CompTIA Security+ Foundations Course

CompTIA Security+ expects you to recognize how attackers operate before you choose a defense. Threat actors range from organized criminals and nation-state groups to insiders and hacktivists; each has different goals, resources, and persistence.

Malware categories include viruses, worms, trojans, ransomware, spyware, and rootkits. Social engineering is just as dangerous: phishing, spear phishing, pretexting, baiting, and tailgating exploit human trust rather than technical flaws. Common network attacks include denial-of-service, man-in-the-middle, replay, and credential-based attacks such as brute force and password spraying.

Learn to associate each attack with its primary goal. Ransomware seeks payment, spyware seeks data collection, and DDoS seeks availability loss. This goal-based view helps you choose the most relevant prevention and detection control.

Attack pattern drill: recognize malware types and social engineering tactics, then map a defense to each. For example, phishing needs email filtering and user training; ransomware needs backups, patching, and least privilege.

A vulnerability is a weakness that a threat can exploit; risk is the likelihood and impact of that exploitation. Security assessments identify weaknesses before attackers do. Vulnerability scans compare systems against known signatures and configuration checks, while penetration tests actively attempt to exploit weaknesses under controlled rules.

Use frameworks such as CVSS to score severity, then apply risk treatment options: mitigate, transfer, accept, or avoid. Controls can be preventive, detective, or corrective. Patch management, secure configuration baselines, and ongoing scanning reduce the window of exposure between discovery and remediation.

For the exam, focus on the difference between a vulnerability scan and a penetration test, and on how residual risk remains after controls are applied.

Risk process drill: identify assets and threats, assess likelihood and impact, score severity, then choose mitigate, transfer, accept, or avoid. Use vulnerability scans and penetration tests to find weaknesses before attackers do.

Cryptography protects confidentiality, integrity, authentication, and non-repudiation. Symmetric encryption is fast and uses one shared key; asymmetric encryption uses a public and private key pair, making key exchange and digital signatures possible. Hashing creates a fixed-size fingerprint that detects changes, and digital signatures combine hashing with a private key.

Identity and access management (IAM) controls who can access what. Authentication verifies identity using something you know, have, or are; multi-factor authentication combines at least two factors. Authorization then applies least privilege, role-based access control (RBAC), and conditional access.

For Security+, understand when each cryptographic method is appropriate: TLS uses asymmetric encryption to establish a session and symmetric encryption for bulk data; hashes are used for password storage and integrity checks; certificates bind public keys to identities through a public key infrastructure (PKI).

Control selection: use symmetric encryption for speed, asymmetric for key exchange and signatures, hashing for integrity, and MFA for authentication. Apply least privilege and review accounts regularly to limit damage.

Network security relies on layered controls: firewalls filter traffic, intrusion detection and prevention systems monitor suspicious activity, and network segmentation limits lateral movement. A demilitarized zone (DMZ) exposes selected services while keeping internal systems protected. VPNs and secure remote access protect data in transit.

Endpoint security extends protection to desktops, laptops, servers, and mobile devices. Endpoint detection and response (EDR) records activity and automates response, while mobile device management (MDM) enforces policies such as encryption, remote wipe, and application control. Cloud environments add responsibilities for identity, configuration, and workload isolation.

Modern architectures increasingly follow zero trust: no device or user is trusted by default, access is continuously verified, and traffic is inspected even inside the network.

Segmentation drill: use firewalls, IDS/IPS, DMZ, and segmentation to limit lateral movement. For endpoints, use EDR, patch management, and host-based firewalls, and verify remote access with VPN or zero-trust controls.

Incident response follows a lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. During an incident, preserve evidence, document actions and timestamps, and follow the organization's chain of custody. Forensics may examine memory, logs, and disk images to determine scope and root cause.

Operations depend on backups, disaster recovery plans, and business continuity planning. Define recovery time objective (RTO) and recovery point objective (RPO) so recovery targets are measurable. Compliance frameworks such as NIST, ISO 27001, GDPR, and HIPAA turn security controls into auditable requirements; policies, standards, procedures, and training support consistent behavior.

For the exam, connect each control to the phase it supports: monitoring detects, playbooks guide response, backups support recovery, and training reduces human error.

Incident loop: prepare, detect, contain, eradicate, recover, and learn. Preserve evidence, document actions and timestamps, and use RTO/RPO to plan recovery. After the incident, update playbooks and train staff.