CompTIA Security+ Certification

The opening establishes the terms without which the rest does not hold.

• Control types from technical and managerial through to compensating
• Confidentiality, integrity and availability as connected goals
• Zero trust, plus authentication, authorisation and accounting
• Cryptographic methods, PKI and digital signatures

The largest block of the first half, because this is where the attack side is understood.

• Threat actors from insiders to nation-states, and what motivates them
• Attack vectors via messages, supply chains and social engineering
• Vulnerabilities in applications, cloud services, mobile devices and operating systems
• Mitigations: segmentation, hardening, isolation and patching

Here the perspective shifts from the single attack to the system design.

• Architecture models from on-premises through cloud to IoT and industrial control
• Security principles applied to infrastructure and communication paths
• Data classification and the protection that follows from it
• Resilience, backups and continuity of operations

By far the largest exam domain, and that mirrors the daily work.

• Secure baselines, hardening, and securing mobile and wireless access
• Vulnerability management from detection through to reporting
• Firewalls, IDS and IPS, DNS filtering, DLP, plus EDR and XDR
• Identity and access management with single sign-on and multifactor authentication
• Incident response from the alert through root cause analysis to forensics

The close connects the technical side with the decisions others have to make.

• Policies, standards and responsibilities in the security organisation
• Identifying and assessing risks, and justifying them with an impact analysis
• Vendor and third-party risk across the whole contract cycle
• Audits, penetration testing and security awareness across the workforce