CompTIA Security+ (SY0-701) Complete Course & Practice Exam

Explore the fundamentals of security, including information security vs information system security, the CIA triad and non-repudiation, authentication, authorization, and accounting, plus zero trust and security controls.

Identify how external threats and internal vulnerabilities intersect to create risk, and reduce it through mitigation, transfer, avoidance, or acceptance for cybersecurity and business continuity.

Protect information from unauthorized access by applying confidentiality to privacy, business advantage, and regulatory compliance; learn encryption, access controls, data masking, physical security, and training.

Maintain data integrity by protecting accuracy, trust, and system operability through hashing, digital signatures, checksums, access controls, and regular audits.

Ensure availability by implementing redundancy across servers, data, networks, and power to achieve up to 99.999% uptime and protect business continuity, trust, and reputation.

Non-repudiation provides undeniable proof of participation in digital transactions by using digital signatures, hash digests, and private keys to ensure authenticity, integrity, and accountability.

Authentication verifies identities in digital interactions using knowledge, possession, inherence, action, and location factors, enabling MFA to prevent unauthorized access and protect data and resources.

Authorization defines what a verified identity may do after authentication by applying role-based, rule-based, or attribute-based controls to protect data, maintain integrity, and simplify user access.

Learn how accounting in cybersecurity monitors and logs user actions to create an audit trail. It supports regulatory compliance, forensic analysis, resource optimization, and user accountability through detailed logs.

Explore how layered security controls across four broad categories: technical, managerial, operational, and physical, to protect organizations' networks, data, and assets.

Identify and apply six security control types—preventative, deterrent, detective, corrective, compensating, and directive—to strengthen organizations' defenses using examples like firewalls, IDS, antivirus, VPNs, and AUP.

Explore zero trust concepts that replace perimeter defenses with continuous verification, adaptive identities, and policy-driven access across control and data planes to secure modern, deperimeterized networks.

Identify gaps between current and desired performance, define scope, collect data, and analyze gaps to craft a plan that bridges them; cover technical and business gap analyses for security.

Explore threat actors—from unskilled attackers to nation-state actors—motivations, attributes, and threat vectors and attack surfaces, plus deception technologies like honeypots and honeytokens.

Identify threat actor motivations behind cyberattacks, including data exfiltration, financial gain, blackmail, service disruption, and espionage, to strengthen protective measures.

Compare internal and external threat actors, assess their resources and funding, and evaluate their sophistication to understand attack styles and the risk they pose to enterprises.

Explore unskilled attackers, or script kiddies, who rely on ready-made tools to target unpatched vulnerabilities, launch DDoS, deface websites, and spread malware, driven by curiosity and notoriety.

Hacktivists use hacking and cyber techniques to promote political or social causes, employing website defacement, DDoS, doxxing, and data leaks to advance their ideologies.

Explore organized cybercrime as a sophisticated, transnational threat in cyberspace, highlighting structured groups, advanced hacking, ransomware, phishing, and financial gain through operations exemplified by FIN7 and Carbanak.

Explore nation-state actors backed by governments employing advanced persistent threats, false flag tactics, and political objectives, fromStuxnet to election interference by Russia.

Explore insider threats—cyber risks from within, employees or contractors with access, including data theft and misuse of privileges, and how zero trust, access controls, audits, and security awareness mitigate them.

Shadow IT, the use of unapproved IT devices, software, and cloud services, can boost productivity but risks data breaches and non-compliance; organizations must balance innovation with secure policies.

Define threat vectors and attack surfaces, identify six vectors—messages, images, files, voice calls, removable devices, and unsecured networks—and learn how to minimize exposure to defend enterprise networks.

Outsmart threat actors by adopting a proactive defense through deception and disruption technologies, honeypots, honeynets, honeyfiles, and honeytokens, to log, monitor, and learn threat actors' TTPs and counter cyber threats.

Explore physical security concepts and controls, from fences and surveillance to access controls and badge cloning, and analyze attacks to protect buildings, people, and critical infrastructure.

Learn how fencing and bollards act as visual deterrents and physical barriers to deter, delay, and defend facilities from unauthorized access and vehicular threats.

Explore brute force attacks on physical security, from forcible entry to device tampering and vehicle ramming, and learn multi-layered defenses like reinforced windows, solid doors, and bollards.

Surveillance systems integrate video surveillance, security guards, lighting, and sensors to monitor and respond to threats. Features include motion detection, night vision, facial recognition, and PTZ cameras for real-time awareness.

Learn how attackers bypass surveillance via visual obstruction, sensor blinding, acoustics, electromagnetics, and physical environment attacks. Explore countermeasures like tamper alarms, backup power, and encrypted frequency hopping to protect organizations.

Learn how access control vestibules use a double-door, electronically controlled design to verify credentials, trap entrants, and prevent piggybacking and tailgating with badges and guards.

Explore how door locks function as a foundational physical security control, from traditional padlocks to electronic and biometric systems integrated with access control vestibules.

