YCDA CompTIA security+ get certified get ahead SY0 501 study guide

Ebook CompTIA Security+: Get Certified Get Ahead SY0501 Study GuideObjective to Chapter Map 1.0 Threats, Attacks and Vulnerabilities 21% 2.0 Technologies and Tools 22% 3.0 Architecture and Design 15% 4.0 Identity and Access Management 16% 5.0 Risk Management 14% 6.0 Cryptography and PKI 12%

Trang 1

||||||||||||||||||||

Trang 2

CompTIA Security+:

Get Certified Get Ahead

SY0-501 Study Guide

Darril Gibson

Trang 3

CompTIA Security+: Get Certified Get Ahead SY0-501

Printed in the United States of America

No part of this book may be used or reproduced in any manner whatsoever withoutwritten permission except in the case of brief quotations embodied in critical articlesand review For information, contact YCDA, LLC

1124 Knights Bridge Lane,

Virginia Beach, VA, 23455

YCDA, LLC books may be purchased for educational, business, or sales promotionaluse For information, please contact Darril Gibson at darril@darrilgibson.com

Copy editor: Karen Annett

Technical editor: Chris

Trang 4

To my wife, who even after 25 years of marriage continues to remind

me how wonderful life can be if you’re in a loving relationship

Thanks for sharing your life with

me

Trang 5

Books of this size and depth can’t be done by a single person, and I’m gratefulfor the many people who helped me put this book together First, thanks to my wife.She has provided me immeasurable support throughout this project The technicaleditor, Chris Crayton, provided some great feedback on each of the chapters and theonline labs If you have the paperback copy of the book in your hand, you’re enjoyingsome excellent composite editing work done by Susan Veach

I’m extremely grateful for all the effort Karen Annett put into this project She’s

an awesome copy editor and proofer and the book is tremendously better due to allthe work she’s put into it Last, thanks to my assistant Jaena Nerona who helped withmany of the details behind the scenes She helped me with some quality control and

project management More, she managedmost of the daily tasks associated with maintaining online web sites

While I certainly appreciate all the feedback everyone gave me, I want tostress that any errors that may have snuck into this book are entirely my fault and noreflection on anyone who helped I always strive to identify and remove every error,but they still seem to sneak in

Special thanks to:

• Chief Wiggum for bollards installation

• Nelson Muntz for personal physical security services

• Martin Prince for educating us about downgrade attacks

• Comp-Global-Hyper-Mega-Net for intermittent HTTP services

• Edna Krabapple for her thoughtful continuing education lessons

• Apu Nahasapeemapetilon for technical advice on secure coding concepts

• Moe Szyslak for refreshments and uplifting our spirits with his talks aboutRATs

About the Author

Darril Gibson is the CEO of YCDA, LLC (short for You Can Do Anything) Hehas contributed to more than 40 books as the author, coauthor, or technical editor.Darril regularly writes, consults, and teaches on a wide variety of technical andsecurity topics and holds several certifications, including CompTIA A+, Network+,

||||||||||||||||||||

Trang 6

In response to repeated requests, Darril created the http://gcgapremium.com/

site where he provides study materials for several certification exams, including theCompTIA Security+ exam Darril regularly posts blog articles at

http://blogs.getcertifiedgetahead.com/, and uses the site to help people stay abreast

of changes in certification exams You can contact him through either of these sites

Additionally, Darril publishes the Get Certified Get Ahead newsletter Thisweekly newsletter typically lets readers know of new blog posts and about updatesrelated to CompTIA certification exams You can sign up at http://eepurl.com/g44Of

Darril lives in Virginia Beach with his wife and two dogs Whenever possible,they escape to a small cabin in the country on over twenty acres of land thatcontinue to provide them with peace, tranquility, and balance

