CompTIA® Security+™ SY0-401 Exam Cram, Fourth Edition

CompTIA® Security+™ SY0-401 Exam Cram, Fourth Edition

by Diane Barrett, Martin Weiss, Kirk Hausman
Released March 2015
Publisher(s): Pearson IT Certification
ISBN: 9780133836455

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

The Publisher regrets that the CD/DVD content for this title cannot be made available Online.

CompTIA® Security+ Exam Cram, Fourth Edition, is the perfect study guide to help you pass CompTIA’s newly updated version of the Security+ exam. It provides coverage and practice questions for every exam topic. The book contains a set of 200 questions in two full practice exams.

Covers the critical information you need to know to score higher on your Security+ exam!

--Categorize types of attacks, threats, and risks to your systems

--Secure devices, communications, and network infrastructure

-- Troubleshoot issues related to networking components

-- Effectively manage risks associated with a global business environment

-- Differentiate between control methods used to secure the physical domain

-- Identify solutions to secure hosts, data, and applications

-- Compare techniques to mitigate risks in static environments

-- Determine relevant access control, authorization, and authentication procedures

-- Select appropriate mitigation techniques in response to attacks and vulnerabilities

-- Apply principles of cryptography and effectively deploy related solutions

--Implement security practices from both a technical and an organizational standpoint

