CompTIA Security+ Security Operations Syllabus

What are the possible vulnerability response/remediation options?

Patching, insurance, segmentation, compensating controls, applying exceptions/exemptions, and (in some cases) accepting the risk. Remediation must be validated through rescanning, audit, and verification, then documented via reporting.

What is a compensating control in vulnerability response?

A compensating control is an alternative safeguard applied when the primary remediation (like patching) cannot be immediately implemented, reducing risk to an acceptable level (e.g., isolating a vulnerable system behind a firewall).

What is the difference between a vulnerability exception and segmentation as a response?

An exception/exemption is a formally documented and approved acceptance of an unremediated vulnerability. Segmentation isolates the vulnerable system on a separate network segment to limit exposure and lateral movement.

What monitoring resources should a security team monitor?

Systems, applications, and infrastructure (the three primary resources), plus log data, network traffic, and user/account activity across them.

What is the difference between log aggregation and a SIEM?

Log aggregation collects and consolidates logs from many sources into a central location. A SIEM (Security Information and Event Management) aggregates AND correlates, alerts, and analyzes those logs in real time to detect security events.

Define scanning, archiving, alerting, and reporting in monitoring activities.

Scanning: actively probing systems for issues. Archiving: retaining logs/data for later analysis and compliance. Alerting: generating notifications when defined thresholds/conditions are met. Reporting: summarizing findings for stakeholders.

What is the difference between alert tuning and an alert threshold?

An alert threshold is the condition value that triggers an alert. Alert tuning is the ongoing process of adjusting rules/thresholds to reduce false positives and alert fatigue while keeping true detections.

What is SNMP used for, and what is the security difference between SNMPv2 and SNMPv3?

SNMP (Simple Network Management Protocol) monitors and manages network devices. SNMPv2 sends community strings in cleartext (insecure). SNMPv3 adds authentication, encryption, and message integrity.

What is NetFlow used for in monitoring?

NetFlow is a protocol that collects metadata about IP traffic flows (source/destination, ports, volume) for network traffic analysis, bandwidth monitoring, and anomaly/threat detection.

What is the difference between SIEM, SNMP traps, and NetFlow as monitoring tools?

SIEM centralizes and correlates logs/events for security analysis. SNMP traps are asynchronous alerts pushed by devices when an event occurs. NetFlow captures traffic flow metadata for volume/behavior analysis.

What are the alert response and remediation states a SOC analyst assigns to alerts?

Quarantine (isolate the threat), Alert tuning (reduce noise), and validation states such as true/false positive and true/false negative used to triage and respond to alerts.

Compare a stateless and a stateful firewall.

A stateless firewall filters each packet independently against static ACL rules. A stateful firewall tracks the state of active connections and makes decisions based on connection context, allowing return traffic for established sessions.

What is a next-generation firewall (NGFW) and how does it differ from a UTM?

An NGFW adds application-layer (Layer 7) awareness, deep packet inspection, and integrated IPS to traditional firewalling. A UTM (Unified Threat Management) bundles multiple security functions (firewall, antivirus, content filter, VPN) into one appliance.

What is a WAF and at what layer does it operate?

A Web Application Firewall (WAF) operates at Layer 7 (application layer) to filter, monitor, and block malicious HTTP/HTTPS traffic to web apps, protecting against attacks like SQL injection and XSS.

What is the difference between an IDS and an IPS?

An IDS (Intrusion Detection System) detects and alerts on malicious activity but does not block it (passive). An IPS (Intrusion Prevention System) sits inline and can actively block/drop malicious traffic (active).

Compare signature-based and anomaly-based detection.

Signature-based detection matches traffic against known attack patterns (good for known threats, misses new ones). Anomaly/behavior-based detection flags deviations from a learned baseline (can catch zero-days but produces more false positives).

What is the difference between a URL filter and a content/DNS filter in web filtering?

A URL filter blocks specific web addresses or categories. A content filter inspects page content/keywords. A DNS filter blocks resolution of malicious or disallowed domains at the DNS-query level before connection.

What is an agent-based vs agentless web filter?

An agent-based web filter installs software on each endpoint to enforce policy anywhere the device goes. An agentless (centralized proxy) filter enforces policy at a network chokepoint and only protects devices on that network.

What email security mechanisms exist, and what does each verify?

SPF verifies the sending mail server is authorized for the domain. DKIM adds a cryptographic signature verifying message integrity and origin. DMARC builds on SPF/DKIM to set policy (none/quarantine/reject) and reporting for failures.

What is an email security gateway?

An email/secure email gateway is a server or service that filters inbound and outbound email to block spam, phishing, malware, and data exfiltration before messages reach users.

What is EDR, and how does XDR extend it?

EDR (Endpoint Detection and Response) continuously monitors endpoints to detect, investigate, and respond to threats. XDR (Extended Detection and Response) correlates data across endpoints, network, email, and cloud for unified detection and response.

How does DNS filtering protect endpoints?

DNS filtering blocks DNS queries to known-malicious or policy-violating domains, preventing the device from ever connecting to phishing sites, malware C2 servers, or blocked content.

What is NAC (Network Access Control) and what does it enforce?

NAC controls which devices can connect to a network, enforcing posture/health checks (patch level, AV status, configuration) before granting access, and can quarantine non-compliant devices.

What is file integrity monitoring (FIM)?

FIM detects unauthorized changes to critical files and configurations by comparing current file states (hashes/attributes) against a known-good baseline and alerting on differences.

