Security+ SY0-701 labs

1.0 General security concepts · 12%

0 taught, 2 partly, 0 without a lab

1. 1.2 Fundamental security concepts Partly taught

   CIA · non-repudiation · AAA · gap analysis · zero trust · physical security · honeypot and honeynet · honeyfile and honeytoken

   TLS certificates: chains, trust and what breaks themA honeypot: the host nobody should touchAAA with RADIUS: who logs in to the router, what they may do, and a log of it802.1X and RADIUS: logging in to a switch portLDAP: one directory for every loginZero trust with mutual TLS

2. 1.4 Cryptographic solutions Partly taught

   public key infrastructure · encryption in transit · encryption at rest · key exchange · hashing and salting · digital signatures · certificates · TPM, HSM and secure enclaves · key stretching · blockchain

   TLS certificates: chains, trust and what breaks themPTP and NTS: time that is precise, and time that is provenVPN: a private tunnel across a hostile networkIPsec: two offices, one untrusted network between themDNSSEC: signed answers, and a resolver that checks themA weak password, guessedLDAP: one directory for every loginSingle sign-on: one login, many services

2.0 Threats, vulnerabilities and mitigations · 22%

0 taught, 3 partly, 0 without a lab

1. 2.2 Threat vectors and attack surfaces Partly taught

   unsecure wireless and wired networks · Bluetooth · open service ports · default credentials · message-based and human vectors · supply chain

   The office LAN's own protocols: files, desktops and callsReconnaissance: mapping a network before you touch itA weak password, guessedHotel Wi-Fi: who is on your path

2. 2.4 Indicators of malicious activity Partly taught

   DDoS: amplified and reflected · DNS attacks · wireless attacks · on-path attacks · credential replay · password spraying and brute force · malware and beaconing · cryptographic downgrade · application attacks · indicators in logs

   Wi-Fi security: WPA2, WPA3 and the evil twinPacket forensics: reading an incident from a capture fileIncident response: working a live compromise by the runbookA weak password, guessedARP spoofing: the machine in the middleHow DNS works, and how a lie in DNS hijacks youSYN flood: half-open connections and how a server resistsDNS amplification: a small lie, a large floodTwo-factor SSH with a one-time code

3. 2.5 Mitigation techniques Partly taught

   segmentation · access control lists · application allow list · isolation · patching · encryption · monitoring · least privilege · configuration enforcement · hardening: host firewall, HIPS, closing ports, default passwords

   Central syslog: every device's log in one placeAccess control lists: who may cross the router, and where to say soA stateful firewall: replies come home, nothing new gets inVulnerability management: scan, assess, remediate, rescanIncident response: working a live compromise by the runbookA weak password, guessedNetwork automation: Ansible pushes the configZero trust with mutual TLS

3.0 Security architecture · 18%

1 taught, 2 partly, 0 without a lab

1. 3.1 Security of architecture models Partly taught

   cloud · infrastructure as code · serverless and microservices · air-gapped networks · logical segmentation · SDN · containers and virtualization · IoT and ICS/SCADA · high availability

   VLANs: many networks on one switchLoad balancing: one address, many serversContainer networking: namespaces, veth and a bridgeA cloud VPC in miniatureVRF-lite: one router, two customers who must never meetNetwork automation: Ansible pushes the configSDN: one controller programs every switch

2. 3.2 Securing enterprise infrastructure Taught

   device placement and security zones · attack surface · fail-open and fail-closed · inline vs tap · jump server · proxy server · IDS/IPS · load balancer and sensors · 802.1X and EAP · WAF, UTM and NGFW · layer 4 and layer 7 firewalls · VPN, TLS and IPsec · SD-WAN and SASE

   TLS certificates: chains, trust and what breaks themLoad balancing: one address, many serversOut-of-band management: a way in that does not depend on the networkA stateful firewall: replies come home, nothing new gets inThe bastion: one guarded door into a private networkA forward proxy: the office's one way out to the webA reverse proxy and a web application firewallVPN: a private tunnel across a hostile networkIPsec: two offices, one untrusted network between themIDS and IPS: Suricata watching, then blockingPacket forensics: reading an incident from a capture fileLayer 2 security: the switch says no802.1X and RADIUS: logging in to a switch port