Table of contents

  1. About This eBook
  2. Title Page
  3. Copyright Page
  4. Contents at a Glance
  5. Contents
  6. About the Authors
  7. Dedication
  8. Acknowledgments
  9. We Want to Hear from You!
  10. Reader Services
  11. CompTIA®
  12. Introduction
    1. Taking a Certification Exam
    2. About This Book
    3. Chapter Format and Conventions
    4. Additional Elements
    5. Exam Objectives
    6. Accessing the Pearson Test Prep Software and Questions
    7. Accessing the Pearson Test Prep Software Online
    8. Accessing the Pearson Test Prep Software Offline
    9. Premium Edition
  13. Part I: Network Security
    1. Chapter 1. Secure Network Design
      1. Implement Security Configuration Parameters on Network Devices and Other Technologies
        1. Firewalls
        2. Routers
        3. Switches
        4. Load Balancers
        5. Proxies
        6. Web Security Gateways
        7. VPN Concentrators
        8. NIDS and NIPS
        9. Protocol Analyzers
        10. Spam Filter
        11. UTM Security Appliances
        12. Web Application Firewall Versus Network Firewall
        13. Application-Aware Devices
        14. Cram Quiz
        15. Cram Quiz Answers
      2. Given a Scenario, Use Secure Network Administration Principles
        1. Rule-Based Management
        2. Firewall Rules
        3. VLAN Management
        4. Secure Router Configuration
        5. Access Control Lists
        6. Port Security
        7. 802.1X
        8. Flood Guards
        9. Loop Protection
        10. Implicit Deny
        11. Network Separation
        12. Log Analysis
        13. Unified Threat Management
        14. Cram Quiz
        15. Cram Quiz Answers
      3. Explain Network Design Elements and Components
        1. DMZ
        2. Subnetting
        3. VLAN
        4. NAT
        5. Remote Access
        6. Telephony
        7. NAC
        8. Virtualization
        9. Cloud Computing
        10. Layered Security/Defense in Depth
        11. Cram Quiz
        12. Cram Quiz Answers
      4. What Next?
    2. Chapter 2. Network Implementation
      1. Given a Scenario, Implement Common Protocols and Services
        1. Protocols
        2. Ports
        3. OSI Relevance
        4. Cram Quiz
        5. Cram Quiz Answers
      2. Given a Scenario, Troubleshoot Security Issues Related to Wireless Networking
        1. WPA
        2. WPA2
        3. WEP
        4. EAP
        5. PEAP
        6. LEAP
        7. MAC Filter
        8. Disable SSID Broadcast
        9. TKIP
        10. CCMP
        11. Antenna Placement
        12. Power-Level Controls
        13. Captive Portals
        14. Antenna Types
        15. Site Surveys
        16. VPN (Over Open Wireless)
        17. Cram Quiz
        18. Cram Quiz Answers
      3. What Next?
  14. Part II: Compliance and Operational Security
    1. Chapter 3. Risk Management
      1. Explain the Importance of Risk-Related Concepts
        1. Control Types
        2. False Positives
        3. False Negatives
        4. Importance of Policies in Reducing Risk
        5. Risk Calculation
        6. Qualitative Versus Quantitative Measures
        7. Vulnerabilities
        8. Threat Vectors
        9. Probability/Threat Likelihood
        10. Risk-Avoidance, Transference, Acceptance, Mitigation, Deterrence
        11. Risks Associated with Cloud Computing and Virtualization
        12. Recovery Time Objective and Recovery Point Objective
        13. Cram Quiz
        14. Cram Quiz Answers
      2. Summarize the Security Implications of Integrating Systems and Data with Third Parties
        1. On-Boarding/Off-Boarding Business Partners
        2. Social Media Networks and/or Applications
        3. Interoperability Agreements
        4. Privacy Considerations
        5. Risk Awareness
        6. Unauthorized Data Sharing
        7. Data Ownership
        8. Data Backups
        9. Follow Security Policy and Procedures
        10. Review Agreement Requirements to Verify Compliance and Performance Standards
        11. Cram Quiz
        12. Cram Quiz Answers
      3. Given a Scenario, Implement Appropriate Risk Mitigation Strategies
        1. Change Management
        2. Incident Management
        3. User Rights and Permissions Reviews
        4. Perform Routine Audits
        5. Enforce Policies and Procedures to Prevent Data Loss or Theft
        6. Enforce Technology Controls
        7. Cram Quiz
        8. Cram Quiz Answers
      4. Given a Scenario, Implement Basic Forensic Procedures
        1. Order of Volatility
        2. Capture System Image
        3. Network Traffic and Logs
        4. Capture Video
        5. Record Time Offset
        6. Take Hashes
        7. Screenshots
        8. Witnesses
        9. Track Man-Hours and Expense
        10. Chain of Custody
        11. Big Data Analysis
        12. Cram Quiz
        13. Cram Quiz Answers
      5. Summarize Common Incident Response Procedures
        1. Preparation
        2. Incident Identification
        3. Escalation and Notification
        4. Mitigation Steps