Trang 7

Table of Contents

Dedication iii

Acknowledgments iv

About the Author iv

Introduction 1

Who This Book Is For 1

About This Book 2

How to Use This Book 2

Conventions 3

Remember This 3

Vendor Neutral 4

Free Online Resources 4

Additional Web Resources 5

Assumptions 5

Set a Goal 6

About the Exam 6

Passing Score 6

Exam Prerequisites 6

Beta Questions 7

Exam Format 7

Question Types 7

Multiple Choice 7

Performance-Based Questions 7

Question Complexity 9

Video 10

Exam Test Provider 10

Voucher Code for 10 Percent Off 10

Exam Domains 11

Objective to Chapter Map 11

1.0 Threats, Attacks and Vulnerabilities 21% 11

||||||||||||||||||||

Trang 8

3.0 Architecture and Design 15% 19

4.0 Identity and Access Management 16% 24

5.0 Risk Management 14% 26

6.0 Cryptography and PKI 12% 29

Recertification Requirements 32

Pre-Assessment Exam 35

Assessment Exam Answers 49

Chapter 1 61

Mastering Security Basics 61

Understanding Core Security Goals 62

What Is a Use Case? 62

Ensure Confidentiality 63

Encryption 63

Access Controls 63

Steganography and Obfuscation 64

Provide Integrity 64

Hashing 64

Digital Signatures, Certificates, and Non-Repudiation 66

Increase Availability 67

Redundancy and Fault Tolerance 67

Patching 68

Resource Versus Security Constraints 68

Introducing Basic Risk Concepts 68

Understanding Control Types 69

Technical Controls 70

Administrative Controls 70

Physical Controls 71

Control Goals 71

Preventive Controls 72

Detective Controls 73

Comparing Detection and Prevention Controls 74

Trang 9

Corrective Controls 74

Deterrent Controls 74

Compensating Controls 74

Combining Control Types and Goals 75

Implementing Virtualization 75

Comparing Hypervisors 76

Application Cell or Container Virtualization 76

Secure Network Architecture 77

Snapshots 77

VDI/VDE and Non-Persistence 78

VMs as Files 78

Risks Associated with Virtualization 79

Running Kali Linux in a VM 80

Using Command-Line Tools 80

Windows Command Line 80

Linux Terminal 81

Understanding Switches and Getting Help 82

Understanding Case 82

Ping 82

Using Ping to Check Name Resolution 83

Beware of Firewalls 84

Using Ping to Check Security Posture 84

Ipconfig, ifconfig, and ip 84

Netstat 86

Tracert 87

Arp 88

Chapter 1 Exam Topic Review 88

Chapter 1 Practice Questions 90

Chapter 1 Practice Question Answers 92

Chapter 2 95

Understanding Identity and Access Management 95

Exploring Authentication Concepts 96

Comparing Identification and AAA 96

||||||||||||||||||||

Trang 10

Something You Know 97

Something You Have 103

Something You Are 106

Somewhere You Are 107

Something You Do 108

Dual-Factor and Multifactor Authentication 109

Summarizing Identification Methods 109

Troubleshooting Authentication Issues 109

Comparing Authentication Services 110

Kerberos 110

NTLM 111

LDAP and LDAPS 111

Single Sign-On 112

SSO and Transitive Trusts 113

SSO and SAML 114

SAML and Authorization 114

SSO and a Federation 114

OAuth and OpenID Connect 115

Managing Accounts 115

Least Privilege 116

Need to Know 116

Account Types 117

Require Administrators to Use Two Accounts 117

Standard Naming Convention 118

Prohibiting Shared and Generic Accounts 118

Disablement Policies 119

Recovering Accounts 119

Time-of-Day Restrictions 120

Location-Based Policies 120

Expiring Accounts and Recertification 121

Account Maintenance 121

Credential Management 121

Trang 11

Comparing Access Control Models 122

Role-Based Access Control 122

Using Roles Based on Jobs and Functions 123

Documenting Roles with a Matrix 123

Establishing Access with Group-Based Privileges 124

Rule-Based Access Control 126

Discretionary Access Control 126

SIDs and DACLs 126

The Owner Establishes Access 127

Beware of Trojans 127

Mandatory Access Control 127

Labels and Lattice 128

Establishing Access 129

Attribute-Based Access Control 129

Chapter 3

.139

Exploring Network Technologies and Tools 139

Reviewing Basic Networking Concepts 140

Basic Networking Protocols 140

Implementing Protocols for Use Cases 142

Voice and Video Use Case 142

File Transfer Use Case 142

Email and Web Use Cases 144

Directory Services Use Case 145

Remote Access Use Cases 145

Time Synchronization Use Case 146

Network Address Allocation Use Case 146

Domain Name Resolution Use Case 147

Subscription Services Use Case 149

Understanding and Identifying Ports 149

||||||||||||||||||||

Trang 12

IP Address Used to Locate Hosts 151

Server Ports 151

