Chapter 4 of 5 · CompTIA Security+ SY0-701

Security Operations

Hardening, assets, vulnerabilities, monitoring, identity, automation and response.

  • 13topics
  • 52 minfast track
  • 4diagrams and exhibits
  • 28%of the exam
Start with Secure Baselines and Hardening Targets

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Secure Baselines and Hardening TargetsSecurity+ secure baselines and hardening: the establish, deploy and maintain cycle, drift, and hardening for servers, network…4 min
  2. 2Wireless and Mobile Device SecuritySecurity+ wireless and mobile security: site surveys, WPA2 and WPA3, 802.1X enterprise Wi-Fi, MDM features, and the BYOD, COPE…4 min
  3. 3Application Security TechniquesSecurity+ application security: input validation, secure cookies, static and dynamic analysis, fuzzing, code signing, sandboxing…4 min
  4. 4Asset Management and DisposalSecurity+ asset management: acquisition, ownership, inventory, enumeration, retention and safe disposal using sanitization…4 min
  5. 5Vulnerability ManagementSecurity+ vulnerability management: scans, threat feeds, bug bounties, CVE and CVSS scoring, prioritization, remediation options…4 min
  6. 6Security Monitoring and AlertingSecurity+ monitoring and alerting: log aggregation, SIEM correlation, NetFlow, SNMP, SCAP, benchmarks, agents, alert tuning…Diagram4 min
  7. 7Network Security Capabilities and ProtocolsSecurity+ network controls: firewall rules, IDS and IPS, web and DNS filtering, and secure protocols with their port numbers such…4 min
  8. 8Endpoint, Email and Data Security ToolsSecurity+ endpoint and email tools: Group Policy, SELinux, SPF, DKIM, DMARC, file integrity monitoring, DLP, NAC, EDR, XDR and…Diagram4 min
  9. 9Identity Lifecycle and FederationSecurity+ identity management: provisioning, deprovisioning, privilege creep, attestation, SSO, federation, SAML, OAuth, OpenID…Diagram4 min
  10. 10Access Control Models and AuthenticationSecurity+ access control models MAC, DAC, RBAC and ABAC, plus authentication factors, MFA, password practice and privileged…4 min
  11. 11Automation and OrchestrationSecurity+ automation and orchestration: use cases, guard rails, SOAR playbooks, benefits such as speed and scale, and risks like…4 min
  12. 12Incident Response ProcessSecurity+ incident response: stages from preparation to lessons learned, tabletop and simulation exercises, root cause analysis…Diagram4 min
  13. 13Digital Forensics and Data SourcesSecurity+ digital forensics and investigation data: legal hold, chain of custody, order of volatility, log sources, metadata and…4 min

About this chapter

What this chapter covers

Security Operations is the day to day work of keeping an organization secure: configuring systems, managing assets and vulnerabilities, watching for trouble, controlling identities, automating tasks and responding to incidents.

It is the largest chapter of the Security+ SY0-701 exam. It has nine outline topics, and they are spread across thirteen pages because each topic is broad.

How the topics fit together

The pages follow the life of a system and of an incident.

Secure setupbaselines, wireless, appstracked byAssets and vulnerabilitiesinventory, scanswatched byMonitoringlogs and toolscontrolled byIdentityaccounts and accesshandled byResponseincident and forensics
  • Secure setup covers baselines, hardening, wireless and mobile devices, and application security.
  • Asset and vulnerability management keep an accurate inventory and a steady fix cycle.
  • Monitoring and enterprise capabilities detect problems and tune the tools in use.
  • Identity and access management controls who gets in and what they can do.
  • Automation speeds up routine work.
  • Incident response and investigation deal with events that get through.
Exam tip

This chapter has many protocol names, ports and tool names. Use the tables to learn the pairs, then test yourself on them.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with diagrams and tables.
  • What to remember for the exam: the facts to memorise.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Take the pages in order, but return to the secure protocols table often, since ports and protocol names come up in several domains.

Ready for more practice?

The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.