CoreQ Academy4.5 Given a scenario, modify enterprise capabilities to enhance security.
Scenario-heavy: given a problem, change the right control. Write a firewall rule, add a DNS filter, enable DMARC, turn on SELinux, deploy EDR.
Firewall
- Rules
- Ordered statements that permit or deny traffic, processed top down; end with an implicit or explicit deny.
- Access lists
- Lists of rules applied to interfaces or resources.
- Ports/protocols
- Allow only the specific ports and protocols needed (e.g. TCP 443).
- Screened subnets
- A network zone (formerly DMZ) between internet and internal network for public-facing services.
IDS/IPS
- Trends
- Patterns over time that reveal slow or persistent attacks.
- Signatures
- Patterns of known attacks; precise but miss new attacks. Keep them updated.
Web filter
- Agent-based
- Filtering software on each device; works off the corporate network.
- Centralized proxy
- All web traffic passes through a proxy that filters it.
- Universal Resource Locator (URL) scanning
- Checking URLs against threat intelligence before allowing access.
- Content categorization
- Blocking or allowing sites by category, such as gambling or malware.
- Block rules
- Explicit rules blocking specific sites or categories.
- Reputation
- Scoring sites and IPs by past behaviour to block risky ones.
Operating system security
- Group Policy
- Windows tool for centrally enforcing settings across domain-joined machines.
- SELinux
- Linux mandatory access control that confines processes to defined policies even if running as root.
Implementation of secure protocols
- Protocol selection
- Use secure versions: SSH not Telnet, SFTP/FTPS not FTP, HTTPS not HTTP, SNMPv3, LDAPS.
- Port selection
- Use the correct standard ports and close insecure ones.
- Transport method
- Choose encrypted transports (TLS, IPsec, SSH).
DNS filtering and email security
- DNS filtering
- Blocking resolution of known malicious or unwanted domains.
- Domain-based Message Authentication Reporting and Conformance (DMARC)
- Tells receivers what to do (none, quarantine, reject) when mail fails SPF/DKIM alignment, and sends reports.
- DomainKeys Identified Mail (DKIM)
- Signs outgoing mail with a domain key so receivers can verify it was not altered and came from the domain.
- Sender Policy Framework (SPF)
- DNS record listing which servers may send mail for a domain.
- Gateway
- Email security gateway that filters spam, malware and phishing.
Endpoint and network controls
- File integrity monitoring
- Alerts when important files (system binaries, configs) change unexpectedly.
- DLP
- Prevents sensitive data leaving.
- Network access control (NAC)
- Checks device identity and health (patches, AV) before granting network access.
- Endpoint detection and response (EDR)/extended detection and response (XDR)
- EDR records endpoint behaviour, detects and responds to threats; XDR extends this across endpoints, network, cloud and email.
- User behavior analytics
- Baselines normal user behaviour and flags anomalies like unusual data downloads.
Check your understanding
Knowledge quiz · pass mark 80%
- Which DNS record lists the servers allowed to send mail for a domain?
- Devices must prove they are patched before joining the network. Use:
- A Linux web server should be confined so a compromised process cannot read other files even as root. Enable:
- Replace Telnet for remote administration with:
- Firewall rules are generally processed top to bottom, with the first match applied.
- Which email control tells receiving servers to reject mail that fails authentication?
Original CoreQ Academy material, mapped to objective 4.5 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.