Client Ports 151

Putting It All Together 151

The Importance of Ports in Security 153

Understanding Basic Network Devices 154

Switches 154

Security Benefit of a Switch 155

Port Security 155

Physical Security of a Switch 155

Loop Prevention 155

Flood Attacks and Flood Guards 156

Routers 157

Routers and ACLs 157

Implicit Deny 158

Antispoofing 158

Bridge 159

Aggregation Switch 160

Firewalls 160

Host-Based Firewalls 160

Application-Based Versus Network-Based Firewalls 161

Stateless Firewall Rules 162

Stateful Versus Stateless 162

Web Application Firewall 163

Implementing a Secure Network 163

Zones and Topologies 163

DMZ 163

Understanding NAT and PAT 165

Network Separation 166

Physical Isolation and Airgaps 166

Logical Separation and Segmentation 166

Comparing a Layer 2 Versus Layer 3 Switch 166

Trang 13

Isolating Traffic with a VLAN 167

Media Gateway 167

Proxy Servers 167

Caching Content for Performance 168

Transparent Proxy Versus Nontransparent Proxy 168

Reverse Proxy 169

Application Proxy 169

Unified Threat Management 170

Mail Gateways 171

Summarizing Routing and Switching Use Cases 172

Chapter 4

.181

Securing Your Network 181

Exploring Advanced Security Devices 182

Understanding IDSs and IPSs 182

HIDS 182

NIDS 183

Sensor and Collector Placement 183

Detection Methods 184

IPS Versus IDS—Inline Versus Passive 187

SSL/TLS Accelerators 188

SSL Decryptors 189

SDN 189

Honeypots 190

Honeynets 190

IEEE 802.1x Security 191

Securing Wireless Networks 192

Reviewing Wireless Basics 192

Fat Versus Thin Access Points 193

Band Selection and Channel Widths 193

||||||||||||||||||||

Trang 14

Disable SSID Broadcasting or Not 194

Enable MAC Filtering 195

Antenna Types and Placement 196

Antenna Power and Signal Strength 197

Network Architecture Zones 198

Wireless Cryptographic Protocols 198

WPA 198

WPA2 198

TKIP Versus CCMP 199

PSK, Enterprise, and Open Modes 199

Authentication Protocols 201

Captive Portals 202

Understanding Wireless Attacks 202

Disassociation Attacks 202

WPS and WPS Attacks 203

Rogue AP 203

Evil Twin 204

Jamming Attacks 204

IV Attacks 205

NFC Attacks 205

Bluetooth Attacks 205

Wireless Replay Attacks 206

RFID Attacks 206

Misconfigured Access Points 207

Using VPNs for Remote Access 207

VPNs and VPN Concentrators 208

Remote Access VPN 208

IPsec as a Tunneling Protocol 209

TLS as a Tunneling Protocol 209

Split Tunnel Versus Full Tunnel 209

Site-to-Site VPNs 210

Always-On VPN 211

Trang 15

Network Access Control 211

Host Health Checks 211

Permanent Versus Dissolvable 212

Identity and Access Services 213

PAP 214

CHAP 214

MS-CHAP and MS-CHAPv2 214

RADIUS 214

TACACS+ 215

Diameter 216

AAA Protocols 216

Chapter 5

.225

Securing Hosts and Data 225

Implementing Secure Systems 226

Operating Systems 227

Secure Operating System Configurations 228

Using Master Images 229

Resiliency and Automation Strategies 230

Secure Baseline and Integrity Measurements 230

Patch Management 231

Change Management Policy 232

Unauthorized Software and Compliance Violations 233

Application Whitelisting and Blacklisting 233

Secure Staging and Deployment 234

Sandboxing with VMs 234

Sandboxing with Chroot 234

Secure Staging Environment 235

Peripherals 235

Hardware and Firmware Security 236

||||||||||||||||||||

Trang 16

FDE and SED 237

UEFI and BIOS 237

Trusted Platform Module 237

Hardware Security Module 238

Additional Vulnerabilities 239

Summarizing Cloud Concepts 239

Software as a Service 240

Platform as a Service 240

Infrastructure as a Service 240

Security Responsibilities with Cloud Models 241

Security as a Service 241

Cloud Deployment Models 242

Deploying Mobile Devices Securely 243

Deployment Models 243

Connection Methods 244

Mobile Device Management 245

Mobile Device Enforcement and Monitoring 247

Unauthorized Software 248

Hardware Control 249

Unauthorized Connections 250

Exploring Embedded Systems 250

Security Implications and Vulnerabilities 251

Comparing Embedded Systems 252

Protecting Data 254

Protecting Confidentiality with Encryption 254

Database Security 255

File System Security 255

Data Loss Prevention 257

Removable Media 257

Data Exfiltration 258

Cloud-Based DLP 258

Trang 17

Chapter 6

.267

Comparing Threats, Vulnerabilities, and Common Attacks 267

Understanding Threat Actors 268

Determining Malware Types 270

Viruses 271

Worms 271

Logic Bombs 271

Backdoors 272

Trojans 273

RAT 274

