOS = jailbreaking. Android = rooting. Bypasses security controls. Exposes device to unapproved apps and exploits. MDM should detect and quarantine jailbroken devices.
CH 14

Monitoring & Incident Response

Domain 4 · Obj 4.3, 4.4, 4.8
Incident Response Process
Preparation — Develop IR plan, train team, establish communication channels, deploy tools (SIEM, EDR). Before any incident.
Detection & Analysis — Identify and confirm an incident. Review alerts, logs, and IoCs. Classify severity. Determine scope.
Containment — Stop the spread. Short-term containment (isolate systems) and long-term containment (patch, rebuild). Preserve forensic evidence.
Eradication — Remove the threat. Delete malware, close vulnerabilities, eliminate attacker footholds.
Recovery — Restore systems to normal operation. Validate they are clean. Monitor closely after return to service.
Lessons Learned — Post-incident review. What happened? What worked? What didn't? What changes will prevent recurrence? Document everything.
CompTIA Security+ tests the PICERL model: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. Know the correct order and what each phase involves. Containment happens BEFORE eradication.
Attack Frameworks
Cyber Kill ChainLockheed Martin model. 7 phases of an attack: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control (C2) → Actions on Objectives. Used to understand and interrupt attacks at each phase. MITRE ATT&CKKnowledge base of adversary tactics, techniques, and procedures (TTPs). Provides common language for describing attacks. Used for threat hunting, detection engineering, and red team planning. More granular than the Kill Chain. Diamond ModelAnalyzes intrusions using four points: Adversary, Capability, Infrastructure, Victim. Relationships between these points characterize the attack. Used for attribution and intelligence analysis.
SIEM — Security Information & Event Management
FunctionCentralizes log collection, correlation, alerting, and reporting from across the environment. Single pane of glass for security monitoring. Log SourcesFirewalls, IDS/IPS, endpoints, servers, applications, authentication systems, DNS, DHCP. Everything that generates events. Correlation RulesLogic that identifies patterns across multiple events from multiple sources that individually appear benign but together indicate an attack. Example: failed login + successful login + data download = potential credential theft. Dashboards & AlertsReal-time visibility into security posture. Alerts trigger when correlation rules fire. Trends show changes over time. Metadata AnalysisEmail metadata (sender, recipient, timestamps, routing), file metadata (creation date, author, location), mobile metadata (GPS, device ID), web metadata (User-Agent, referrer).
SOAR & Playbooks
SOARSecurity Orchestration, Automation, and Response. Automates repetitive security tasks and incident response workflows. Integrates with SIEM, ticketing systems, threat intel feeds, and security tools. Reduces mean time to respond (MTTR) by handling routine alerts without human intervention. PlaybookPredefined, documented response procedure for a specific type of security incident. Step-by-step actions to take when a particular alert fires. SOAR platforms execute playbooks automatically. Example: phishing playbook — auto-quarantine email, check URL reputation, alert SOC analyst. RunbookSimilar to a playbook but covers routine operational procedures (not just incidents). More general — can cover daily maintenance tasks. Playbooks are a type of runbook focused on security incidents. Automation BenefitsFaster response than human analysts. Consistent — no steps skipped. Frees analysts for high-level tasks. Scales to handle large alert volumes. Reduces alert fatigue.
SIEM = collects and correlates logs, generates alerts. SOAR = automates the response to those alerts using playbooks. SIEM tells you something happened. SOAR automatically does something about it. Both are commonly deployed together in modern SOCs.
Log Types & Analysis
System LogsOS-level events: startup/shutdown, driver failures, kernel errors, service starts/stops. Windows Event Log categories: System, Application, Security, Setup. Security LogsAuthentication events: successful/failed logins, privilege use, account changes, object access (if auditing enabled). Most forensically valuable Windows log. Event IDs: 4624 (logon), 4625 (failed logon), 4648 (explicit credential use), 4740 (account lockout). Application LogsEvents from applications: errors, crashes, access events, configuration changes. Format varies by application. Network LogsFirewall logs (allowed/denied traffic), DNS query logs, DHCP logs, proxy logs, VPN connection logs. Essential for detecting lateral movement and exfiltration. NetFlow / IPFIXNetwork traffic metadata: source/dest IP, port, protocol, byte count, timestamps. Does NOT capture packet payload — only traffic statistics. Used to detect anomalies (unusually large transfers, unexpected connections) without full packet capture overhead. Packet Capture (PCAP)Full capture of network traffic including payload content. High detail but high storage requirement. Wireshark, tcpdump. Used for deep forensic analysis and protocol debugging. Log RetentionHow long logs are kept. Compliance requirements vary: PCI DSS = 1 year minimum (3 months online). HIPAA = 6 years. Establish retention policy based on regulatory requirements and forensic needs. Logs must be tamper-evident.
Indicators of Compromise (IoCs)
Account lockouts Concurrent sessions from multiple locations Impossible travel Unusual resource consumption Blocked content alerts Resource inaccessibility Out-of-cycle logging Missing or altered logs Unusual outbound traffic New admin accounts created
Threat Hunting & Root Cause Analysis
Threat HuntingProactive search for threats that have evaded automated detection. Assumes breach has occurred — looks for evidence. Uses hypothesis-driven investigation and IoC analysis. Five WhysRoot cause analysis technique. Ask "why?" at least five times to drill down from symptom to underlying cause. Identifies the actual problem, not just the symptoms. Root Cause AnalysisIdentifies the underlying cause of an incident. Not just what happened, but why it was possible. Drives systemic fixes rather than surface-level patches.
CH 15

