CompTIA Security+ Security Operations Syllabus

Security Operations syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Operations in CompTIA Security+, not a summary of it.

1. 1

   Applying Security Techniques to Computing Resources

   5 topics

   • Secure Baselines
     • Establishing baselines
     • Deploying and maintaining baselines
   • Hardening Targets
     • Mobile devices, workstations, servers
     • Switches, routers, cloud infrastructure
     • ICS/SCADA, IoT, embedded, RTOS
   • Mobile Solutions
     • Mobile device management (MDM)
     • Deployment models: BYOD, COPE, CYOD
     • Connection methods: cellular, Wi-Fi, Bluetooth
   • Wireless Security Settings
     • WPA3 and AAA/RADIUS
     • Cryptographic protocols and authentication protocols
   • Application Security
     • Input validation and secure cookies
     • Static and dynamic code analysis
     • Code signing and sandboxing
2. 2

   Asset and Vulnerability Management

   4 topics

   • Asset Management
     • Acquisition/procurement and assignment/accounting
     • Monitoring/asset tracking and inventory
     • Disposal/decommissioning: sanitization, destruction, retention
   • Vulnerability Identification
     • Vulnerability scans and application security testing
     • Threat feeds: OSINT, dark web, ISACs
     • Penetration testing and bug bounty
   • Analysis and Prioritization
     • CVSS and CVE
     • Vulnerability classification and exposure factor
     • False positives/negatives
   • Vulnerability Response and Remediation
     • Patching, insurance, segmentation
     • Compensating controls and exceptions/exemptions
     • Validation of remediation and reporting
3. 3

   Security Monitoring and Alerting

   4 topics

   • Monitoring Resources
     • Systems, applications, infrastructure
   • Monitoring Activities
     • Log aggregation and alerting
     • Scanning, reporting, archiving
   • Monitoring Tools
     • SIEM and SCAP
     • Antivirus, DLP, SNMP traps
     • NetFlow and vulnerability scanners
   • Alert Response and Remediation
     • Quarantine and alert tuning
     • Validation and reporting
4. 4

   Enhancing Enterprise Security Capabilities

   5 topics

   • Firewall and Filtering
     • Rules, access lists, ports/protocols
     • Screened subnets
   • IDS/IPS and Web Filtering
     • Signatures and trends
     • Content/URL filtering, agent-based, centralized proxy
     • Block rules and reputation
   • Email Security
     • DKIM, SPF, DMARC
     • Email gateway and security
   • Endpoint Detection and DNS Filtering
     • EDR and XDR
     • DNS filtering
   • Network Access and File Integrity
     • Network access control (NAC)
     • File integrity monitoring
     • User behavior analytics
5. 5

   Identity and Access Management

   5 topics

   • Provisioning and Identity
     • Provisioning/de-provisioning user accounts
     • Identity proofing and federation
     • Single sign-on: LDAP, OAuth, SAML
   • Access Controls
     • Mandatory and discretionary
     • Role-based, rule-based, attribute-based
     • Time-of-day and least privilege
   • Multifactor Authentication
     • Factors: something you know/have/are, somewhere you are
     • Implementations: biometrics, hard/soft tokens, security keys
   • Password Concepts
     • Password best practices: length, complexity, reuse, age
     • Password managers and passwordless
   • Privileged Access Management
     • Just-in-time permissions
     • Password vaulting and ephemeral credentials
6. 6

   Automation and Incident Response

   5 topics

   • Automation and Orchestration
     • Use cases: ticket creation, onboarding, security groups
     • Benefits: efficiency, baseline enforcement, reaction time
     • Considerations: complexity, cost, technical debt
   • Incident Response Process
     • Preparation and detection
     • Analysis and containment
     • Eradication, recovery, lessons learned
   • Incident Response Activities
     • Training and testing (tabletop, simulation)
     • Root cause analysis and threat hunting
   • Digital Forensics
     • Legal hold and chain of custody
     • Acquisition and preservation
     • E-discovery and reporting
   • Investigation Data Sources
     • Log data: firewall, application, endpoint, OS
     • Vulnerability scans, packet captures, dashboards

Security Operations flashcards for CompTIA Security+

22 of 68 cards from the Security Operations deck — real questions with worked answers.

1. What is a secure baseline, and what are its three lifecycle stages?

   A secure baseline is a documented, standardized minimum security configuration for a system or device. Its three stages are: Establish (define the secure config), Deploy (apply it to systems), and Maintain (update it as threats and requirements change).

2. What does 'hardening' a system mean?

   Hardening is reducing a system's attack surface by removing unnecessary software, services, and accounts, closing unused ports, disabling default credentials, and applying patches and secure configurations.

3. List common hardening targets an organization must secure.

   Workstations, servers, mobile devices, switches, routers, cloud infrastructure, ICS/SCADA systems, embedded systems, RTOS, and IoT devices.