Explore access badge cloning in RFID and NFC, including scanning, data extraction, writing to a new card, and mitigation via encryption, MFA, shielded wallets, and log auditing.

Explore social engineering and human-based attack vectors such as phishing, impersonation, pretexting, typosquatting, and brand impersonation, and implement security awareness training and anti-phishing campaigns to prevent fraud, scams, and misinformation.

Explore how social engineers use six motivational triggers: authority, urgency, social proof, scarcity, likability, and fear to persuade users and breach security.

Learn how impersonation drives social engineering, with four forms—impersonation, brand impersonation, typosquatting, and watering hole attacks—and how training, secure gateways, and threat intelligence mitigate these threats.

Demonstrate how pretexting fuels social engineering by manipulating a receptionist to reveal printer models and IP details. Train staff to resist such calls and never disclose sensitive information.

Expose attackers' techniques across phishing, spear phishing, whaling, and business email compromise, including vishing and smishing, and learn how fraudsters harvest credentials through urgent links or attachments.

Prevent phishing attacks in enterprise networks through anti-phishing campaigns and user security awareness training, teaching users to spot urgency, unusual requests, mismatched URLs, and suspicious addresses.

Design and run a free anti-phishing campaign with phish insights, sending LinkedIn-like emails to test users, track clicks, and deliver remedial training to those who fall for it.

Explore how fraud and scams use social engineering to steal information or money, including identity fraud and invoice scams, pretexting, and steps to prevent them.

Investigate influence campaigns and how misinformation and disinformation shape public opinion and elections. Identify strategies to combat malicious campaigns by nation-state actors and safeguard trust across social platforms.

Explore social engineering attacks such as diversion theft, hoaxes, shoulder surfing, dumpster diving, eavesdropping, baiting, and piggybacking, plus DNS spoofing and brand impersonation tactics.

Explore how malware, the malicious software, infiltrates systems via threat vectors and attack vectors, covering viruses, worms, trojans, ransomware, spyware, rootkits, and indicators of malicious activity.

Explore how viruses deploy malicious code to infect systems, spread via user actions, and include ten types—from boot sector to hoax—evading detection.

Examine how worms self-replicate and spread by exploiting unpatched vulnerabilities, highlighting the need for patching and security controls to prevent botnets, as Nimda and Conficker show rapid, global exploitation.

Explore Trojan malware, its history as the Trojan horse, and how disguised software can grant remote access via RAT, cause data exfiltration, and create backdoors, with antivirus and patching defenses.

Showcases how viruses and remote access trojans function in a lab with vulnerable Windows 7 machines. Explore infection, social engineering, and RAT capabilities like system info and screenshots.

Explore ransomware, its impact on data and infrastructure, and implement four security best practices: regular backups, software updates, security awareness training, and multi-factor authentication.

Explore how botnets and zombies form networks controlled by a command and control node to launch DDoS attacks, crypto mining, and encryption attacks across compromised devices.

Understand rootkits' pursuit of administrative or root access, their movement from ring three to ring zero, and their use of DLL injection and shims to hide from detection.

Learn how backdoors bypass security and why they are harmful, examine logic bombs and Easter eggs, and see how remote access trojans function as modern backdoors.

Discover how software and hardware keyloggers covertly record keystrokes to steal usernames, passwords, and data, and defend with patches, antivirus, phishing awareness, mfa, keystroke encryption, and physical checks.

Explore spyware and bloatware, how malicious and unwanted software invade devices, how they affect privacy and performance, and practical steps to remove them and secure systems.

Explain malware exploitation techniques, from file-based and fileless attacks to memory execution and concealment, detailing stage-one droppers, stage-two downloaders, remote access trojans, and living off the land.

Identify indicators of malware attacks, including account lockouts, concurrent session utilization, blocked content, impossible travel, resource consumption, inaccessibility, out-of-cycle logging, missing logs, and published or documented attacks, to enable response.

Explore data protection as a core information security practice, safeguarding data confidentiality, integrity, and availability through classifications, ownership roles, data states, and methods like encryption and tokenization.

Define data classifications and assign a data owner to set sensitivity levels from public to confidential and critical. Build data lifecycle policies for storage, retention, and disposal aligned with laws.

Identify data ownership: a senior executive data owner labels and protects information assets to uphold confidentiality, integrity, availability, and privacy; data controller, processor, steward, custodian, and privacy officer govern.

Learn the three data states—at rest, in transit, and in use—and apply encryption with SSL/TLS, VPN, and IPSec, plus access controls to protect data.

Learn about regulated data and data types like PII, PHI, trade secrets, and IP, and how GDPR, HIPAA, and PCI DSS guide their protection.

Examine data sovereignty and the laws governing data stored or processed across borders, including GDPR implications for EU citizens and cross-border data transfers in cloud computing.

secure data by applying geofencing, encryption, hashing, masking, tokenization, obfuscation, segmentation, and role-based access control (rbac) to reduce breach risk.