Ransomware 274

Keylogger 275

Spyware 275

Adware 276

Bots and Botnets 276

Rootkits 277

Recognizing Common Attacks 278

Social Engineering 278

Impersonation 279

Shoulder Surfing 279

Tricking Users with Hoaxes 279

Tailgating and Mantraps 280

Dumpster Diving 280

Watering Hole Attacks 280

Attacks via Email and Phone 281

Spam 281

Phishing 281

Spear Phishing 284

Whaling 284

Vishing 285

||||||||||||||||||||

Trang 18

Blocking Malware and Other Attacks 287

Protecting Systems from Malware 287

Antivirus and Anti-Malware Software 288

Data Execution Prevention 289

Advanced Malware Tools 290

Spam Filters 290

Educating Users 291

New Viruses 291

Phishing Attacks 291

Zero-Day Exploits 292

Why Social Engineering Works 292

Authority 293

Intimidation 293

Consensus 293

Scarcity 294

Urgency 294

Familiarity 294

Trust 294

Chapter 7

.303

Protecting Against Advanced Attacks 303

Comparing Common Attacks 304

DoS Versus DDoS 304

Privilege Escalation 304

Spoofing 305

SYN Flood Attacks 305

Man-in-the-Middle Attacks 306

ARP Poisoning Attacks 306

ARP Man-in-the-Middle Attacks 307

Trang 19

ARP DoS Attack 307

DNS Attacks 308

DNS Poisoning Attacks 308

Pharming Attacks 308

DDoS DNS Attacks 308

Amplification Attacks 309

Password Attacks 309

Brute Force Attacks 310

Dictionary Attacks 310

Password Hashes 311

Pass the Hash Attacks 311

Birthday Attacks 311

Rainbow Table Attacks 312

Replay Attacks 313

Known Plaintext Attacks 313

Hijacking and Related Attacks 314

Domain Hijacking 315

Man-in-the-Browser 315

Driver Manipulation 315

Zero-Day Attacks 316

Memory Buffer Vulnerabilities 316

Memory Leak 316

Integer Overflow 317

Buffer Overflows and Buffer Overflow Attacks 317

Pointer Dereference 318

DLL Injection 319

Summarizing Secure Coding Concepts 319

Compiled Versus Runtime Code 319

Proper Input Validation 319

Client-Side and Server-Side Input Validation 320

Other Input Validation Techniques 321

Avoiding Race Conditions 321

Proper Error Handling 322

Cryptographic Techniques 322

||||||||||||||||||||

Trang 20

Code Obfuscation 323

Code Quality and Testing 324

Development Life-Cycle Models 324

Secure DevOps 325

Version Control and Change Management 326

Provisioning and Deprovisioning 327

Identifying Application Attacks 327

Web Servers 327

Database Concepts 328

Normalization 328

SQL Queries 330

Injection Attacks 332

Cross-Site Scripting 332

Cross-Site Request Forgery 333

Understanding Frameworks and Guides 334

Chapter 8

.343

Using Risk Management Tools 343

Understanding Risk Management 344

Threats and Threat Assessments 344

Vulnerabilities 346

Risk Management 346

Risk Assessment 347

Risk Registers 350

Supply Chain Assessment 351

Comparing Scanning and Testing Tools 351

Checking for Vulnerabilities 351

Password Crackers 352

Network Scanners 352

Trang 21

Banner Grabbing 356

Vulnerability Scanning 356

Credentialed Versus Non-Credentialed 358

Configuration Compliance Scanner 359

Obtaining Authorization 359

Penetration Testing 359

Passive Reconnaissance 360

Active Reconnaissance 360

Initial Exploitation 361

Escalation of Privilege 361

Pivot 361

Persistence 362

White, Gray, and Black Box Testing 362

Intrusive Versus Non-Intrusive Testing 363

Passive Versus Active Tools 363

Exploitation Frameworks 364

Using Security Tools 364

Sniffing with a Protocol Analyzer 364

Command-Line Tools 366

Tcpdump 366

Nmap 366

Netcat 367

Monitoring Logs for Event Anomalies 367

Operating System Event Logs 368

Firewall and Router Access Logs 368

Linux Logs 368

Other Logs 369

SIEM 370

Continuous Monitoring 371

Usage Auditing and Reviews 371

Permission Auditing and Review 372

||||||||||||||||||||

Trang 22

Chapter 9 381

Implementing Controls to Protect Assets 381

Implementing Defense in Depth 382

Comparing Physical Security Controls 383

Using Signs 384 Comparing Door Lock Types 384 Securing Door Access with Cipher Locks 384 Securing Door Access with Cards 385 Securing Door Access with Biometrics 385

Tailgating 386 Preventing Tailgating with Mantraps 386 Increasing Physical Security with Guards 387 Monitoring Areas with Cameras 387 Fencing, Lighting, and Alarms 388 Securing Access with Barricades 389 Using Hardware Locks 389

Securing Mobile Computers with Cable Locks 390 Securing Servers with Locking Cabinets 390 Securing Small Devices with a Safe 390

Asset Management 391 Implementing Environmental Controls 391 Heating, Ventilation, and Air Conditioning 391

