Free Exams learning guide
CompTIA Security+ Exam Study Guide
CompTIA Security+ Exam Study Guide — a free intermediate-level guide covering how to pass the comptia security+ exam. Learn with clear explanations,...
What you will learn
- Exam Strategy and Core Security Principles
- Cryptography and Public Key Infrastructure
- Identity and Access Management (IAM)
- Threats, Vulnerabilities, and Attacks
- Security Architecture and Network Design
- Security Operations and Incident Response
- Security Program Management and Governance
- Exam Preparation and Final Review
1. Exam Strategy and Core Security Principles
Navigating the CompTIA Security+ (SY0-701) Exam A cybersecurity analyst notices an unauthorized configuration change on a core border firewall. The change allows traffic from an unknown external IP range directly into the isolated database segment. The analyst immediately checks the change management logs—there is no record of this modification. When confronted, the senior network engineer who has administrative access to the firewall claims their account was not involved. How do you prove whether the engineer is telling the truth? This scenario hinges on a concept called non-repudiation—the ability to prove the origin and integrity of an action. It is one of the most heavily tested concepts on the CompTIA Security+ exam. To successfully pass the SY0-701 exam, you must move beyond simply recognizing security terminology. You must understand how these concepts apply to real-world architectures, policy decisions, and incident response scenarios. Exam Structure and Format The CompTIA Security+ (SY0-701) exam is designed for professionals with baseline security knowledge, acting as a springboard for intermediate cybersecurity roles. Understanding the exam’s mechanics is the first step toward passing it. Maximum Questions: 90 questions. (CompTIA typically includes up to 15 unscored, beta questions used for data gathering, though you will not know which ones they are). Time Limit: 90 minutes. Passing Score: 750 (on a scale of 100 to 900). Question Types: Multiple-choice questions (MCQs): Single and multiple response. Pay close attention to whether the prompt asks for one answer or "two" or "three" answers. Performance-based questions (PBQs): These simulate real-world problems, such as configuring a firewall rule set, dragging and dropping server components to create a secure architecture, or analyzing log files to identify an attack. Exam Domain Weighting The exam is broken down into five domains. Knowing the weighting helps you allocate your study time effectively. 1. General Security Concepts (12%): The foundational principles covered in this chapter. 2. Threats, Vulnerabilities, and Mitigations (22%): Attack vectors, threat actors, and vulnerability management. 3. Security Architecture (28%): Designing secure systems, cloud concepts, and cryptography. 4. Security Operations (24%): Incident response, monitoring, and automation. 5. Security Program Management and Oversight (14%): Governance, risk, compliance (GRC), and policy creation. Tactical Exam Strategy When you sit for the exam, time management and question dissection are your greatest assets. 1. Tackle PBQs strategically: PBQs often appear at the beginning of the exam. If a PBQ is complex and you are unsure of the answer, do not burn 15 minutes on it. Make your best guess, flag it, and move on. You can return to it later with fresh eyes. 2. Process of elimination: For MCQs, eliminate the distractors first. CompTIA questions often feature two plausible answers and two clearly incorrect ones. Narrowing the field to a 50/50 …
2. Cryptography and Public Key Infrastructure
The Cryptographic Landscape Imagine intercepting a highly sensitive military transmission during wartime. The data is sitting right in front of you, completely unencrypted, because the sender assumed their private network was secure. This exact scenario played out during the early days of network computing, leading to catastrophic breaches. Today, cryptography is the ultimate safety net—the mechanism that ensures data is useless even if an attacker bypasses your perimeter defenses and intercepts your traffic. Cryptography underpins the Confidentiality pillar of the CIA triad introduced in Module 1. But it goes further, providing mechanisms for integrity, authentication, and non-repudiation. For the CompTIA Security+ exam, you must be able to differentiate between the primary types of cryptographic algorithms, understand how they are combined, and manage the infrastructure that issues and validates their keys. Symmetric vs. Asymmetric Encryption At the highest level, encryption algorithms are divided into two categories: symmetric and asymmetric. The distinction lies entirely in how the keys are managed. Symmetric Encryption Symmetric encryption uses a single shared key to both encrypt and decrypt data. It is computationally fast and highly efficient for encrypting large amounts of data at rest or in transit. Exam essentials for symmetric algorithms: AES (Advanced Encryption Standard): The current global standard. It uses block cipher modes (encrypting fixed-size blocks of data, typically 128 bits) and supports key sizes of 128, 192, and 256 bits. ChaCha20: A modern stream cipher (encrypting data bit-by-bit) often paired with Poly1305 for authentication. It is highly efficient on mobile devices lacking specialized hardware acceleration. Blowfish/3DES: Older algorithms. 