Protect your data with data loss prevention (DLP) by monitoring data in use, in transit, and at rest, and enforcing policies across endpoint, network, storage, and cloud.

Configure data loss prevention in Google Workspace to protect Drive, Chat, and Gmail using setup wizards, predefined rules, and custom rules with scope, alerts, and blocking.

Explore how encryption protects data at rest, in transit, and in use, compare symmetric and asymmetric algorithms, hashing, PKI, and key management.

Compare symmetric and asymmetric encryption, highlighting shared secret keys and public-key cryptography, key distribution challenges, and the hybrid approach that balances speed with secure key exchange.

Identify and compare symmetric algorithms such as DES, 3DES, IDEA, AES, Blowfish, Twofish, and RC4/RC5/RC6, noting key sizes, block types, and AES as the most commonly used and strongest standard.

Explore asymmetric algorithms and public key cryptography, using public/private keys to enable confidentiality, integrity, authentication, non-repudiation, and digital signatures with hash digests, including Diffie-Hellman, RSA, and ECC.

Explains hashing as a one-way function that produces a fixed-length message digest, acting as a digital fingerprint to verify integrity and enable non-repudiation through digital signatures.

Explore how to harden password storage against pass-the-hash and birthday attacks by using key stretching, salting, and nonces, adopting sha-256 over md5, and limiting failed login attempts.

Explore how PKI uses certificate authorities and asymmetric encryption to enable secure TLS/SSL communications, build authentication, and protect data through digital keys and certificates.

Learn how digital certificates secure identities with X.509 PKI, covering wildcard and SAN certificates, root of trust, CA roles, CSR, CRL, OCSP, and OCSP stapling.

Explore digital certificates for Google.com and Apple.com over https, comparing 256-bit ECC and 2048-bit RSA public key certificates, including issuers and subject details.

Explore how blockchain functions as a shared, immutable ledger that records transactions, enables smart contracts, and supports transparent, trust-driven, permissioned and public networks, including cryptocurrencies, across industries.

Explore encryption tools like the trusted platform module, hardware security module, key management systems, and secure enclaves that protect data across enterprise networks and platforms.

Explore obfuscation techniques like steganography, tokenization, and data masking to hide data in plain sight and reduce risk without encryption, with real-world lab demonstrations.

Explore cryptographic attacks, including downgrade and collision attacks, and examine the looming quantum computing threat and post-quantum cryptography standards like Kyber, Dilithium, Falcon, and SPHINCS+.

Explore the risk management lifecycle including identification, analysis, treatment, monitoring, and reporting, and learn qualitative and quantitative analysis, strategies, and metrics like recovery time objective and mean time to repair.

Explore how risk assessment frequency varies by organization and context, covering ad-hoc, recurring, one-time, and continuous assessments and how each supports proactive risk management.

Identify potential risks and vulnerabilities to guide risk management and continuity planning; apply RTO, RPO, MTTR, and MTBF in a business impact analysis.

Identify and manage uncertainties with a risk register, detailing description, impact, likelihood, outcome, level, and cost. Align these risks with risk appetite, tolerance, and KRIs, and assign risk owners.

Explore qualitative risk analysis in project risk management. Evaluate likelihood and impact to categorize risks as high, medium, or low, guided by expert judgment and avoiding quantitative methods.

Explore how quantitative risk analysis uses numerical measurements to assess risk, detailing SLE, ARO, ALE, and EF, and applying them to financial, safety, and scheduling decisions.

Explores four risk management strategies including transfer, accept, avoid, and mitigate, with examples of insurance, indemnity clauses, exemptions, and exceptions to reduce losses and protect reputation.

Monitor and report risk throughout the project lifecycle, tracking residual and control risks and evaluating risk response effectiveness. Share risk reports with stakeholders to support informed decisions and regulatory compliance.

Explore third party vendor risks and supply chain threats, covering threat vectors, attack surfaces, vulnerabilities, risk assessment, vendor evaluations, audits, and contracts such as service level agreements.

Examine supply chain risks across hardware, software, and service providers. Learn to assess origins, integrity, and vulnerabilities to protect enterprise networks.

Examine supply chain attacks, including counterfeit hardware, rootkits, and SolarWinds, and learn four safeguards—vendor due diligence, monitoring, education, and contractual safeguards—to strengthen supply chains.

Conduct vendor assessments to evaluate security, reliability, and performance of vendors, suppliers, and MSPs; include penetration testing, contract audit rights, internal audits, independent third-party validation, and supply chain analysis.

Select the right vendor through due diligence, assess financial stability, conflicts of interest, and environmental practices, then monitor performance and use feedback loops to sustain alignment with organizational objectives.

Explore how contracts and agreements establish trust and define rights, obligations, and boundaries across basic contracts, SLAs, MOAs, MOUs, MSAs, SOWs, NDAs, and BPAs.