Hot and Cold Aisles 392 HVAC and Fire 392 Fire Suppression 393 Environmental Monitoring 393

Shielding 394

Protected Cabling 394 Protected Distribution of Cabling 394

Faraday Cage 395 Adding Redundancy and Fault Tolerance 395

Trang 23

Single Point of Failure 395 Disk Redundancies 396

RAID-0 396 RAID-1 397 RAID-5 and RAID-6 397

RAID-10 397 Server Redundancy and High Availability 397 Failover Clusters for High Availability 398 Load Balancers for High Availability 399 Clustering Versus Load Balancing 400

Power Redundancies 400 Protecting Data with Backups 400

Comparing Backup Types 401

Full Backups 401 Restoring a Full Backup 402 Differential Backups 402 Order of Restoration for a Full/Differential Backup Set 402

Incremental Backups 402 Order of Restoration for a Full/Incremental Backup Set 403 Choosing Full/Incremental or Full/Differential 403

Snapshot Backup 403 Testing Backups 404 Protecting Backups 404 Backups and Geographic Considerations 404 Comparing Business Continuity Elements 405

Business Impact Analysis Concepts 406

Impact 407 Privacy Impact and Threshold Assessments 407

Recovery Time Objective 408 Recovery Point Objective 408 Comparing MTBF and MTTR 408 Continuity of Operations Planning 409

Recovery Sites 409 Order of Restoration 411

||||||||||||||||||||

Trang 24

Testing Plans with Exercises 412 Chapter 9 Exam Topic Review 413

Chapter 10 423

Understanding Cryptography and PKI 423

Introducing Cryptography Concepts 424

Providing Integrity with Hashing 425

MD5 425 SHA 426 HMAC 426 RIPEMD 427 Hashing Files 427 Hashing Passwords 428 Key Stretching 428 Hashing Messages 429 Using HMAC 430 Providing Confidentiality with Encryption 432

Encryption Terms 433 Block Versus Stream Ciphers 434

Cipher Modes 435 Symmetric Encryption 435

AES 437 DES 438 3DES 438 RC4 438 Blowfish and Twofish 438 Symmetric Encryption Summary 439 Asymmetric Encryption 439

The Rayburn Box 440 The Rayburn Box Used to Send Secrets 440

Trang 25

The Rayburn Box Used for Authentication 441

The Rayburn Box Demystified 441

Certificates 441 RSA 443 Static Versus Ephemeral Keys 443 Elliptic Curve Cryptography 443

Diffie-Hellman 444 Steganography 444 Using Cryptographic Protocols 445

Protecting Email 446 Signing Email with Digital Signatures 446

Encrypting Email 448 S/MIME 450 PGP/GPG 450 HTTPS Transport Encryption 450

SSL Versus TLS 450

Encrypting HTTPS Traffic with TLS 451

Cipher Suites 452 Implementation Versus Algorithm Selection 453 Downgrade Attacks on Weak Implementations 453 Exploring PKI Components 454

Certificate Authority 454 Certificate Chaining and Trust Models 455

Registration and CSRs 456 Revoking Certificates 457 Certificate Issues 458 Public Key Pinning 459 Key Escrow 460 Recovery Agent 460 Comparing Certificate Types 460 Certificate Formats 461 Chapter 10 Exam Topic Review 463

||||||||||||||||||||

Trang 26

Chapter 11 473

Implementing Policies to Mitigate Risks 473

Exploring Security Policies 474

Personnel Management Policies 474

Acceptable Use Policy 475 Mandatory Vacations 475 Separation of Duties 476 Job Rotation 477 Clean Desk Policy 477 Background Check 479

NDA 479 Exit Interview 479 Onboarding 480 Policy Violations and Adverse Actions 480 Other General Security Policies 481

Agreement Types 483 Protecting Data 484

Information Classification 484 Data Sensitivity Labeling and Handling 485 Data Destruction and Media Sanitization 486

Data Retention Policies 487

PII and PHI 488 Protecting PII and PHI 488 Legal and Compliance Issues 489 Data Roles and Responsibilities 490

Responding to Incidents 491

Incident Response Plan 491 Incident Response Process 492 Implementing Basic Forensic Procedures 493

Order of Volatility 494 Data Acquisition and Preservation of Evidence 495

Trang 27

Chain of Custody 498 Legal Hold 499 Recovery of Data 499 Active Logging for Intelligence Gathering 500

Track Man-Hours and Expense 500 Providing Training 500

Role-Based Awareness Training 500

Continuing Education 501 Training and Compliance Issues 502 Troubleshooting Personnel Issues 502 Chapter 11 Exam Topic Review 503