3DES (Triple DES) is largely deprecated due to performance issues and vulnerabilities but may appear on the exam as a legacy system you need to identify and replace. The key distribution problem: Because both parties need the same key, you must securely share that key with the recipient before any encrypted communication can occur. If you could securely send the key, you might as well securely send the message. This flaw leads directly to the need for asymmetric encryption. Asymmetric Encryption Asymmetric encryption uses mathematically linked key pairs: a public key and a private key. Data encrypted with the public key can only be decrypted by the corresponding private key, and vice versa. It is computationally slow, so it is rarely used to encrypt large datasets. Instead, it is primarily used to securely exchange symmetric keys and perform digital signatures. Exam essentials for asymmetric algorithms: RSA (Rivest-Shamir-Adleman): The most widely used asymmetric algorithm. Relies on the mathematical difficulty of factoring the product of two large prime numbers. ECC (Elliptic Curve Cryptography): Provides the same level of security as RSA but uses much smaller key sizes (e.g., a 256-bit ECC key is roughly equivalent to a …
3. Identity and Access Management (IAM)
The Foundation of Access: AAA Imagine an employee clicks a phishing link, and an attacker obtains their username and password. If that single credential pair is all that stands between the attacker and your organization's customer database, the breach is already over. The only thing that could have stopped it—short of the user not clicking the link—is a robust Identity and Access Management (IAM) framework that requires more than just a password. At the heart of IAM is the AAA concept: Authentication, Authorization, and Accounting. Building on the CIA triad discussed in Chapter 1, AAA is the primary mechanism for enforcing Confidentiality and ensuring that users are held accountable for their actions (a practical application of non-repudiation, which we explored in Chapter 2). Because you are preparing for the CompTIA Security+ exam, you need to look at AAA not just as a concept, but as a set of technologies you will configure and troubleshoot. Authentication (Who are you?) Authentication is the process of verifying a user's identity. You should already know the three classic factors of authentication (something you know, something you have, something you are), so we will move briskly into how they are applied and managed. Password Policies: CompTIA expects you to know how to configure secure password policies. This includes enforcing complexity (uppercase, lowercase, numbers, symbols), length (preferably 12+ characters or passphrases), and expiration. However, modern frameworks like NIST SP 800-63B have shifted away from mandatory periodic resets unless a compromise is suspected, favoring length and breach-list checking instead. Be prepared to apply the "CompTIA mindset" here: if a question asks for the BEST way to mitigate password attacks, look for length and complexity over frequent resets, but know that legacy systems might still enforce expiration. Biometrics: When dealing with "something you are," you must understand the metrics of biometric accuracy. False Acceptance Rate (FAR): The system incorrectly grants access to an unauthorized user. This is a severe security risk. False Rejection Rate (FRR): The system incorrectly denies access to an authorized user. This is an inconvenience and a productivity drain. Crossover Error Rate (CER): The point where FAR and FRR intersect. A lower CER indicates a more accurate, highly tuned biometric system. Authorization (What can you do?) Once authenticated, the system must determine what you are allowed to do. Authorization dictates access rights. Least Privilege: Users should only have the permissions necessary to perform their job functions—nothing more. Role-Based Access Control (RBAC): Access is based on the user's role within the organization. A "HR Manager" role might have access to payroll, while an "IT Admin" role has access to server configurations. This is the most common model in enterprise environments. Attribute-Based Access Control (ABAC): A more …
4. Threats, Vulnerabilities, and Attacks