What are the four stages of the identity/account provisioning lifecycle?

Provisioning (create the account/identity), Permission assignment (grant appropriate access), Periodic review/attestation (verify access is still appropriate), and De-provisioning (disable/remove access when no longer needed).

Compare DAC, MAC, RBAC, and ABAC access control models.

DAC: owner sets permissions (discretionary). MAC: system enforces access via labels/clearances (mandatory, non-overridable). RBAC: access based on job role. ABAC: access based on attributes/policies (user, resource, environment conditions).

What is the principle of least privilege and how does it differ from rule-based access control?

Least privilege grants users only the minimum access needed for their job. Rule-based access control applies global if/then rules (e.g., time-of-day or ACL conditions) to all users regardless of role.

What are the three authentication factor categories, and which are combined for true MFA?

Something you know (password/PIN), something you have (token/phone), and something you are (biometric). True MFA requires factors from at least two different categories — two passwords is not MFA.

What is the difference between TOTP and HOTP?

HOTP (HMAC-based One-Time Password) generates a code from a counter that increments per use. TOTP (Time-based One-Time Password) generates a code from the current time, so it expires after a short window (e.g., 30 seconds).

What are key password policy concepts: length, complexity, reuse, expiration, and age?

Length = minimum characters (most impactful). Complexity = mix of character types. Reuse = prevents using previous passwords. Expiration = forces periodic change. Age = minimum time before a password can be changed again.

What is password spraying, and how does account lockout defend against it?

Password spraying tries a few common passwords across many accounts to avoid lockouts. Account lockout (after N failed attempts) limits guesses per account, mitigating brute-force and spraying attacks.

What is a password manager and what is passwordless authentication?

A password manager is a vault that securely stores and generates strong, unique passwords. Passwordless authentication removes passwords entirely, using factors like biometrics, hardware security keys (FIDO2/WebAuthn), or magic links.

What is PAM (Privileged Access Management) and what is just-in-time permission?

PAM secures, controls, and monitors accounts with elevated privileges. Just-in-time (JIT) permission grants elevated access only for a limited time when needed, then revokes it, minimizing standing privilege.

What is a password vault and ephemeral credential in PAM?

A password vault securely stores and rotates privileged account credentials, brokering access without revealing the password. Ephemeral credentials are temporary, single-use credentials issued for one session that expire automatically.

What are the main benefits of automation and orchestration in security operations?

Efficiency/time savings, enforcing baselines, standard infrastructure configurations, scaling securely, employee retention, reaction time, and acting as a workforce multiplier — all with consistent, repeatable execution.

What is the difference between automation and orchestration?

Automation makes a single task run without manual effort. Orchestration coordinates multiple automated tasks and tools into a unified end-to-end workflow (e.g., a SOAR playbook executing many steps across systems).

What is SOAR and how does it relate to a playbook?

SOAR (Security Orchestration, Automation, and Response) integrates tools to automate incident response. A playbook is the defined, ordered set of automated/manual steps SOAR executes to handle a specific type of incident.

What are the considerations/risks when using automation and orchestration?

Complexity, cost, single point of failure, technical debt, and ongoing supportability. Poorly designed automation can propagate errors quickly across many systems.

List the phases of the incident response process (NIST/CompTIA model).

Preparation, Detection, Analysis, Containment, Eradication, Recovery, and Lessons Learned (post-incident activity).

What is the difference between containment, eradication, and recovery?

Containment limits the spread/damage of an incident (isolate affected systems). Eradication removes the threat (malware, accounts, vulnerabilities). Recovery restores systems to normal operation and validates they are clean.

What is the difference between a tabletop exercise and a simulation in incident response?

A tabletop exercise is a discussion-based walkthrough of a scenario by the response team (low cost, no live systems). A simulation actively executes a scenario (e.g., a simulated phishing attack) to test real responses and tooling.

What are root cause analysis and threat hunting in incident response activities?

Root cause analysis identifies the underlying reason an incident occurred to prevent recurrence. Threat hunting is proactively searching networks/systems for hidden threats that evaded existing detection controls.

What is the order of volatility in digital forensics?

Collect evidence from most to least volatile: CPU registers/cache → RAM (memory) → network/routing/ARP cache → temporary files/swap → disk/storage → remote logging/archived media. Most volatile data must be captured first.

What is chain of custody and why is it critical in forensics?

Chain of custody is the documented, unbroken record of who collected, handled, transferred, and stored evidence, with times and reasons. It ensures evidence integrity and admissibility in legal proceedings.

What is legal hold and e-discovery in digital forensics?

Legal hold (preservation) is the requirement to retain potentially relevant data once litigation is anticipated. E-discovery is the process of identifying, collecting, and producing electronically stored information for legal proceedings.

Why is data acquisition order and hashing important when imaging evidence?

Forensic imaging captures a bit-for-bit copy of media, and a cryptographic hash (e.g., SHA-256) of the original and the image proves the copy is identical and unaltered, preserving evidence integrity.

What investigation data sources are used during an incident, and what does each provide?

Dashboards (summarized view), automated reports, vulnerability scans, packet captures, firewall/IDS/IPS logs, application/OS/endpoint/network logs, metadata, and vulnerability scan output — each provides evidence of activity for analysis.

What is the difference between a firewall log and an IPS/IDS log as data sources?

A firewall log records allowed/denied connections based on rules (who connected where). An IDS/IPS log records detected/blocked attack signatures or anomalies (what malicious activity was attempted), giving threat context.