Post-Assessment Exam .511

Assessment Exam Answers 524

Appendix A—Glossary 537

Index 569

||||||||||||||||||||

Trang 28

Congratulations on your purchase of CompTIA Security+: Get Certified GetAhead study guide Yo u are one step closer to becoming CompTIA Security+certified This certification has helped many individuals get ahead in their jobs andtheir careers, and it can help you get ahead, too

It is a popular certification within the IT field One IT hiring manager told methat if a résumé doesn’t include the Security+ certification, or a higher-level securitycertification, he simply sets it aside He won’t even talk to applicants That’s not thesame with all IT hiring managers, but it does help illustrate how important security

is within the IT field

Who This Book Is For

If you’re studying for the CompTIA Security+ exam and want to pass it on yourfirst attempt, this book is for you It covers 100 percent of the objectives identified byCompTIA for the Security+ exam

The first target audience for this book is students in CompTIA Security+classes My goal is to give students a book they can use to study the relevant andimportant details of CompTIA Security+ in adequate depth for the challengingtopics, but without the minutiae in topics that are clear for most IT professionals Iregularly taught from the earlier editions of this book, and I’ll continue to teach usingthis edition I also hear from instructors around the United States and in severalother countries who use versions of the book to help students master the topics andpass the Security+ exam the first time they take it

Second, this book is for those people who like to study on their own If you’reone of the people who can read a book and learn the material without sitting in aclass, this book has what you need to take and pass the exam

Additionally, you can keep this book on your shelf (or in your Kindle) toremind yourself of important, relevant concepts These concepts are important forsecurity professionals and IT professionals in the real world

Based on many conversations with students and readers of the previous

Trang 29

versions of this book, I know that many people use the Security+ certification as thefirst step in achieving other security certifications For example, you may followSecurity+ with one of these cybersecurity certifications:

• (ISC)2 Systems Security Certified Practitioner (SSCP)

• (ISC)2 Certified Information Systems Security Professional (CISSP)

• CompTIA Advanced Security Practitioner (CASP)

• CompTIA Cybersecurity Analyst (CSA+)

If you plan to pursue any of these advanced security certifications, you’ll findthis book will help you lay a solid foundation of security knowledge Learn thismaterial, and you’ll be a step ahead on the other exams

||||||||||||||||||||

Trang 30

About This Book

Over the past several years, I’ve taught literally hundreds of students, helpingthem to become CompTIA Security+ certified During that time, I’ve learned what

concepts are easy to grasp and what concepts need more explanation I’ve

developed handouts and analogies that help students grasp the elusive concepts

Feedback from students was overwhelmingly positive—both in their comments

to me and their successful pass rates after taking the certification exam When the

objectives changed in 2008, I rewrote my handouts as the first edition of this book

When the objectives changed again in 2011 and 2014, I rewrote the book to reflect

the new objectives This book reflects the objective changes released in 2017

Gratefully, this book has allowed me to reach a much larger audience andshare security and IT-related information Even if you aren’t in one of the classes I

teach, this book can help you learn the relevant material to pass the exam the first

time you take it

How to Use This Book

Over the years, I’ve taught the Security+ course many times During thisprocess, I learned the best way to present the material so that students understand and

retain the most knowledge The book is laid out the same way

For most people, the easiest way to use the book is by starting with the assessment exam (after the intro) to gauge your initial understanding of the topics

pre-Then, go through each chapter sequentially, including the end-of-chapter practice test

questions Doing so, you’ll build a solid foundation of knowledge This helps make

the more advanced topics in later chapters easier to understand

If you have a high level of IT security knowledge and only want to study thetopics that are unclear to you on this exam, you can review the objective map listed

at the end of the introduction This lists all the objectives and identifies the chapter

where the objective topics are covered Additionally, you can look at the index tolocate the exact page for these topics If you have the Kindle version, it includes an

excellent search feature you can use to find a specific topic When practicing for any

certification exam, the following steps are a good recipe for success:

• Review the objectives The objectives for the SY0-501 exam are listed

in the “Objective to Chapter Map” section in this Introduction

• Learn the material related to the objectives This book covers all the

objectives, and the introduction includes a map showing which chapter (or

Trang 31

chapters) covers each objective Along those lines, my goal when writingthe book was to cover the objectives at sufficient depth to help you pass theexam However, these topics all have a lot more depth When I study for acertification exam, I typically dig in much deeper than necessary, oftenbecause the topics interest me You can, too, if you want, but don’t lose site

of the exam objectives

• Take practice questions A key step when preparing for any certification

exam is to make sure you can answer the exam questions Yes, you need theknowledge, but you also must be able to read a question and select thecorrect answer This simply takes practice When using practice testquestions, ensure they have explanations Questions without explanationsoften encourage rote memorization without understanding and sometimeseven give you the wrong answers

||||||||||||||||||||

Trang 32

• Achieve high scores on practice exams I typically tell people that they

should get scores of at least 90 percent on practice tests for the CompTIASecurity+ exam However, don’t focus on only your scores

