CompTIA Security+ Domains 4 & 5

Security Orchestration Automation and Response. Playbooks that automate enrichment and response steps.

Endpoint Detection and Response. Watches endpoint behavior and can isolate a host.

Extended Detection and Response. Correlates signals across endpoint, network, email, cloud, and more.

User and Entity Behavior Analytics. Spots weird activity relative to a normal baseline.

File Integrity Monitoring. Alerts when critical files change unexpectedly.

Mobile Device Management. Enforce lock screens, encryption, wipe, and app controls on phones and tablets.

Bring Your Own Device. Personal device used for work. Needs containers or strong separation.

Corporate Owned Personally Enabled. Company owns the device, employee can still use it personally under policy.

Reduce attack surface. Patch, disable unused services, kill default accounts, enforce baselines.

Approved minimum config for a system type. Drift detection finds unauthorized changes.

Only approved apps or traffic are permitted. Deny by default.

Find, test, deploy, and verify updates that close known vulnerabilities.

Vuln scan that logs in. Sees patch level and local config better than an outside scan.

Outside view of exposed services. Good for what an attacker can see without a login.

Automated check for known weaknesses. Does not fully exploit them like a pen test.

Authorized attempt to exploit weaknesses and prove real impact. Needs written permission.

Adversary simulation that tests detection and response, not just whether a hole exists.

Defenders who monitor, detect, and respond.

Red and blue work together to improve controls and detections faster.

Before an incident: plans, contacts, tools, logging, and training.

Confirm something is an incident, scope it, and assign severity.

Stop the bleeding. Isolate hosts, disable accounts, block IOCs.

Remove the cause. Wipe malware, close the hole, reset credentials.

Bring systems back carefully and watch for reinfection.

After action review. Update playbooks and controls so the next event goes better.

Document who handled evidence, when, and why. Breaks in the chain wreck court use.

Collect the most fleeting evidence first: CPU/cache, RAM, network state, then disk, then backups.

Hardware or software that lets you read a drive without changing it.

Bit for bit copy of media used for analysis while preserving the original.

Stop deleting or altering records that may be needed for an investigation or lawsuit.

Hash evidence before and after imaging to prove nothing changed.

Role Based Access Control. Permissions follow job roles.

Attribute Based Access Control. Decisions use attributes like department, device health, or location.

Mandatory Access Control. System enforced labels. Users cannot casually override them.

Discretionary Access Control. Resource owners decide who gets access. Flexible but messy.

Privileged Access Management. Vaults, session recording, and just in time admin rights.

Just in time privilege. Temporary elevation instead of permanent admin.

Single Sign On. One login unlocks many apps.

Trust another identity provider for authentication.

XML based federation protocol common for enterprise web SSO.

Delegated authorization. Lets an app act with limited access without sharing the user password.

OpenID Connect. Identity layer on top of OAuth 2.0. This is the login piece.

Ticket based network authentication. Core of many Windows domains.

Central AAA for VPN, WiFi, and network devices.

Device admin AAA that cleanly separates authentication, authorization, and accounting.

Directory access protocol. Query users and groups. Prefer LDAPS in production.

Multifactor Authentication. Combine factors like something you know, have, and are.

Phishing resistant passwordless auth using public key crypto. Often with WebAuthn.

Remove accounts and access when someone leaves or changes roles. Automate this if you can.

Sender Policy Framework. Lists which servers may send mail for a domain.

DomainKeys Identified Mail. Cryptographic signature on outbound email.

Policy and reporting that builds on SPF and DKIM alignment. Helps stop spoofing.

Filters spam, malware, and phishing before mail hits the inbox.

Detonate a file or URL in an isolated environment before trusting it.

Firmware verifies bootloader signatures so unsigned boot malware has a harder time.

Encrypt the whole volume so a stolen laptop does not spill plaintext files.

Filters traffic on the individual endpoint.

Only approved binaries can run. Strong ransomware control when done well.

Same account appears in distant places too quickly to be real. Strong identity risk signal.

Repeatable response steps for a known incident type.

High level management statement of intent. What must be true.

Mandatory specific requirement that supports a policy.

Step by step instructions for how to do something.

Minimum secure configuration for a system class.

Chance that a threat exploits a vulnerability and causes impact.

Potential cause of harm. Who or what could hurt you.

Weakness that can be exploited.

Risk before you apply controls.

Risk left after controls. Someone still owns that leftover.

How much risk leadership is willing to live with.

Living list of risks, owners, ratings, and treatment status.

Stop doing the risky activity altogether.

Reduce likelihood or impact with controls.

Shift impact through insurance or contracts.

Knowingly keep the residual risk with an owner sign off.

Single Loss Expectancy. Asset value times exposure factor for one incident.

Annualized Rate of Occurrence. How often you expect the incident per year.

Annualized Loss Expectancy. SLE times ARO. Useful for comparing control cost to loss.

Business Impact Analysis. Identifies critical processes and what downtime actually costs.

Business Continuity Plan. Keep the business running through disruption.

Disaster Recovery Plan. Restore IT systems after a disaster.

Continuity of Operations. Keep essential functions going under stress.

Research and assessment before you trust a vendor or decision.

Ongoing responsible action after you already know the risks.

Service Level Agreement. Contracted uptime or support expectations.

Nondisclosure Agreement. Contractual secrecy obligations.

Contract language letting you assess a vendor security posture.

Data Processing Agreement. Spells out how a vendor may handle personal data.

End access, return or destroy data, and close accounts when a vendor relationship ends.

Software Bill of Materials. Inventory of components in software so you can track inherited risk.

Payment Card Industry Data Security Standard. Rules for handling cardholder data.

EU privacy regulation for personal data. Consent, rights, and breach notice expectations matter.

US health data privacy and security rules for protected health information.

US standards body. Cybersecurity Framework and many SP 800 docs show up on exams.

International standard for an information security management system.

Independent report on a service org controls, often used in vendor reviews.

How long you keep data. Over retention increases breach blast radius.

Laws of the country where data lives can control how that data may be handled.

Teach people how phishing, reporting, and policy look in real life. Humans are a control.

Controlled process for changes: request, approve, test, backout plan, maintenance window.

How you reverse a failed change and restore the prior working state.

Scheduled time for disruptive changes with stakeholders warned.

Independent or internal check that controls exist and work as claimed.

Artifacts that prove a control operated: logs, tickets, screenshots, configs.

A security event that threatens confidentiality, integrity, or availability and needs response.

Legal or contractual duty to tell affected parties or regulators after certain incidents.

Risk introduced by vendors, partners, and supply chain dependencies.

Rules for how employees may use company systems and data.