Chapter 4 of 5 · CompTIA Security+ SY0-801
Security Operations
Mitigations, assets, vulnerabilities, monitoring, identity, automation and response.
- 14topics
- 1 h 10 minfast track
- 5diagrams and exhibits
- 27%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Mitigation and Hardening TechniquesSecurity+ mitigating controls: segmentation, access controls, hardening, monitoring, mobile device management and application…5 min
- 2Sandboxing and Deception TechnologySecurity+ sandboxing and deception technology: honeypots, honeynets, honeyfiles, honeytokens and canary accounts that expose…5 min
- 3Intrusion Prevention, Firewalls and Content FiltersSecurity+ network controls: NIDS, NIPS, HIDS, HIPS and WIPS, firewall rules, WAF, UTM, Layer 4 and Layer 7, rate limiting, DLP…5 min
- 4Endpoint, Access and Email SecuritySecurity+ endpoint and email controls: EDR, XDR, antivirus, NAC with 802.1X and captive portals, SPF, DKIM, DMARC, BIMI, Group…Diagram5 min
- 5Application and Repository SecuritySecurity+ application security: secrets scanning in code repositories, input validation, secure cookies, static code analysis and…5 min
- 6Asset Management Life CycleSecurity+ asset management life cycle: planning, procurement, assignment, tracking and safe disposal using sanitization…5 min
- 7Vulnerability Management TasksSecurity+ vulnerability management: scanning, IPAM, CSPM and code review, severity and pen test review, remediation, verification…5 min
- 8Security Monitoring and AlertingSecurity+ monitoring and alerting: systems, applications and infrastructure, log aggregation, SIEM, automated alerts, dashboards…Diagram5 min
- 9Monitoring Tools and ProtocolsSecurity+ monitoring tools: benchmarks, agents, scanners, packet analyzers, NetFlow, SNMP, syslog, SCAP, port mirroring and…5 min
- 10Identity Lifecycle, Federation and Account TypesSecurity+ identity management: provisioning, permissions, identity proofing, federation, SSO with SAML, LDAP and OAuth, and user…Diagram5 min
- 11Access Control Models, MFA and PasswordsSecurity+ access control: MFA tokens and codes, rule, role, time, mandatory and discretionary models, just-in-time access…5 min
- 12Automation, Orchestration and AI in SecOpsSecurity+ automation: provisioning, desired state, anomaly detection, guardrails and risks, AI agents and chatbots, outcomes…5 min
- 13Incident Response ActivitiesSecurity+ incident response: preparation, identification, investigation, containment, negotiation, recovery, notification and…Diagram5 min
- 14Investigation Data, Artifacts and SourcesSecurity+ investigation data: log and trace types, NetFlow and IPFIX, packet captures, log integrity, memory dumps, bit-level…5 min
About this chapter
What this chapter covers
Security Operations is the day to day work of keeping an organization secure: applying mitigating controls, managing assets and vulnerabilities, watching for trouble, controlling identities, automating tasks and responding to incidents.
It is 27% of the CompTIA Security+ SY0-801 exam, the largest chapter. It has eight outline objectives, and they are spread across fourteen pages because several objectives are broad.
How the topics fit together
The pages follow the life of a system and of an incident.
- Mitigating controls cover segmentation, hardening, deception, network and endpoint tools, email and application security.
- Asset and vulnerability management keep an accurate inventory and a steady fix cycle.
- Monitoring and alerting detect problems with the right tools, protocols and tuning.
- Identity and access management controls who gets in and what they can do.
- Automation and AI speed up routine work within safe limits.
- Incident response and investigation deal with events that get through.
This chapter has many tool and protocol names. Use the tables to learn what each tool sees and does, then test yourself on them.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Take the pages in order. The first five pages all belong to the first objective, which is the largest in the chapter.
Ready for more practice?
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.