Digital Forensics

Domain 4 · Obj 4.4
Core Forensics Principles
Chain of CustodyDocumented record of everyone who handled evidence from collection to court presentation. Ensures admissibility. Every transfer documented: who, when, why. Breaks in chain = evidence potentially inadmissible. Integrity PreservationEvidence must not be modified during collection or analysis. Use write blockers. Create forensic image (bit-for-bit copy). Work on copy — never on original. Legal HoldOrganization's obligation to preserve potentially relevant evidence when litigation is reasonably anticipated. Requires suspending normal retention/destruction schedules. Triggered by lawsuit, investigation, or regulatory inquiry. Forensic ImageBit-for-bit copy of an entire storage device including deleted files, unallocated space, and slack space. Used for analysis while preserving original. FTK Imager is a common tool.
Order of Volatility

Evidence must be collected from most volatile (disappears fastest) to least volatile:

CPU Registers & Cache — Most volatile. Lost on power cycle. Capture first.
RAM (Memory) — Running processes, encryption keys, network connections. Lost on reboot. Use memory capture tools immediately.
Network Connections — Active sessions, open ports, routing table, ARP cache. Changes quickly.
Running Processes — Process list, open files, temporary data.
Disk / Storage — Files, logs, installed applications. Persists through power cycle.
Remote / Cloud Storage — May be changed by others or auto-deleted. Notify provider early.
Backups and Archives — Least volatile. Stable but may not reflect current state.
RAM is collected BEFORE disk in forensics — always. It contains encryption keys, passwords in memory, running malware, and active network connections that are lost on shutdown. FTK Imager can capture both RAM and disk images.
EDRM — Electronic Discovery Reference Model

The EDRM defines the standard process for electronic discovery in legal proceedings:

Information Governance — Manage data before litigation occurs.
Identification — Know what data exists and where it is.
Preservation — Ensure data isn't changed or destroyed (legal hold).
Collection — Gather data for processing and management.
Processing — Remove irrelevant data, format for review.
Review — Ensure only appropriate data is included.
Analysis — Identify key topics, terms, individuals.
Production — Provide data to third parties or court.
Presentation — Testimony and expert analysis in court.
Forensics Tools
FTK ImagerCreates forensic disk images and captures RAM. Generates hash values to verify integrity. Free tool by Exterro. Standard for acquisition. FTK (Forensic Toolkit)Full forensic analysis suite. Processes disk images, email, mobile devices. Industry standard for law enforcement and enterprise. AutopsyOpen-source forensic platform. Disk imaging, keyword search, timeline analysis, artifact recovery, file carving. Built on The Sleuth Kit. Free alternative to FTK. VolatilityOpen-source memory forensics framework. Analyzes RAM dumps for processes, network connections, malware artifacts, encryption keys. Write BlockerHardware or software device that prevents any writes to original evidence during forensic acquisition. Essential for maintaining evidence integrity.
CH 16