        5. Lessons Learned
        6. Reporting
        7. Recovery/Reconstitution Procedures
        8. First Responder
        9. Incident Isolation
        10. Data Breach
        11. Damage and Loss Control
        12. Cram Quiz
        13. Cram Quiz Answers
      6. What Next?
    2. Chapter 4. Response and Recovery
      1. Explain the Importance of Security-Related Awareness and Training
        1. Security Policy Training and Procedures
        2. Role-Based Training
        3. Personally Identifiable Information
        4. Information Classification
        5. Public
        6. Data Labeling, Handling, and Disposal
        7. Compliance with Laws, Best Practices, and Standards
        8. User Habits
        9. New Threats and New Security Trends/Alerts
        10. Use of Social Networking and Peer-to-Peer Services
        11. Follow Up and Gather Training Metrics to Validate Compliance and Security Posture
        12. Cram Quiz
        13. Cram Quiz Answers
      2. Compare and Contrast Physical and Environmental Controls
        1. Environmental Controls
        2. Physical Security
        3. Control Types
        4. Cram Quiz
        5. Cram Quiz Answers
      3. Summarize Risk Management Best Practices
        1. Business Continuity Concepts
        2. Fault Tolerance
        3. Disaster Recovery Concepts
        4. Cram Quiz
        5. Cram Quiz Answers
      4. Given a Scenario, Select the Appropriate Control to Meet the Goals of Security
        1. Confidentiality
        2. Integrity
        3. Availability
        4. Safety
        5. Cram Quiz
        6. Cram Quiz Answers
      5. What Next?
  15. Part III: Threats and Vulnerabilities
    1. Chapter 5. Attacks
      1. Explain Types of Malware
        1. Adware
        2. Viruses
        3. Worms
        4. Spyware
        5. Trojan Horses
        6. Rootkits
        7. Backdoors
        8. Logic Bombs
        9. Botnets
        10. Ransomware
        11. Polymorphic Malware
        12. Armored Virus
        13. Cram Quiz
        14. Cram Quiz Answers
      2. Summarize Various Types of Attacks
        1. Man-in-the-Middle
        2. Denial of Service
        3. Distributed DoS
        4. Replay
        5. DNS Poisoning
        6. ARP Poisoning
        7. Spoofing
        8. Spam
        9. Phishing and Related Attacks
        10. Privilege Escalation
        11. Malicious Insider Threat
        12. Transitive Access and Client-Side Attacks
        13. Password Attacks
        14. Typo Squatting/URL Hijacking
        15. Watering Hole Attack
        16. Cram Quiz
        17. Cram Quiz Answers
      3. Summarize Social Engineering Attacks and the Associated Effectiveness with Each Attack
        1. Social Engineering
        2. Shoulder Surfing
        3. Dumpster Diving
        4. Tailgating
        5. Impersonation
        6. Hoaxes
        7. Principles (Reasons for Effectiveness)
        8. Cram Quiz
        9. Cram Quiz Answers
      4. Explain Types of Wireless Attacks
        1. Jamming/Interference
        2. Rogue Access Points
        3. War Driving
        4. Bluejacking/Bluesnarfing
        5. Packet Sniffing
        6. WEP/WPA Attacks
        7. WPS Attacks
        8. Near-Field Communication
        9. Cram Quiz
        10. Cram Quiz Answers
      5. Explain Types of Application Attacks
        1. Browser Threats
        2. Code Injections
        3. Directory Traversal
        4. Header Manipulation
        5. Zero-Day
        6. Buffer Overflows
        7. Integer Overflows
        8. Cookies
        9. Arbitrary/Remote Code Execution
        10. Cram Quiz
        11. Cram Quiz Answers
      6. What Next?
    2. Chapter 6. Deterrents
      1. Analyze a Scenario and Select the Appropriate Type of Mitigation and Deterrent Techniques
        1. Monitoring System Logs
        2. Hardening
        3. Network Security
        4. Security Posture
        5. Reporting
        6. Detection Controls Versus Prevention Controls
        7. Cram Quiz
        8. Cram Quiz Answers
      2. Given a Scenario, Use Appropriate Tools and Techniques to Discover Security Threats and Vulnerabilities
        1. Interpret Results of Security Assessment Tools
        2. Tools
        3. Risk Calculation
        4. Assessment Technique
        5. Cram Quiz
        6. Cram Quiz Answers
      3. Explain the Proper Use of Penetration Testing Versus Vulnerability Scanning
        1. Penetration Testing
        2. Vulnerability Scanning
        3. Testing
        4. Cram Quiz
        5. Cram Quiz Answers
      4. What Next?
  16. Part IV: Application, Data, and Host Security
    1. Chapter 7. Application Security
      1. Explain the Importance of Application Security Controls and Techniques
        1. Fuzzing
        2. Secure Coding Concepts
        3. Cross-Site Scripting Prevention
        4. Cross-Site Request Forgery Prevention
        5. Application Configuration Baseline (Proper Settings)
        6. Application Hardening
        7. Application Patch Management
        8. NoSQL Databases Versus SQL Databases
