CompTIA Security+

Security controls, fundamental concepts (CIA, AAA, zero trust), change management, and cryptographic solutions.

• Compare and contrast types of security controls
• Summarize fundamental security concepts (CIA triad, AAA, zero trust)
• Explain the importance of change management for security
• Explain the purpose of cryptographic solutions (PKI, encryption, hashing, certificates)

Threat actors and vectors, vulnerability types, indicators of malicious activity, and mitigation techniques.

• Compare and contrast common threat actors and motivations
• Explain common threat vectors and attack surfaces
• Explain types of vulnerabilities (application, cloud, hardware, supply chain)
• Analyze indicators of malicious activity (malware, network, application attacks)
• Explain mitigation techniques used to secure the enterprise

Security implications of architecture models, securing infrastructure, protecting data, and resilience/recovery.

• Compare security implications of architecture models (cloud, on-prem, IoT, ICS/SCADA)
• Apply security principles to secure enterprise infrastructure
• Compare strategies to protect data (classification, encryption, DLP)
• Explain the importance of resilience and recovery (backups, high availability)

Hardening resources, asset management, vulnerability and identity management, monitoring, and incident response.

• Apply security techniques to computing resources (hardening, secure baselines)
• Explain security implications of asset management
• Explain vulnerability management activities
• Explain security alerting and monitoring concepts and tools (SIEM)
• Implement and maintain identity and access management (MFA, privileged access)
• Explain appropriate incident response activities

Security governance, risk management, third-party risk, compliance, audits, and security awareness.

• Summarize elements of effective security governance
• Explain elements of the risk management process
• Explain third-party risk assessment and management
• Summarize elements of effective security compliance
• Explain types and purposes of audits and assessments
• Implement security awareness practices (phishing, training, reporting)