In late 2013, a massive data breach at the retail giant Target compromised the credit and debit card information of over 40 million customers. The initial point of entry wasn't a sophisticated, zero-day exploit against Target's heavily fortified point-of-sale systems. It was a phishing email sent to a third-party HVAC contractor. Attackers stole the contractor's credentials, pivoted into Target's network, and eventually reached the payment systems. This breach perfectly illustrates the intersection of threat actors, attack vectors, and vulnerabilities. As you prepare for the CompTIA Security+ exam (which heavily weights the "Threats, Vulnerabilities, and Mitigations" domain at 22%), you must understand not just how attacks happen, but who executes them, why they do it, and how organizations proactively search for these weaknesses before an attacker does. Threat Actors and Their Motivations To defend a network, you must first understand who is trying to breach it. The Security+ exam expects you to categorize threat actors based on their capabilities, motivations, and levels of sophistication. When tackling these questions, use the "CompTIA mindset"—look for the underlying intent rather than just the technical action. Categories of Threat Actors Nation-state / Advanced Persistent Threats (APTs): These are highly skilled, well-funded groups typically backed by governments. Their motivations are usually espionage, intellectual property theft, or disrupting critical infrastructure. They operate stealthily, maintaining long-term persistence in a network. They are the most likely to use zero-day exploits. Organized Crime: Driven almost entirely by financial gain, these groups operate like illegal corporations. They are responsible for the bulk of ransomware attacks, business email compromise (BEC), and credit card skimming operations. They are highly organized, often employing specialists for different phases of an attack. Hacktivists: Their motivations are ideological, political, or social. A hacktivist group like Anonymous might launch Distributed Denial of Service (DDoS) attacks or deface websites to protest a corporation's policies or a government's actions. Their goal is usually maximum visibility and disruption rather than financial gain. Insider Threats: These are individuals with legitimate access to an organization's systems who misuse that access. They can be malicious (a disgruntled employee stealing data to sell to a competitor) or negligent (an employee who accidentally exposes an S3 bucket to the public internet). Shadow IT: While not inherently malicious, employees who set up unauthorized software or cloud services create vulnerabilities that threat actors can exploit. Script Kiddies: Unskilled individuals who use pre-packaged tools and scripts created by others. They lack deep technical knowledge and are usually motivated by curiosity, a desire for notoriety, or basic mischief. Attributes and Motivations When analyzing a scenario on the exam, map the attack to the actor's attributes: 1. Internal vs. External: Does the attacker have existing access (internal) or are they attacking …
5. Security Architecture and Network Design
Designing Secure Network Topologies An attacker breaches an exposed web server. In a flat network, that single compromise gives the attacker a direct path to customer databases, internal file shares, and domain controllers. In a segmented network, the attacker hits a wall—an access control list on a router or a firewall rule blocking lateral movement. Network security architecture is about building those walls proactively. While the CIA triad (introduced in Chapter 1) defines what we are protecting, network topology dictates how we structurally enforce those protections. For the CompTIA Security+ exam, you must look at network designs and quickly identify where traffic flows, where trust boundaries exist, and how to isolate critical assets. The DMZ and Zones of Trust A Demilitarized Zone (DMZ) is a logical or physical separate network segment that houses services exposed to the untrusted internet. Think of it as the lobby of a building—outsiders can enter, but they cannot access the private offices. Typical DMZ architecture uses two firewalls: 1. An external firewall connects the internet to the DMZ. 2. An internal firewall connects the DMZ to the trusted internal network. Traffic flows from the internet into the DMZ are strictly controlled. Crucially, the internal network should never allow the DMZ to initiate connections back into it. If an attacker compromises a DMZ web server, they should not be able to pivot directly to the internal database; the internal firewall must block all inbound traffic from the DMZ by default. Network Access Control (NAC) Building on the Identity and Access Management (IAM) concepts from Chapter 3, Network Access Control (NAC) enforces security policy at the network edge. NAC evaluates a device's security posture before granting it access. NAC operates in two primary modes: Pre-admission: The device is assessed before it joins the network. If it fails the posture check (e.g., missing AV definitions, outdated OS patches), it is denied access or quarantined. Post-admission: The device is continuously monitored while connected. If its posture changes or it exhibits malicious behavior, its access is dynamically revoked or restricted. VLANs and Segmentation Virtual Local Area Networks (VLANs) create logical broadcast domains within a single physical network infrastructure. Instead of buying separate switches for HR, Finance, and IT, administrators configure switches to group ports logically. For the exam, VLANs are primarily a security control used for segmentation. By separating user departments, guest networks, and voice traffic into different VLANs, you limit the blast radius of an attack. To move between VLANs, traffic must pass through a router or a Layer 3 switch, where Access Control Lists (ACLs) can inspect and filter the traffic. Network Security Devices and Placement Knowing what a firewall does is fundamental; knowing where to place it …
