CompTIA Security+ Security Operations Summary

Multifactor authentication combines different types of factors: something you know (password), something you have (phone, token), and something you are (fingerprint).

Wrong choices

• A password plus a security question: Both are something you know, so this is one factor type used twice.
• Two different passwords: Both are something you know.
• A username plus a password: A username is not an authentication factor.

Biometrics such as fingerprints, face, and iris are something you are.

Wrong choices

• Something you know: Passwords and PINs are something you know.
• Something you have: Phones, smart cards, and tokens are something you have.
• Somewhere you are: Location is a separate attribute, not a fingerprint.

Least privilege limits each account to the minimum access required. It reduces damage if an account is misused or compromised.

Wrong choices

• Separation of duties: Separation of duties splits critical tasks among different people.
• Implicit trust: Implicit trust is what zero trust avoids.
• Job rotation: Job rotation moves people between roles over time.

WPA3 is the current Wi-Fi security standard. It uses SAE instead of the older pre-shared key handshake, which makes offline password guessing much harder.

Wrong choices

• WEP: WEP is old and easily broken.
• WPA: WPA (first version) is outdated.
• Open network with no encryption: An open network has no encryption.

Incident response starts with preparation (plans, tools, training) before any incident happens. Then come detection, analysis, containment, eradication, recovery, and lessons learned.

Wrong choices

• Containment: Containment comes after an incident is detected and analyzed.
• Lessons learned: Lessons learned is the final phase.
• Eradication: Eradication removes the cause after containment.

Single sign-on lets a user authenticate once and access many systems. SAML and OpenID Connect are common SSO standards.

Wrong choices

• Multifactor authentication: MFA uses multiple factor types; it does not by itself remove repeated logins.
• Password spraying: Password spraying is an attack.
• Account lockout: Lockout blocks an account after failed attempts.

In RBAC, permissions are given to roles, and users get access by being placed in roles. It is easy to manage in large organizations.

Wrong choices

• Mandatory access control (MAC): MAC uses security labels such as Secret or Top Secret.
• Discretionary access control (DAC): In DAC the data owner decides who gets access.
• Rule-based access control: Rule-based uses rules such as time of day, not job roles.

A SIEM (security information and event management) system gathers logs, correlates events across sources, and alerts analysts to possible incidents.

Wrong choices

• DLP: DLP watches for sensitive data leaving the organization.
• VPN: A VPN creates encrypted tunnels.
• WAF: A WAF filters web application traffic.

A false positive is an alert for something that is not actually a threat. A false negative, missing a real attack, is usually more dangerous.

Wrong choices

• False negative: A false negative is a real attack that was not detected.
• True positive: A true positive is a real attack that was correctly detected.
• True negative: A true negative is a safe event correctly not alerted.

DLP tools inspect data in email, uploads, and devices, and can block or alert when sensitive information is about to leave the organization.

Wrong choices

• Intrusion detection system: An IDS looks for attacks on the network; it is not focused on outgoing sensitive data.
• Load balancer: A load balancer spreads traffic.
• Honeypot: A honeypot is a decoy for attackers.