Senior Acquisitions Editor: Jeff Kellum
Development Editor: Amy Breguet
Technical Editors: Josh More and Buzz Murphy
Production Editor: Christine O'Connor
Copy Editor: Tiffany Taylor
Editorial Manager: Pete Gaughan
Vice President and Executive Group Publisher: Richard Swadley
Associate Publisher: Chris Webb
Media Project Manager 1: Laura Moss-Hollister
Media Associate Producer: Josh Frank
Media Quality Assurance: Doug Kuhn
Book Designers: Judy Fung and Bill Gibson
Proofreader: Louise Watson and Jenn Bennett, Word One New York
Indexer: Nancy Guenther
Project Coordinator, Cover: Todd Klemme
Cover Designer: Wiley
Copyright © 2014 by John Wiley & Sons, Inc., Indianapolis, Indiana
Published simultaneously in Canada
ISBN: 978-1-118-90137-3
ISBN: 978-1-118-90142-7 (ebk.)
ISBN: 978-1-118-92290-3 (ebk.)
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.
For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.
Library of Congress Control Number: 2014930404
TRADEMARKS: Wiley and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission is a registered trademark of. CompTIA and Security+ are trademarks or registered trademarks of Computing Technology Industry Association, Inc. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.
Dear Reader,
Thank you for choosing CompTIA Security+ Review Guide. This book is part of a family of premium-quality Sybex books, all of which are written by outstanding authors who combine practical experience with a gift for teaching.
Sybex was founded in 1976. More than 30 years later, we're still committed to producing consistently exceptional books. With each of our titles, we're working hard to set a new standard for the industry. From the paper we print on, to the authors we work with, our goal is to bring you the best books available.
I hope you see all that reflected in these pages. I'd be very interested to hear your comments and get your feedback on how we're doing. Feel free to let me know what you think about this or any other Sybex book by sending me an email at contactus@sybex.com. If you think you've found a technical error in this book, please visit http://sybex.custhelp.com. Customer feedback is critical to our efforts at Sybex.
To Catharine Renee Stewart: Aw, it's a helluva ride … Yeah, it's a helluva life.
Thanks to all those at Sybex who continue to allow me to do what I enjoy most—impart knowledge to others. Thanks to Jeff Kellum, acquisitions editor, and the whole Sybex crew for professional juggling services adequately rendered. Thanks to my editors: developmental editor, Amy Breguet, and technical editor, Josh More. To my parents: Dave—Dad, I miss you; and Johnnie—Mom, thanks for your love and consistent support. To Mark: I have been and always shall be your friend. And finally, as always, to Elvis: you were pioneering in recognizing that everything is better with bacon!
James Michael Stewart has been working with computers and technology since 1983 (although officially as a career since 1994). His work focuses on Windows, certification, and security. Recently, Michael has been teaching job skill and certification courses, such as CISSP, CEH, CHFI, and Security+. Michael has contributed to many Security+ focused materials, including exam preparation guides, practice exams, DVD video instruction, and courseware. In addition, Michael has co-authored numerous books on other security and IT certification and administration topics. He has developed certification courseware and training materials as well as presented these materials in the classroom. Michael holds numerous certifications, including Sec+, CISSP, and CEH. Michael graduated in 1992 from the University of Texas at Austin with a bachelor's degree in philosophy. Despite his degree, his computer knowledge is self-acquired, based on seat-of-the-pants, hands-on “street smarts” experience. You can reach Michael by email at michael@impactonline.com.
The Security+ certification program was developed by the Computer Technology Industry Association (CompTIA) to provide an industry-wide means of certifying the competency of computer service technicians in the basics of computer security. The Security+ certification is granted to those who have attained the level of knowledge and security skills that show a basic competency with security needs of both personal and corporate computing environments. CompTIA's exam objectives are periodically updated to keep their exams applicable to the most recent developments. The most recent update, labeled as SY0–401, occurred in spring 2014. This book focuses on these newly revised certification objectives.
The Security+ certification was created to offer an introductory step into the complex world of IT security. You only need to pass a single exam to become Security+ certified. However, obtaining this certification doesn't mean you can provide realistic security services to a company. In fact, this is just the first step toward true security knowledge and experience. By obtaining Security+ certification, you should be able to acquire more security experience in order to pursue more complex and in-depth security knowledge and certification.
For the latest pricing on the exam and updates to the registration procedures, please visit www.vue.com. If you have further questions about the scope of the exams or related CompTIA programs, refer to the CompTIA website at www.comptia.org.
CompTIA Security+ Review Guide: SY0-401 is designed to be a succinct, portable exam review guide. It can be used in conjunction with a more complete Security+ 2014 study guide, such as Sybex's CompTIA Security+ Study Guide: SY0-401 (ISBN: 9781118875070), computer-based training (CBT) courseware, and a classroom/lab environment; or as an exam review for those who don't feel the need for more extensive test preparation. It isn't our goal to give away the answers, but rather to identify those topics on which you can expect to be tested and to provide sufficient coverage of these topics.
Perhaps you've been working with information technologies for years. The thought of paying lots of money for a specialized IT exam-preparation course probably doesn't sound appealing. What can they teach you that you don't already know, right? Be careful, though—many experienced network administrators have walked confidently into the test center only to walk sheepishly out of it after failing an IT exam. After you've finished reading this book, you should have a clear idea of how your understanding of the technologies involved matches up with the expectations of the Security+ test makers.
