Security Operations · Topic 4 of 14
Endpoint, Access and Email Security
Security+ endpoint and email controls: EDR, XDR, antivirus, NAC with 802.1X and captive portals, SPF, DKIM, DMARC, BIMI, Group Policy and SELinux.
- 5 min
- Includes a diagram
- Antivirus finds known malware. EDR watches endpoint behavior and can isolate hosts. XDR correlates across many sources.
- NAC checks identity and device posture before granting access, and can quarantine failing devices.
- 802.1X is port-based access control with a supplicant, an authenticator and an authentication server.
What it is
This page covers the controls that protect endpoints, the network edge where devices connect, email and operating systems. They are endpoint security tools, network access control, email authentication standards and operating system policy tools.
Each tool addresses a specific gap. The exam asks you to choose the tool that matches the problem described.
How it works
Endpoint security
| Tool | Focus |
|---|---|
| Antivirus | Detects and removes known malware, mostly by signatures, with some heuristic checks |
| Endpoint detection and response (EDR) | Records detailed activity on endpoints, detects suspicious behavior and allows response such as isolating the host |
| Extended detection and response (XDR) | Combines data from endpoints, network, cloud, email and identity for broader correlation and response |
Antivirus is good at known threats but weak against new ones. EDR watches behavior, such as a document program starting a command shell, so it can catch attacks with no known signature. XDR joins those signals with others, so one attack seen in email, on a laptop and in the cloud appears as one incident.
Network access control
Network access control (NAC) checks a user or device when it connects and decides what access it gets.
| Feature | Meaning |
|---|---|
| 802.1X | Port-based access control: the device (supplicant) asks the switch or access point (authenticator) for access, and an authentication server checks the credentials or certificate before the port opens |
| Endpoint posture and compliance | NAC checks device health, such as patch level, antivirus status and disk encryption, before granting access |
| Captive portal | A web page that users must pass, by signing in or accepting terms, before they get network access, common on guest networks |
A device that fails a posture check can be denied or placed in a restricted quarantine network where it can only reach update servers.
Email security
Four Domain Name System (DNS) based standards help prove that mail is genuine.
| Standard | Purpose |
|---|---|
| Sender Policy Framework (SPF) | A DNS record lists the servers allowed to send mail for a domain |
| DomainKeys Identified Mail (DKIM) | The sending server signs messages, and receivers check the signature with a public key published in DNS |
| Domain-based Message Authentication, Reporting, and Conformance (DMARC) | A policy that tells receivers what to do when SPF or DKIM checks fail (none, quarantine or reject) and sends reports to the domain owner |
| Brand Indicators for Message Identification (BIMI) | Lets a sender's brand logo appear next to authenticated mail in supporting email clients |
BIMI builds on DMARC. The domain must have a DMARC policy at enforcement, quarantine or reject, before receivers will show the logo. Together these standards reduce spoofing and phishing that pretend to come from the organization.
Operating systems security
| Tool | What it does |
|---|---|
| Group Policy | Central control of settings on Windows computers and users in an Active Directory domain |
| Security-Enhanced Linux (SELinux) | Adds mandatory access control to Linux, limiting what each process can reach |
Group Policy pushes password rules, firewall settings, software restrictions and other configuration to many machines at once. SELinux restricts a process to the files and ports its policy allows, so a compromised web service cannot read files outside its policy. SELinux runs in enforcing, permissive or disabled mode, and permissive mode only logs what it would block.
Choosing the right tool
| Need | Tool |
|---|---|
| Push the same settings to many Windows machines | Group Policy |
| Stop a compromised Linux service reading other files | SELinux |
| Stop spoofed mail from your domain | SPF, DKIM and DMARC |
| Show your verified logo in recipients' inboxes | BIMI |
| Keep unpatched devices off the network | NAC with posture checks |
| Authenticate each device before a switch port opens | 802.1X |
| Investigate and isolate a suspect laptop | EDR |
| Correlate endpoint, cloud and email signals | XDR |
How the exam asks about this
- "Receivers should reject mail that fails SPF and DKIM checks for our domain." -> A DMARC policy set to reject.
- "Visitors must accept the terms of use before using the guest network." -> A captive portal.
- "Laptops missing patches should be sent to a remediation network." -> NAC with endpoint posture checks.
What to remember for the exam
- Antivirus finds known malware. EDR watches endpoint behavior and can isolate hosts. XDR correlates across many sources.
- NAC checks identity and device posture before granting access, and can quarantine failing devices.
- 802.1X is port-based access control with a supplicant, an authenticator and an authentication server.
- A captive portal is a sign in or terms page, common for guest access.
- SPF lists allowed senders, DKIM signs messages, and DMARC sets the policy and reports.
- BIMI shows a brand logo and requires DMARC at enforcement.
- Group Policy manages Windows settings centrally. SELinux provides mandatory access control on Linux.
For "prove that email really came from our domain", think SPF, DKIM and DMARC, with DMARC tying them together with a policy.
Common mistakes
Mixing up SPF and DKIM. SPF checks the sending server. DKIM checks a signature on the message.
Believing DMARC works alone. It builds on SPF and DKIM results.
Thinking BIMI authenticates mail. It displays a logo for mail that has already passed DMARC.
Using EDR and XDR interchangeably. EDR is limited to endpoints, and XDR gathers more kinds of data.
Leaving SELinux in permissive mode. Permissive mode only logs and does not block.
A device that fails a NAC check may still need limited access to get updates. Plan a quarantine network rather than a plain block.
Check yourself
Which email standard tells receivers what to do when SPF or DKIM checks fail?
DMARC.
What does NAC posture checking verify?
The health of the device, such as patch level, antivirus status and encryption, before it gets network access.
How does EDR differ from XDR?
EDR focuses on endpoint activity, while XDR combines data from endpoints, network, cloud, email and other sources.
Topic 4 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.