6. Security Operations and Incident Response
Detecting the Threat in the Noise At 2:14 AM on a Tuesday, an automated alert fires off in a Security Operations Center (SOC). A user account belonging to a junior marketing executive has authenticated successfully from the company’s headquarters in New York. Eleven seconds later, the same account authenticates from an IP address in Eastern Europe. Is this a VPN glitch, or is it an active intrusion? This scenario illustrates the core challenge of Security Operations. As discussed in earlier modules, attackers will inevitably bypass preventive controls like firewalls and IAM systems. When they do, security operations is the discipline of noticing, reacting, and recovering. For the CompTIA Security+ exam, this domain—Security Operations (24% of the exam)—tests your ability to analyze monitoring outputs, execute the incident response lifecycle, and ensure the business can survive a catastrophic failure. Log Analysis and Security Monitoring Security monitoring relies on logs—immutable records of events generated by operating systems, applications, and network devices. You already understand the threats (Module 4) and the architecture (Module 5); now you must learn how those architectures signal when they are under attack. Common Log Sources To detect threats, you must know where to look. Intermediate security professionals should be intimately familiar with the outputs of these systems: - Firewall and Network Appliances: Log denied connections, allowed connections, and NAT translations. Next-Generation Firewalls (NGFW) provide deeper context, logging application-level traffic and blocked malware payloads. - Endpoint Detection and Response (EDR): Generates logs for process creation, registry modifications, file executions, and memory access on individual hosts. - Operating System Logs: Windows Event Logs (Security, System, Application) and Linux syslog and auth.log files track logins, privilege escalations, and system changes. - IAM Systems: As covered in Module 3, identity providers log authentication successes, failures, Multi-Factor Authentication (MFA) challenges, and token generation. - Application Logs: Web servers (like Nginx or IIS) log HTTP requests, response codes (like 404 Not Found or 500 Internal Server Error), and user-agent strings. The Power of SIEM Reading logs individually is inefficient. A Security Information and Event Management (SIEM) platform aggregates logs from disparate sources, normalizes them into a common format, and correlates them to identify threats. SIEMs use rules and correlation engines to connect the dots. For example, a SIEM rule might trigger an alert if it sees: Event A (Failed login attempts 5 on Windows Server) AND Event B (Successful login on same server within 2 minutes). When analyzing SIEM outputs for the exam, look for specific indicators of compromise (IOCs): - Geolocation anomalies: Logins from impossible travel distances (like the New York to Eastern Europe scenario). - Time anomalies: Administrative logins at 3:00 AM local time. - Volume anomalies: A sudden spike in outbound DNS …
7. Security Program Management and Governance
Risk Management: Assessment and Mitigation In 2013, a major US retailer suffered a breach compromising 40 million credit cards. The initial entry point wasn't a sophisticated zero-day exploit, but a third-party HVAC vendor with network access. The attackers stole the vendor's credentials, pivoted into the retailer's primary network, and installed malware on point-of-sale systems. This incident fundamentally changed how the industry views third-party risk, but it also highlights a broader truth: technical controls are useless without a governance structure to manage human and organizational risk. As we transition from the operational focus of incident response, we move to the boardroom. Security Program Management and Oversight accounts for 14% of your exam. Here, the "CompTIA mindset" shifts from technical configurations to business processes, legal obligations, and strategic planning. The Risk Management Lifecycle Risk is the probability that a threat will exploit a vulnerability to cause harm to an asset. You cannot eliminate risk entirely; you can only manage it. The risk management lifecycle is a continuous loop: 1. Identify assets and risks: What are you protecting, and what could go wrong? 2. Assess and analyze: Determine the likelihood and impact of identified risks. 3. Respond: Choose a mitigation strategy. 