Security Governance & Compliance

Domain 5 · Obj 5.1, 5.2, 5.4, 5.5, 5.6
Policy Hierarchy
PoliciesHigh-level statements of management intent. "The organization will protect customer data." Sets the direction. All other documents derive from policy. StandardsSpecific mandatory requirements that implement policy. "All passwords must be at least 12 characters." More specific than policy. ProceduresStep-by-step instructions for how to implement standards. "To reset a password: Step 1... Step 2..." Operational instructions. GuidelinesRecommended best practices. Not mandatory. "We recommend using a password manager." Advisory, not enforced. AUP (Acceptable Use Policy)Defines what users may and may not do with organizational systems. Must be signed before access is granted. Foundation of user accountability.
Major Compliance Frameworks & Regulations
HIPAAHealth Insurance Portability and Accountability Act. Protects PHI (Protected Health Information). Applies to healthcare providers, insurers, and business associates. Security, Privacy, and Breach Notification Rules. PCI DSSPayment Card Industry Data Security Standard. Protects cardholder data. Applies to any organization that processes, stores, or transmits credit card data. 12 requirements. Not a law — industry standard with contractual enforcement. GDPRGeneral Data Protection Regulation. EU regulation protecting personal data of EU residents. Applies globally if processing EU resident data. Right to be forgotten, data portability. Fines up to 4% of global revenue. SOXSarbanes-Oxley Act. US law. Protects investors from fraudulent financial reporting. IT controls for financial systems. Applies to publicly traded US companies. GLBAGramm-Leach-Bliley Act. US law. Financial institutions must protect customer financial information. Safeguards Rule requires security programs. FERPAFamily Educational Rights and Privacy Act. Protects student education records. Applies to schools receiving federal funding. Parents/students control who sees records.
NIST Cybersecurity Framework (CSF)
Five Core FunctionsIdentify → Protect → Detect → Respond → Recover. A cyclical process, not a checklist. Maps to security program maturity. IdentifyKnow your assets, risks, and organizational context. Asset management, risk assessment, governance. ProtectImplement safeguards. Access control, training, data security, maintenance, protective technology. DetectDiscover security events. Anomaly detection, continuous monitoring, detection processes. RespondTake action on detected events. Response planning, communications, analysis, mitigation. RecoverRestore capabilities after an incident. Recovery planning, improvements, communications.

NIST CSF Implementation Tiers

Tier 1: PartialAd hoc, reactive, informal risk management. No formal program. Tier 2: Risk InformedApproved practices but not organization-wide policy. Tier 3: RepeatableFormally approved policies, organization-wide implementation. Tier 4: AdaptiveContinuously improved based on lessons learned and threat intelligence.
NIST Risk Management Framework (RMF)

7-step process for managing information security and privacy risk:

Prepare — Set organizational risk management context.
Categorize — Classify system and data based on impact level.
Select — Choose appropriate security controls (NIST SP 800-53).
Implement — Put selected controls in place.
Assess — Verify controls are implemented correctly and effective.
Authorize — Senior official accepts residual risk and authorizes operation.
Monitor — Continuously monitor controls and system for changes.
Change Management
Request for Change (RFC) submitted with description and justification.
Change review board evaluates impact, risk, and resources required.
Approve or reject. If approved, schedule maintenance window.
Test the change in non-production environment.
Implement change in production with a backout plan ready.
Document the change — update diagrams, policies, and procedures.
Version control (Git) is an important component of change management. Allows reversion to previous configurations if changes cause problems. Every configuration change should be versioned and documented.
Third-Party Risk Management
Vendor Risk AssessmentEvaluating the security posture of third parties before and during a business relationship. Questionnaires, on-site audits, review of certifications (SOC 2, ISO 27001). Risk is transferred by contract but not eliminated — your organization is still responsible for breaches caused by vendors. Supply Chain RiskRisk introduced through hardware, software, or services from the supply chain. A compromise anywhere in the chain can impact the end user. Examples: compromised firmware in hardware, malicious packages in software repositories, SolarWinds-style update poisoning. Due DiligenceThorough investigation of a potential vendor's security controls, financial stability, and compliance posture before entering a contract. Ongoing diligence required throughout the relationship — not just at contract signing. Vendor AgreementsContractual documents that define security expectations. SLA (Service Level Agreement) — performance metrics. NDA (Non-Disclosure Agreement) — confidentiality. MOU (Memorandum of Understanding) — intent agreement, not legally binding. MSA (Master Service Agreement) — overarching contract terms. BPA (Business Partnership Agreement) — partnership terms. Right to AuditContractual clause giving the customer the right to audit a vendor's security controls. Critical for high-risk vendor relationships. Alternatively, require vendors to provide SOC 2 Type II reports (third-party audit results). End-of-Life (EOL) Vendor RiskThird-party components that reach EOL stop receiving patches. EOL software in your supply chain becomes an unpatched vulnerability you cannot fix. Identify and plan for replacement before EOL dates.
Third-party risk is heavily tested in SY0-701. Key concept: outsourcing a function transfers responsibility but NOT accountability. If a vendor breaches your customer data, your organization faces the regulatory and reputational consequences. Due diligence + contractual protections + ongoing monitoring are all required.
Auditing & Assessments
Internal AuditConducted by the organization's own staff. Less expensive. May lack objectivity. Good for ongoing compliance monitoring. External AuditConducted by an independent third party. More objective and credible. Required for many compliance frameworks (SOC 2, PCI QSA). More expensive. AttestationFormal declaration that security controls are in place and functioning. Management signs off on compliance statements. Carries legal weight — false attestation = significant liability. SOC ReportsSystem and Organization Controls. SOC 1 = financial controls. SOC 2 = security, availability, processing integrity, confidentiality, privacy (Trust Services Criteria). Type I = controls exist at a point in time. Type II = controls operated effectively over a period (6+ months). SOC 2 Type II is the gold standard for vendor assurance. ISO 27001International standard for information security management systems (ISMS). Certification requires third-party audit. Demonstrates comprehensive security program. Globally recognized. Regulatory ComplianceMeeting requirements imposed by law or regulation. Non-compliance = fines, lawsuits, loss of license to operate. Examples: HIPAA fines up to $1.9M per violation category per year. GDPR fines up to €20M or 4% of global annual turnover.
CH 17

