Security Operations

Domain 4 of the CompTIA Security+ SY0-701 exam, worth 28% of your score.

10 topics 4 free to read

• Hardening & Configuration
  Apply hardening techniques to operating systems, applications, network devices, and mobile devices.
• Asset Management
  Hardware, software, and data asset management including MDM, BYOD, and secure data disposal.
• Vulnerability Management

  CVSS scoring, CVE, vulnerability scanning, penetration testing, and threat intelligence.
• Security Monitoring & SIEM

  SIEM, log management, SOAR, threat hunting, and alerting tools for security operations.
• Modify Enterprise Capabilities

  Firewalls, IDS/IPS, web and DNS filtering, email security, DLP, NAC and EDR - tuning the controls you already own.
• Identity & Access Management (IAM)

  Authentication methods, MFA, SSO, federation, directory services, access control models, and PAM.
• Automation & Orchestration

  Scripting, orchestration and SOAR: the use cases, the benefits that are examined, and the costs that are examined harder.
• Incident Response
  Incident response lifecycle, playbooks, communication plans, and post-incident activities.
• Digital Forensics

  Forensic acquisition, order of volatility, chain of custody, legal hold, and data analysis.
• Acronyms - Security Operations
  Endpoints, vulnerability management, monitoring, identity and automation - the largest domain, and the one with the most pairs of tools…