4. Monitor: Continuously track risks and the effectiveness of controls. Quantitative vs. Qualitative Risk Assessment Risk assessment methodologies fall into two categories, and the exam will test your ability to calculate and interpret both. Quantitative Risk Assessment uses objective, monetary values to calculate risk. You must know these formulas cold for the exam: SLE (Single Loss Expectancy): The monetary loss from a single occurrence. (SLE = Asset Value × Exposure Factor) ARO (Annualized Rate of Occurrence): How often a threat is expected to occur in a year. ALE (Annualized Loss Expectancy): The total expected loss over a year. (ALE = SLE × ARO) Scenario: A database server worth \$100,000 is located in a flood zone. If a flood occurs, 50% of the server's value is lost (Exposure Factor = 0.5). Floods historically happen once every 10 years (ARO = 0.1). SLE = \$100,000 × 0.5 = \$50,000 ALE = \$50,000 × 0.1 = \$5,000 If a mitigation control costs \$8,000 annually to maintain, it is not financially justified, because it costs more than the expected annual loss (\$5,000). Qualitative Risk Assessment uses subjective categories (like Low, Medium, High) based on experience and judgment. This is often visualized using a Risk Matrix that plots likelihood against impact. While quantitative is best for tangible assets, qualitative is frequently used for intangible assets like reputation. Risk Mitigation Strategies Once a risk is identified and assessed, management must choose how to respond. The four primary strategies are: Transfer: Shifting the risk to a third party, typically …
8. Exam Preparation and Final Review
The Final Mile: Bridging Knowledge and Execution You have spent the last seven modules building a robust mental model of cybersecurity. You understand how Cryptography and Public Key Infrastructure establishes non-repudiation. You can navigate the nuances of Identity and Access Management (IAM), dissect attacks covered in Threats, Vulnerabilities, and Attacks, and design segmented networks using the principles from Security Architecture and Network Design. You know how to execute Security Operations and Incident Response, and you can align organizational risk using Security Program Management and Governance. Knowing the material, however, is only half the battle. The CompTIA Security+ exam is a timed, high-stakes environment that tests not just your knowledge, but your test-taking execution. With a Time Limit of 90 minutes to answer a Maximum Questions count of 90, you have roughly one minute per question. To achieve the Passing Score of 750 (out of 900), you must master the exam’s unique format—particularly the dreaded performance-based questions (PBQs). Mastering Performance-Based Questions (PBQs) Performance-based questions are designed to test your hands-on, practical skills rather than just your ability to recall facts. As introduced in Exam Strategy and Core Security Principles, the best approach is to Tackle PBQs strategically. PBQs typically appear at the very beginning of the exam. They might ask you to configure a firewall, drag and drop security controls to their appropriate phases, or piece together a network architecture diagram. Because they require multiple steps, they are notorious time sinks. The PBQ Navigation Strategy When the exam begins and you are faced with your first PBQ, follow this strict protocol: 1. Assess quickly: Read the prompt and look at the interface. If you immediately know what to do, execute the task. 2. The 5-Minute Rule: If you do not instantly recognize the solution, do not panic and do not stare at the screen. Give yourself a maximum of five minutes. If you are stuck, find the "Next" button and move on. 3. Flag for review: The exam software allows you to mark questions for review. 4. Return with fresh eyes: Multiple-choice questions (MCQs) often prime your brain for the concepts tested in the PBQs. By answering the MCQs first, you might trigger your memory. You can always return to the PBQs at the end of the exam. Deconstructing PBQ Scenarios Let’s look at a common PBQ type: the drag-and-drop matching scenario. Scenario: You are presented with a list of security controls (e.g., Biometrics, Fence, Mantrap, Antivirus, IPS) and a list of security phases (Preventative, Detective, Corrective, Deterrent). You must drag each control to its correct phase. Execution: - Do not overcomplicate the scenario. CompTIA is looking for the best fit based on standard definitions. - A fence is a deterrent. …
Continue learning
- PMP Exam Prep: Complete Study Guide for 2024PMP Exam Prep: Complete Study Guide for 2024 — a free intermediate-level guide covering how to pass the pmp exam. Learn with clear explanations, real...
- CMA Medical Assistant Exam Prep: Complete Study GuideCMA Medical Assistant Exam Prep: Complete Study Guide — a free intermediate-level guide covering how to pass the cma medical assistant exam. Learn with...
- CompTIA Network+ Exam Study RoadmapCompTIA Network+ Exam Study Roadmap — a free intermediate-level guide covering how to pass the comptia network+ exam. Learn with clear explanations,...
- How to Pass the PMP Exam: Complete Study GuideHow to Pass the PMP Exam: Complete Study Guide — a free intermediate-level guide covering how to pass the pmp exam. Learn with clear explanations, real...