Risk Management & Privacy

Domain 5 · Obj 5.2, 5.3
Risk Fundamentals
ThreatA possible event that could cause harm. "Someone might try to steal our data." VulnerabilityA weakness in a system that could be exploited. "Our web app is susceptible to SQL injection." RiskThe product of threat and vulnerability. Risk = Likelihood × Impact. Without a vulnerability, a threat presents no risk. Without a threat, a vulnerability presents no risk. LikelihoodProbability that a threat will exploit a vulnerability. Expressed as probability (quantitative) or High/Medium/Low (qualitative). ImpactThe damage a risk event would cause if it occurred. Financial, operational, reputational, compliance.
Risk Assessment Types
Quantitative Risk AssessmentUses numerical data and calculations. Produces dollar-value results. More objective but requires accurate data. Key metrics: AV (Asset Value), EF (Exposure Factor), ARO (Annual Rate of Occurrence), SLE, ALE. SLE (Single Loss Expectancy)AV × EF. Expected loss from a single risk event. Example: $1M server × 30% destruction = $300,000 SLE. ALE (Annual Loss Expectancy)SLE × ARO. Expected annual loss from a risk. Example: $300,000 SLE × 0.5 events/year = $150,000 ALE. Use ALE to justify security investment — don't spend more than the ALE to prevent the risk. Qualitative Risk AssessmentUses subjective ratings (High/Medium/Low, 1–5 scale). Based on expert opinion. Faster and cheaper than quantitative. Used when hard data is unavailable. Produces risk matrix.
Risk Responses
Risk MitigationReduce the likelihood or impact of the risk. Implementing security controls, patches, or redundancy. Most common response. Risk AvoidanceChange business practices to eliminate the risk entirely. Stop doing the risky activity. Example: don't store credit card data at all. Risk TransferenceShift the risk to another party. Cyber insurance, contracts, outsourcing. Financial impact transferred, not the risk itself. Risk AcceptanceAcknowledge the risk and decide to live with it. Appropriate when cost of mitigation exceeds expected loss. Must be a documented, conscious decision.
Risk can never be eliminated completely — there is always residual risk remaining after controls are applied. Accepting residual risk after mitigation is normal. The goal is to reduce risk to an acceptable level, not to zero.
Risk Register & Risk Matrix
Risk RegisterCentralized document tracking all identified risks, their likelihood, impact, owner, and mitigation status. Living document updated continuously. Used for risk prioritization and management reporting. Risk MatrixVisual grid plotting likelihood vs impact. Identifies risk severity at a glance. High likelihood + High impact = Critical risk (red zone). Used in qualitative assessments. Risk AppetiteThe level of risk an organization is willing to accept in pursuit of its objectives. Set by senior leadership and the board. Risk ToleranceThe acceptable variation in outcomes related to risk. How much actual risk can deviate from risk appetite before action is required.
Data Roles & Classification
Data OwnerSenior leader responsible for a data asset. Sets classification and access policies. Accountable for the data. Data CustodianIT professional responsible for implementing the data owner's policies. Day-to-day management: backups, access controls, encryption. Data ProcessorOrganization or system that processes data on behalf of the data controller. Common in GDPR context. Data StewardResponsible for data quality and governance. Ensures data is accurate, consistent, and properly documented. Government ClassificationTop Secret → Secret → Confidential → Sensitive But Unclassified → Unclassified. Commercial ClassificationTypically: Restricted/Confidential → Private/Internal → Public.
Privacy Enhancing Technologies
Data MinimizationCollect and retain only the minimum personal data necessary for the stated purpose. Core GDPR principle. Limits exposure. AnonymizationRemove all identifying information from data sets so individuals cannot be identified. True anonymization means re-identification is not possible. PseudonymizationReplace identifying information with pseudonyms. Data can be re-identified with the mapping key. GDPR recognizes this as a risk reduction measure but not full anonymization. Data SovereigntyData is subject to the laws of the country where it is stored. Cloud customers must know where their data resides. Critical for GDPR compliance. Right to be ForgottenGDPR provision allowing individuals to request deletion of their personal data when it's no longer needed for its original purpose. Organization must comply within 30 days.