CompTIA Security+ Bootcamp

• Control categories and types (Domain 1)
• CIA, non-repudiation and AAA
• Zero trust and gap analysis
• Physical security and deception

LAB Classify controls in a scenario

• Change management processes (Domain 1)
• Symmetric and asymmetric encryption
• Hashing and salting
• Key exchange and key stretching

LAB Encrypt, hash and verify files

• Public key infrastructure (Domain 1)
• Certificates and certificate authorities
• Digital signatures
• Blockchain and obfuscation

LAB Inspect a certificate chain

• Threat actor types and motivations (Domain 2)
• Message, image and file vectors
• Social engineering
• Supply chain and unsecure networks

LAB Profile the threat actor behind an incident

• Application and OS vulnerabilities (Domain 2)
• Web-based vulnerabilities
• Cloud, virtualization and supply chain
• Mobile and zero-day vulnerabilities

LAB Match vulnerabilities to systems

• Malware attacks (Domain 2)
• Network and application attacks
• Password and cryptographic attacks
• Indicators of compromise

LAB Investigate indicators in logs

• Segmentation and access control (Domain 2)
• Patching and encryption
• Monitoring and least privilege
• Hardening techniques

LAB Choose mitigations for findings

• Cloud and infrastructure as code (Domain 3)
• Serverless, microservices and containers
• IoT, ICS/SCADA and embedded systems
• Architecture considerations

LAB Review a cloud architecture

• Device placement and security zones (Domain 3)
• Firewalls, IPS, proxies and VPNs
• Secure communication and access
• Selecting effective controls

LAB Design a secure network layout

• Data types and classifications (Domain 3)
• Data states and sovereignty
• Protection methods
• Data loss prevention

LAB Classify and protect sensitive data

• High availability and site considerations (Domain 3)
• Backups and replication
• Power resilience
• Testing and capacity planning

LAB Build a recovery plan

• Secure baselines (Domain 4)
• Hardening targets
• Wireless and mobile security
• Application security

LAB Harden systems to a baseline

• Asset management (Domain 4)
• Vulnerability scanning and analysis
• Prioritization and remediation
• Validation and reporting

LAB Prioritize a vulnerability scan

• Monitoring computing resources (Domain 4)
• SIEM, SCAP and agents
• Alerting and tuning
• Enhancing security: firewalls, IDS/IPS, DNS filtering, EDR

LAB Tune noisy alerts

• Provisioning and federation (Domain 4)
• SSO and MFA
• Access control models
• Privileged access management

LAB Design an IAM solution

• Security automation and orchestration (Domain 4)
• Incident response process
• Threat hunting and root cause analysis
• Digital forensics

LAB Run an incident response

• Log data and sources (Domain 4)
• Dashboards and reports
• Packet captures
• Vulnerability scan data

LAB Investigate an incident with log data

• Governance structures and policies (Domain 5)
• Standards and procedures
• Compliance and its consequences
• Privacy and data roles

LAB Write a security policy

• Risk identification and analysis (Domain 5)
• Risk registers and strategies
• Business impact analysis
• Vendor assessment and agreements

LAB Build a risk register

• Audits and penetration testing (Domain 5)
• Security awareness programs
• Full-domain review
• Full-length practice exam

LAB Capstone: plan a security assessment