Or perhaps you're relatively new to the world of IT, drawn to it by the promise of challenging work and higher salaries. You've just waded through an 800-page study guide or taken a week-long class at a local training center. Lots of information to keep track of, isn't there? Well, by organizing this book according to CompTIA's exam objectives, and by breaking up the information into concise, manageable pieces, we've created what we think is the handiest exam review guide available. Throw it in your briefcase and carry it to work with you. As you read the book, you'll be able to quickly identify those areas you know best and those that require a more in-depth review.
This book is organized according to the official objectives list prepared by CompTIA for the Security+ exam. The chapters correspond to the six major domains of objective and topic groupings. The exam is weighted across these six domains (topical areas) as follows:
Within each chapter, the top-level exam objectives from each domain are addressed in turn. In addition to a thorough review of each objective, every chapter includes two specific features: Exam Essentials and Review Questions.
Exam Essentials
At the end of each top-level objective section, you're given a short list of topics that you should explore fully before taking the test. Included in the Exam Essentials areas are notations of the key information you should have taken from that section, or from the corresponding content in the CompTIA Security+ Study Guide.
Review Questions
This feature ends every chapter and provides 10 questions to help you gauge your mastery of the chapter.
We've included several additional test-preparation features on the companion website. These tools will help you retain vital exam content as well as prepare you to sit for the actual exams:
Test Engine
We've also included the Sybex Test Engine. Using this custom test engine, you can identify weak areas up front and then develop a solid studying strategy using each of these robust testing features. Our thorough readme file will walk you through the quick, easy installation process. There are two practice exams. Take these practice exams just as if you were taking the actual exam (without any reference material). When you've finished the first exam, move on to the next one to solidify your test-taking skills. If you get more than 90 percent of the answers correct, you're ready to take the certification exams.
Electronic Flashcards
You'll find flashcards for on-the-go review. These are short questions and answers, just like the flashcards you probably used to study in school. You can answer them on your PC or download them onto a portable device for quick and convenient reviewing.
Glossary of Terms in PDF
From the companion website, we have included a very useful glossary of terms in PDF format so you can easily read it on any computer. If you have to travel and brush up on any key terms, you can do so with this useful resource.
Here are some general tips for taking your exams successfully:
www.comptia.org.CompTIA has begun to include performance-based questions on its exams. These differ from the traditional multiple-choice questions, in that the candidate is expected to perform a task or series of tasks. Tasks could include filling in a blank, answering questions based on a video or an image, reorganizing a set into an order, or filling in fields based on a given situation or set of conditions. Don't be surprised if on the exams you are presented with a scenario and asked to complete a task. For an official description of performance-based questions from CompTIA, visit http://certification.comptia.org/news/2012/10/09/What_Is_A_Performance-Based_Question.aspx.
The Security+ SY0-401 exam consists of up to 90 questions with a time allotment of 90 minutes for the exam itself. Additional time is provided for the pre-exam elements, such as the NDA, and the post-exam survey. To pass, you must score at least 750 points on a scale of 100–900. At the completion of your test, you will receive a printout of your test results. This report will show your score and the objective topics about which you missed a question.
Sybex welcomes feedback on all of its titles. Visit the Sybex website at www.sybex.com for book updates and additional certification information. You'll also find forms you can use to submit comments or suggestions regarding this or any other Sybex title.
For easy reference and clarification, the following is a complete listing of Security+ objectives. Also, we organized this book to correspond with the official objectives list. We use the objective list's order and organization throughout the book. Each domain is covered in one chapter. Each sub-objective is a heading within a chapter.
1.1 Implement security configuration parameters on network devices and other technologies.
1.2 Given a scenario, use secure network administration principles.
1.3 Explain network design elements and components.
1.4 Given a scenario, implement common protocols and services.
1.5 Given a scenario, troubleshoot security issues related to wireless networking.
2.1 Explain the importance of risk related concepts.
2.2 Summarize the security implications of integrating systems and data with third parties.
2.3 Given a scenario, implement appropriate risk mitigation strategies.
2.4 Given a scenario, implement basic forensic procedures.
2.5 Summarize common incident response procedures.
2.6 Explain the importance of security-related awareness and training.
2.7 Compare and contrast physical security and environmental controls.
2.8 Summarize risk-management best practices.
2.9 Given a scenario, select the appropriate control to meet the goals of security.
3.1 Explain types of malware.
3.2 Summarize various types of attacks.
3.3 Summarize social engineering attacks and the associated effectiveness with each attack.
3.4 Explain types of wireless attacks.
3.5 Explain types of application attacks.
3.6 Analyze a scenario and select the appropriate type of mitigation and deterrent techniques.
3.7 Given a scenario, use appropriate tools and techniques to discover security threats and vulnerabilities.
3.8 Explain the proper use of penetration testing versus vulnerability scanning.
4.1 Explain the importance of application security controls and techniques.
4.2 Summarize mobile security concepts and technologies.
4.3 Given a scenario, select the appropriate solution to establish host security.
4.4 Implement the appropriate controls to ensure data security.
4.5 Compare and contrast alternative methods to mitigate security risks in static environments.
5.1 Compare and contrast the function and purpose of authentication services.
5.2 Given a scenario, select the appropriate authentication, authorization or access control.
5.3 Install and configure security controls when performing account management, based on best practices.
6.1 Given a scenario, utilize general cryptography concepts.
6.2 Given a scenario, use appropriate cryptographic methods.
6.3 Given a scenario, use appropriate PKI, certificate management, and associated components.
Here are the acronyms of security terms that CompTIA deems important enough that they're included in the objectives list for the exam. We've repeated them here exactly as listed by CompTIA.