4. Compare MDM, MAM, and UEM in mobile device management.

   MDM (Mobile Device Management) controls the whole device. MAM (Mobile Application Management) controls only specific managed apps/data. UEM (Unified Endpoint Management) manages all endpoint types (mobile, desktop, IoT) from a single platform.

5. Compare BYOD, COPE, COBO, and CYOD mobile deployment models.

   BYOD: employee-owned device used for work. COPE: company-owned, personally enabled (org owns, personal use allowed). COBO: company-owned, business only. CYOD: employee chooses from a company-approved list of devices the company owns.

6. Which cellular/connection methods are relevant to mobile security, and what risk does each carry?

   Cellular, Wi-Fi, and Bluetooth. Cellular can be intercepted via rogue base stations; Wi-Fi is vulnerable to eavesdropping/rogue APs; Bluetooth is vulnerable to bluejacking, bluesnarfing, and bluebugging at short range.

7. Compare WPA2 and WPA3, including their respective handshake/encryption methods.

   WPA2 uses AES-CCMP with a 4-way handshake (PSK) vulnerable to offline dictionary attacks. WPA3 uses SAE (Simultaneous Authentication of Equals / Dragonfly handshake) providing forward secrecy and protection against offline cracking, plus GCMP encryption.

8. In WPA Enterprise, what are the roles of the supplicant, authenticator, and authentication server?

   Supplicant = the client device requesting access. Authenticator = the AP/switch that forwards credentials. Authentication server = the RADIUS server that validates credentials. This is the 802.1X framework.

9. What is the difference between EAP-TLS, EAP-TTLS, and PEAP?

   EAP-TLS requires certificates on both server and client (mutual auth, strongest). EAP-TTLS requires only a server certificate and tunnels client credentials. PEAP also uses a server certificate to create a TLS tunnel protecting an inner authentication method like MSCHAPv2.

10. What are input validation, secure cookies, and code signing in application security?

    Input validation checks/sanitizes user input to prevent injection attacks. Secure cookies use flags (Secure, HttpOnly) to protect session data. Code signing uses a digital signature to verify software author and integrity before execution.

11. What is the difference between SAST and DAST?

    SAST (Static Application Security Testing) analyzes source code without running it (white-box, early in SDLC). DAST (Dynamic Application Security Testing) tests a running application from the outside (black-box, finds runtime/environment flaws).

12. What is sandboxing in the context of application security?

    Sandboxing runs code or applications in an isolated environment with restricted access to system resources, so untrusted or new software can be tested or executed without affecting the host system.

13. What is the purpose of asset management, and what are the acquisition and disposal stages?

    Asset management tracks ownership, classification, and lifecycle of assets. Acquisition/procurement establishes ownership and assigns the asset; disposal/decommissioning includes sanitization, destruction, certification, and data retention compliance before retirement.

14. What are the main media sanitization methods and their effects?

    Clearing (overwrite, reusable), Purging/degaussing (stronger removal via overwriting or magnetic field, may render media unusable), and Destruction (shredding, pulverizing, incinerating, melting — physically destroys media).

15. What are the main methods of vulnerability identification?

    Vulnerability scans, application security testing (SAST/DAST), penetration testing, responsible disclosure / bug bounty programs, threat intelligence feeds (OSINT, dark web), and system/process audits.

16. What is the difference between a credentialed and non-credentialed vulnerability scan?

    A credentialed scan logs in with valid account credentials to inspect the system from the inside (more thorough, fewer false positives). A non-credentialed scan tests from the outside without login, simulating an attacker's external view.

17. Differentiate a false positive, false negative, true positive, and true negative in scanning.

    True positive: a real vulnerability correctly reported. False positive: a vulnerability reported that doesn't actually exist. True negative: correctly reporting no vulnerability. False negative: a real vulnerability missed/not reported (most dangerous).

18. What does CVE stand for, and what does CVSS measure?

    CVE = Common Vulnerabilities and Exposures, a unique identifier for a publicly known vulnerability. CVSS = Common Vulnerability Scoring System, a 0–10 numeric severity score used to prioritize remediation.

19. What are the CVSS severity rating bands?

    None: 0.0; Low: 0.1–3.9; Medium: 4.0–6.9; High: 7.0–8.9; Critical: 9.0–10.0.

20. What factors are used to prioritize vulnerabilities beyond CVSS score?

    Exposure factor, environmental variables, industry/organizational impact, risk tolerance, asset criticality/classification, and whether the vulnerability is actively exploited in the wild (e.g., on CISA's KEV catalog).

21. What are the possible vulnerability response/remediation options?

    Patching, insurance, segmentation, compensating controls, applying exceptions/exemptions, and (in some cases) accepting the risk. Remediation must be validated through rescanning, audit, and verification, then documented via reporting.

22. What is a compensating control in vulnerability response?

    A compensating control is an alternative safeguard applied when the primary remediation (like patching) cannot be immediately implemented, reducing risk to an acceptable level (e.g., isolating a vulnerable system behind a firewall).

See more Security Operations flashcards →

Planning Security Operations for CompTIA Security+

Security Operations (CompTIA Security+) FAQ