Security+ level · Domain 4.0 Security Operations · 28% of the mapped exam

4.1 Given a scenario, apply common security techniques to computing resources.

32 topics · 6 quiz questions · 1 hands-on lab

Day-to-day security work: build secure baselines, harden each type of device, deploy wireless and mobile securely, and write applications that resist common attacks.

Secure baselines

Establish: Define the secure configuration for each system type, often from CIS Benchmarks or vendor guides.
Deploy: Apply the baseline consistently with automation (Group Policy, MDM, configuration management, golden images).
Maintain: Check for drift, update the baseline as threats and software change, and re-apply.

Hardening targets

Mobile devices: Screen lock, encryption, MDM enrollment, app store restrictions, remote wipe.
Workstations: Patching, EDR, host firewall, no local admin rights, disk encryption.
Switches: Disable unused ports, port security, secure management (SSH not Telnet), change defaults.
Routers: Secure management, ACLs, disable unused services, authenticated routing updates.
Cloud infrastructure: Least-privilege IAM, no public storage by default, logging enabled, security groups tight.
Servers: Minimal installed roles, patching, logging, restricted admin access.
ICS/SCADA: Segment from IT networks, restrict remote access, monitor passively, compensate where patching is impossible.
Embedded systems: Change defaults, update firmware where possible, isolate.
RTOS: Limit network exposure, vendor-supported updates, segment.
IoT devices: Separate network, change default credentials, disable unneeded features, update firmware.

Wireless devices

Site surveys: Physically measuring the wireless environment to plan access point placement and find rogue or interfering signals.
Heat maps: Visual maps of signal strength across a site, used to fix coverage gaps and limit signal leaking outside the building.

Mobile solutions

Mobile device management (MDM): Central tool to enforce policies, deploy apps, and lock or wipe devices.
Bring your own device (BYOD): Employees use personal devices; privacy vs. control trade-off. Containerisation separates work data.
Corporate-owned, personally enabled (COPE): Company owns the device but allows personal use; more control than BYOD.
Choose your own device (CYOD): Employee picks from approved company-owned models.
Cellular: Mobile network connection; generally encrypted but subject to SIM swapping and rogue base stations.
Wi-Fi: Use WPA3 and avoid open public networks without VPN.
Bluetooth: Disable when not needed; avoid discoverable mode; pair carefully.

Wireless security settings

Wi-Fi Protected Access 3 (WPA3): Current Wi-Fi security standard; uses SAE instead of a pre-shared key handshake, resisting offline password guessing.
AAA/Remote Authentication Dial-In User Service (RADIUS): Central server that authenticates wireless users individually (WPA3-Enterprise with 802.1X).
Cryptographic protocols: Use strong ones (WPA3, AES/CCMP or GCMP). Avoid WEP and TKIP.
Authentication protocols: EAP methods such as EAP-TLS (certificates, strongest) and PEAP (password inside a TLS tunnel).

Application security

Input validation: Check all input against what is expected (type, length, format) on the server side. Stops many injection attacks.
Secure cookies: Set Secure (HTTPS only), HttpOnly (no JavaScript access) and SameSite flags on session cookies.
Static code analysis: Scanning source code without running it to find flaws (SAST).
Code signing: Signing software with a certificate so users can verify it is authentic and unmodified.
Sandboxing: Running code in an isolated environment so it cannot affect the rest of the system.
Monitoring: Logging and watching applications for errors and attacks.

Hands-on practice

Check your understanding

< 3.4 previous 4.2 next >

Original CoreQ Academy material, mapped to objective 4.1 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.