• Read and understand the explanations Ideally, you should be able to

look at any practice test question and know why the correct answers arecorrect and why the incorrect answers are incorrect Within this book, you’llfind this information in the explanations When you understand theexplanations, you have the best chance of accurately interpreting thequestions on the live exam and answering them correctly no matter howCompTIA words or presents them

This book has over 300 practice test questions you can use to test yourknowledge and your ability to correctly answer them Every question has a detailed

explanation to help you understand why the correct answers are correct and why the

incorrect answers are incorrect

You can find the practice questions in the following areas:

• Pre-assessment exam Use these questions at the beginning of the book

to get a feel for what you know and what you need to study more

• End-of-chapter practice questions Each chapter has practice questions

to help you test your comprehension of the material in the chapter

• Post-assessment exam Use this as a practice exam to test your

comprehension of the subject matter and readiness to take the actual exam

It’s OK if you do the practice questions in a different order You may decide totackle all the chapters in the book and then do the pre-assessment and post-

assessment questions That’s fine However, I strongly suggest you review all the

questions in the book Also, make sure you check out the additional free online

• Glossary terms Important glossary items are presented in bold italics

the first time they are mentioned, and/or when they are defined Theobjectives include an extensive Security+ Acronyms list Some of these are

Trang 33

relevant to the current exam, so I’ve included them in Appendix A,

“Glossary.” However, irrelevant acronyms are not included in the Glossary

• Commands Some chapters include specific commands that I encourage

you to enter so that you can see how they work These are shown in bold.

• File names File names such as md5sum.exe are shown in italics.

• Web site URLs URLs such as http:/gcgapremium.com are shown in

italics

Remember This

Throughout the book, you’ll see text boxes that highlight important informationyou should remember to successfully pass the exam The surrounding contentprovides the additional information needed to fully understand these key points, andthe text boxes summarize the important points

||||||||||||||||||||

Trang 34

These textboxes will look like this:

A tried-and-true method of repeating key information is to take notes whenyou’re first studying the material and then rewrite the notes later This will expose

you to the material a minimum of three times

Another method that students have told me has been successful for them is touse an MP3 player Many MP3 players can record Start your MP3 recorder and

read the information in each text box for a chapter and the information in the Exam

Topic Review section of each chapter Save the MP3 file and regularly listen to it

This allows you to reaffirm the important information in your own voice

You can play it while exercising, walking, or just about any time when it’s notdangerous to listen to any MP3 file You can even burn the MP3 files to a CD and

play them back from a CD player

If the MP3 method is successful for you, you can also record and listen to examquestions Read the question, only the correct answer, and the first sentence or two of

the explanation in each practice question

If you don’t have time to create your own MP3 recordings, check out thecompanion web site (http://gcgapremium.com) for this book You can purchase MP3

recordings there that you can download and use

More and more security devices use Linux as their operating system and this version

of the exam has some specific topics on Linux Command-line tools such as dig,

ifconfig, and ip are a few examples Most mobile devices use either the Apple iOS

operating system or the Android operating system and some of the objectives (such as

rooting and jailbreaking) focus on these operating systems

Trang 35

Free Online Resources

There are many additional free resources available to you at

http://gcgapremium.com/501-extras/, including:

• Free online labs

• Sample performance-based questions

• Additional free multiple-choice practice test questions

• Other free resources such as links to additional content

I created this online content with a couple of goals First, this version of theobjectives was

||||||||||||||||||||

Trang 36

significantly longer than the last version There was a lot I wanted to include in the

book, but there just wasn’t room As an example, if I included all the labs in the book, it

would have inflated the page count of the book to an unmanageable level Second, I

wanted to give myself a way to update the book content If it’ll be helpful to readers,

I can easily add additional labs and/or additional resources

These materials are valuable free supplements, so you’ll need to register toaccess this content and prove that you have the book by answering a question As an

example, you may have to answer a question such as this:

Locate the “Vendor Neutral” section in the introduction of the book What isthe last word in that section?

