CompTIA Security+ Lessons

Every lesson is free to read, with three practice questions each. Work through them in order, or jump to the objective you need.

Practise with the exam simulator

  1. Security controls: the four categories and the six typesObjective 1.1Audio
  2. A lab you can break safely, and why your laptop is not itAudio
  3. CIA, AAA and non-repudiation, stated precisely enough to be usefulObjective 1.2Audio
  4. Zero trust, and the deception technology that sits beside itObjective 1.2Audio
  5. Change management, which is a security control and is examined as oneObjective 1.3Audio
  6. PKI, encryption and the key management that decides whether any of it worksObjective 1.4Audio
  7. Hashing, digital signatures, obfuscation and blockchainObjective 1.4Audio
  8. Threat actors, sorted by what they can afford rather than by how scary they soundObjective 2.1Audio
  9. Motivations, shadow IT, and the threat that already has a badgeObjective 2.1Audio
  10. Message, voice and file-based vectors, and the social engineering behind themObjective 2.2Audio
  11. Unsecure networks, supply chain, and the software you did not writeObjective 2.2Audio
  12. Application, web and operating-system vulnerabilitiesObjective 2.3Audio
  13. Hardware, mobile, virtualisation, cloud and supply-chain vulnerabilitiesObjective 2.3Audio
  14. Recognising malware by the evidence it leavesObjective 2.4Audio
  15. Password and cryptographic attacks, and the controls that end themObjective 2.4Audio
  16. Network, application and physical attack indicatorsObjective 2.4Audio
  17. Mitigation techniques, chosen for the vulnerability in front of youObjective 2.5Audio
  18. On-premises, cloud and virtualisation, compared by where the risk landsObjective 3.1Audio
  19. IoT, ICS/SCADA, embedded systems and infrastructure as codeObjective 3.1Audio
  20. Device placement, security zones and attack surfaceObjective 3.2Audio
  21. Firewalls, appliances and selecting the control that fitsObjective 3.2Audio
  22. Secure communication and access: VPN, tunnelling and remote workObjective 3.2Audio
  23. Data types, classification, and the protection each class earnsObjective 3.3Audio
  24. High availability, site resilience and powerObjective 3.4Audio
  25. Backups, testing, and continuity of operationsObjective 3.4Audio
  26. Secure baselines, and hardening the targets that appear on the examObjective 4.1Audio
  27. Wireless, mobile deployment, application security and sandboxingObjective 4.1Audio
  28. Asset management, from purchase order to certificate of destructionObjective 4.2Audio
  29. Vulnerability management, end to endObjective 4.3Audio
  30. Alerting and monitoring, and the tools CompTIA namesObjective 4.4Audio
  31. Modifying firewalls, IDS/IPS and the filtering layersObjective 4.5Audio
  32. DLP, NAC, EDR/XDR and email securityObjective 4.5Audio
  33. Provisioning identity, single sign-on and federationObjective 4.6Audio
  34. Multifactor authentication, password concepts and privileged accessObjective 4.6Audio
  35. Automation and orchestration, and when not to automateObjective 4.7Audio
  36. The incident response process, and the preparation that decides the outcomeObjective 4.8Audio
  37. Root cause analysis, threat hunting and digital forensicsObjective 4.8Audio
  38. Reading log data and other sources to support an investigationObjective 4.9Audio
  39. Governance structures, and who is allowed to decideObjective 5.1Audio
  40. Policies, standards, procedures and guidelines, and the difference between themObjective 5.1Audio
  41. Risk identification, assessment and analysisObjective 5.2Audio
  42. The risk register, appetite, response strategies and business impactObjective 5.2Audio
  43. Third-party risk: assessing and selecting a vendorObjective 5.3Audio
  44. Agreements, and monitoring a vendor after the ink driesObjective 5.3Audio
  45. Compliance, privacy, and the cost of getting it wrongObjective 5.4Audio
  46. Audits, assessments and where penetration testing fitsObjective 5.5Audio
  47. Security awareness that changes behaviour rather than completion ratesObjective 5.6Audio