        9. Server-Side Versus Client-Side Validation
        10. Cram Quiz
        11. Cram Quiz Answers
      2. What Next?
    2. Chapter 8. Host Security
      1. Summarize Mobile Security Concepts and Technologies
        1. Device Security
        2. Application Security
        3. BYOD Concerns
        4. Cram Quiz
        5. Cram Quiz Answers
      2. Given a Scenario, Select the Appropriate Solution to Establish Host Security
        1. Operating System Security and Settings
        2. OS Hardening
        3. Anti-malware
        4. Patch Management
        5. White Listing Versus Black Listing Applications
        6. Trusted OS
        7. Host-Based Firewalls
        8. Host-Based Intrusion Detection
        9. Hardware Security
        10. Host Software Baselining
        11. Virtualization
        12. Cram Quiz
        13. Cram Quiz Answers
      3. What Next?
    3. Chapter 9. Data Security
      1. Implement the Appropriate Controls to Ensure Data Security
        1. Cloud Storage
        2. SAN
        3. Handling Big Data
        4. Data Encryption
        5. Hardware-Based Encryption Devices
        6. Data In-Transit, Data At-Rest, Data In-Use
        7. Permissions/ACL
        8. Data Policies
        9. Cram Quiz
        10. Cram Quiz Answers
      2. Compare and Contrast Alternative Methods to Mitigate Security Risks in Static Environments
        1. Environments
        2. Methods
        3. Cram Quiz
        4. Cram Quiz Answers
      3. What Next?
  17. Part V: Access Control and Identity Management
    1. Chapter 10. Authentication, Authorization, and Access Control
      1. Compare and Contrast the Function and Purpose of Authentication Services
        1. RADIUS
        2. TACACS+
        3. Kerberos
        4. LDAP
        5. XTACACS
        6. SAML
        7. Secure LDAP
        8. Cram Quiz
        9. Cram Quiz Answers
      2. Given a Scenario, Select the Appropriate Authentication, Authorization, or Access Control
        1. Identification Versus Authentication Versus Authorization
        2. Authorization
        3. Authentication
        4. Authentication Factors
        5. Identification
        6. Federation
        7. Transitive Trust/Authentication
        8. Cram Quiz
        9. Cram Quiz Answers
      3. What Next?
    2. Chapter 11. Account Management
      1. Install and Configure Security Controls When Performing Account Management, Based on Best Practices
      2. Mitigate Issues Associated with Users with Multiple Account/Roles and/or Shared Accounts
      3. Account Policy Enforcement
      4. Group-Based Privileges
      5. User-Assigned Privileges
      6. User Access Reviews
      7. Continuous Monitoring
      8. Cram Quiz
      9. Cram Quiz Answers
      10. What Next?
  18. Part VI: Cryptography
    1. Chapter 12. Cryptography Tools and Techniques
      1. Given a Scenario, Utilize General Cryptography Concepts
        1. Symmetric Versus Asymmetric
        2. Elliptic Curve and Quantum Cryptography
        3. In-Band Versus Out-of-Band Key Exchange
        4. Session Keys
        5. Transport Encryption
        6. Nonrepudiation and Digital Signatures
        7. Hashing
        8. Key Escrow
        9. Steganography
        10. Use of Proven Technologies
        11. Cram Quiz
        12. Cram Quiz Answers
      2. Given a Scenario, Use Appropriate Cryptographic Methods
        1. Wireless Encryption Functions
        2. Cryptographic Hash Functions
        3. HMAC
        4. Symmetric Encryption Algorithms
        5. Asymmetric Encryption Algorithms
        6. One-Time Pads
        7. PGP
        8. Use of Algorithms with Transport Encryption
        9. Cipher Suites
        10. Key Stretching
        11. Cram Quiz
        12. Cram Quiz Answers
      3. What Next?
    2. Chapter 13. Public Key Infrastructure
      1. Given a Scenario, Use Appropriate PKI, Certificate Management, and Associated Components
        1. Public Key Infrastructure Standards
        2. PKI
        3. Certificate Policies
        4. Public and Private Key Usage
        5. Revocation
        6. Trust Models
        7. Cram Quiz
        8. Cram Quiz Answers
      2. What Next?
  19. Practice Exam 1: CompTIA Security+ SY0-401
    1. Exam Questions
    2. Answers at a Glance
    3. Answers with Explanations
  20. Index
  21. Practice Exam 2: CompTIA Security+ SY0-401
    1. Exam Questions
    2. Answers at a Glance
    3. Answers with Explanations
  22. Glossary
  23. Exam CRAM: The CompTIA Security+ Cram Sheet
    1. Domain 1.0: Network Security
    2. Domain 2.0: Compliance and Operational Security
    3. Domain 3.0: Threats and Vulnerabilities
    4. Domain 4.0: Application, Data and Host Security
    5. Domain 5.0: Access Control and Identity Management
    6. Domain 6.0: Cryptography
  24. Code Snippets

Product information

  • Title: CompTIA® Security+™ SY0-401 Exam Cram, Fourth Edition
  • Author(s): Diane Barrett, Martin Weiss, Kirk Hausman
  • Release date: March 2015
  • Publisher(s): Pearson IT Certification
  • ISBN: 9780133836455