The “Vendor Neutral” section is right before this section (“Free Online

Resources”) and the last word in that section is systems You will then need to

enter the word systems People guessing (or who don’t have the book) won’t be

able to answer the question You will

Be careful, though If you don’t answer the question correctly the first time, youwon’t get another chance for several days It’s important that you take the time to

enter the correct word the first time

Additional Web Resources

Check out http://GetCertifiedGetAhead.com for up-to-date details on theCompTIA Security+ exam This site includes additional information related to the

CompTIA Security+ exam and this book

Although many people have spent a lot of time and energy trying to ensure thatthere are no errors in this book, errors occasionally slip through This site includes

an errata page listing any errors we’ve discovered

If you discover any errors, please let me know through the Contact Us page onthe web site I’d also love to hear about your success when you pass the exam I’m

constantly getting good news from readers and students who are successfully earning

their certifications

In response to all the requests I’ve received for additional materials, such asonline practice test questions, flash cards, and audio files, I created this site:

http://gcgapremium.com/ It includes access to various study materials at an

additional cost Packages include all the materials in the book and in the free online

resources area, plus additional materials such as flash cards, audio, and additional

performance-based questions

Last, I’ve found that many people find cryptography topics challenging, so

Trang 37

I’ve posted some videos on YouTube (http://www.youtube.com/) As time allows,I’ll post additional videos, and you can get a listing of all of them by searchingYouTube with “Darril Gibson.”

• “Day-to-day technical information security experience”

• “Broad knowledge of security concerns and implementation, including thetopics in the domain list”

However, I’m aware that two years of experience in a network could meanmany different things Your two years of experience may expose you to differenttechnologies than someone else’s two years of experience

||||||||||||||||||||

Trang 38

When it’s critical that you understand an underlying network concept to masterthe relevant exam material, I have often included the concept within the background

information

Set a Goal

Look at a calendar right now and determine the date 45 days from today Thiswill be your target date to take this exam Set this as your goal to complete studying

the materials and to take the exam

This target allows you to master about one and a half chapters per week It may bethat some of the chapters take you less time and some of the chapters take you more

time No problem If you want to modify your target date later, do so However, a

recipe for success in almost any endeavor includes setting a goal

When I teach CompTIA Security+ at a local university, I often help the studentsregister for the exam on the first night They pick a date close to the end of the course

and register I’ve found that when we do this, about 90 percent of the students take

and pass the exam within one week after completing the course On the other hand,

when I didn’t help the students register on the first night, more than half of them did

not complete the exam in the same time frame Setting a goal helps

About the Exam

CompTIA first released the Security+ exam in 2002, and it has quickly grown

in popularity They revised the exam objectives in 2008, 2011, 2014, and again in

2017 The 2017 exam is numbered as SY0-501 The English version of the SY0-401

exam is scheduled to retire in July 2018

Here’s a summary of the exam details:

• Number of questions: Maximum of 90 questions

• Length of test: 90 minutes

• Passing score: 750

• Grading criteria: Scale of 100 to 900 (about 83 percent)

• Question types: Multiple choice and performance-based

• Exam format: Traditional—can move back and forth to view previous

questions

• Exam prerequisites: None required but Network+ is recommended

• Exam test provider: Pearson VUE (https://home.pearsonvue.com/)

Trang 39

Passing Score

A score of 750 is required to pass This is on a scale of 100 to 900 If you takethe exam but don’t get a single question correct, you get a score of 100 If you getevery question correct, you get a score of 900 A passing score of 750 divided by

900 equals.8333 or 83.33 percent

Also, a score of 83 percent is higher than many other certification exams, soyou shouldn’t underestimate the difficulty of this exam However, many peopleregularly pass it and you can pass it, too With this book and the free onlineresources, you will be well prepared

Exam Prerequisites

All that is required for you to take the exam is money Other than that, there are

no enforced prerequisites However, to successfully pass the exam, you’reexpected to have “a minimum of

||||||||||||||||||||

Trang 40

two years’ of experience in IT administration with a focus on security.” If you have

more than that, the exam materials will likely come easier to you If you have less, the

exam may be more difficult

Beta Questions

Your exam may have some beta questions They aren’t graded but instead areused to test the validity of the questions If everyone gets a beta question correct, it’s

probably too easy If everyone gets it incorrect, there’s probably something wrong

with the question After enough people have tested a beta question, CompTIA

personnel analyze it and decide if they want to add it to the test bank, or rewrite and

test it as a new beta question

The good news is that CompTIA doesn’t grade the beta questions However,you don’t know which questions are ungraded beta questions and which questions

are live questions, so you need to treat every question equally

Exam Format

The exam uses a traditional format You start at question 1 and go to the lastquestion During the process, you can skip questions and mark any questions you

want to review when you’re done Additionally, you can view previous questions if

desired For example, if you get to question 10 and then remember something that

helps you answer question 5, you can go back and redo question 5

include a phrase such as “Select TWO” or “Select THREE.”

You may also see questions that use phrases such as “BEST choice,” “BESTdescription,” or “MOST secure.” In these examples, don’t be surprised if you see

two answers that could answer the question, while only one is the best choice As an

example, consider this simple question:

Q. Which one of the following numbers is between 1 and 10 and is the

Định dạng
Số trang	1.188
Dung lượng	35,14 MB