3. 3.4 Resilience and recovery Partly taught

   load balancing and clustering · hot, warm and cold sites · geographic dispersion · backups · power: UPS and generators · testing: tabletop, failover, simulation

   Load balancing: one address, many serversRouter config backups: TFTP, SCP and a restore

4.0 Security operations · 28%

1 taught, 6 partly, 0 without a lab

1. 4.1 Secure computing and network resources Partly taught

   secure baselines · hardening switches and routers · site surveys and heat maps · mobile device management · WPA3 · AAA and RADIUS · secure protocols · sandboxing · monitoring

   TLS certificates: chains, trust and what breaks themWi-Fi: joining a wireless networkWi-Fi security: WPA2, WPA3 and the evil twinBGP policy: local preference, MED, communities and RPKICentral syslog: every device's log in one placeThe bastion: one guarded door into a private networkA honeypot: the host nobody should touchVulnerability management: scan, assess, remediate, rescanAAA with RADIUS: who logs in to the router, what they may do, and a log of it802.1X and RADIUS: logging in to a switch port

2. 4.3 Vulnerability management Partly taught

   network scanning · threat feeds · penetration testing · CVSS and prioritising · remediation and rescanning

   SNMP: asking devices how they areVulnerability management: scan, assess, remediate, rescanReconnaissance: mapping a network before you touch it

3. 4.4 Alerting and monitoring Partly taught

   log aggregation · alerting and alert tuning · SIEM · SCAP and benchmarks · SNMP traps · NetFlow · DLP · antivirus · vulnerability scanners

   SNMP: asking devices how they areCentral syslog: every device's log in one placeNetFlow: who talks to whomA honeypot: the host nobody should touchDNS sinkhole: blocking bad domains for every client at onceVulnerability management: scan, assess, remediate, rescanLog correlation: one event, many logs, a rule that joins them

4. 4.5 Strengthen enterprise security capabilities Partly taught

   firewall rules and screened subnets · IDS/IPS signatures · web filtering · secure protocol and port selection · DNS filtering · email security: SPF, DKIM, DMARC · file integrity monitoring · NAC · EDR/XDR · group policy and SELinux

   The DNS tree: how a name is foundTLS certificates: chains, trust and what breaks themHTTP/1.1, HTTP/2 and HTTP/3PTP and NTS: time that is precise, and time that is provenA stateful firewall: replies come home, nothing new gets inA forward proxy: the office's one way out to the webA reverse proxy and a web application firewallSPF, DKIM and DMARC: proving who sent an emailDNS sinkhole: blocking bad domains for every client at onceIDS and IPS: Suricata watching, then blockingVulnerability management: scan, assess, remediate, rescanIncident response: working a live compromise by the runbook802.1X and RADIUS: logging in to a switch port

5. 4.6 Identity and access management Partly taught

   provisioning and de-provisioning · SSO and LDAP · OAuth and SAML · federation · access control models · multifactor authentication · password practices · privileged access management

   A weak password, guessedLDAP: one directory for every loginKerberos: one login, tickets for everythingTwo-factor SSH with a one-time codeSingle sign-on: one login, many servicesZero trust with mutual TLS

6. 4.8 Incident response Partly taught

   preparation, detection, analysis · containment, eradication, recovery · lessons learned · tabletop exercises and simulations · root cause analysis · threat hunting · digital forensics · legal hold and chain of custody

   A honeypot: the host nobody should touchPacket forensics: reading an incident from a capture fileLog correlation: one event, many logs, a rule that joins themIncident response: working a live compromise by the runbook

7. 4.9 Data sources for an investigation Taught

   firewall logs · application and endpoint logs · OS security logs · IDS/IPS logs · network logs and metadata · packet captures · dashboards and reports

   Central syslog: every device's log in one placeNetFlow: who talks to whomA honeypot: the host nobody should touchIDS and IPS: Suricata watching, then blockingPacket forensics: reading an incident from a capture fileLog correlation: one event, many logs, a rule that joins themIncident response: working a live compromise by the runbookA weak password, guessed

5.0 Security program management and oversight · 20%

0 taught, 0 partly, 0 without a lab