CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

  Data Poisoning Explained: Attacking AI  Training Data for SecurityX and SecAI+ Sep 27, 2026 · @Ken What Is Data Poisoning? Most attacks target a system after it is built. Data poisoning targets it while it is still learning. In a data poisoning attack , an adversary deliberately manipulates the data a machine learning model trains on, so that the finished model carries a flaw the attacker chose. The model is not exploited later — it is built wrong from the start. Nothing in the running system is misconfigured, and no code is vulnerable. The weights themselves are the vulnerability. That timing is the single most important distinction for both exams: Data poisoning happens at training time . The attacker corrupts the learning process. Evasion attacks (adversarial examples) happen at inference time . The model is fine; the attacker crafts an input that fools it. Prompt injection also happens at inference time , against a language model, through the input channel. Model inv...

 Wireless Disassociation Attacks: A Security+, PenTest+, and Network+ Exam Prep Guide What Is a Disassociation Attack? A disassociation attack is the close cousin of a deauthentication attack: it abuses the same weakness in 802.11 — unauthenticated, unencrypted management frames — but sends a different frame type. A forged disassociation frame tells a client it is no longer associated with the access point (AP), knocking it off the network without touching the authentication state underneath. The two attacks get grouped together on every exam because their real-world effect is nearly identical: the client drops and must reconnect. But the distinction between association and authentication is exactly the kind of detail these exams like to test, which is why disassociation earns its own explanation rather than a footnote on the deauth article.

 Deauthentication Attacks: A Security+, PenTest+, and Network+ Exam Prep Guide What Is a Deauthentication Attack? A deauthentication attack exploits a weakness in the 802.11 wireless standard: management frames — the frames that handle association, authentication, and disconnection — were never encrypted or authenticated in the original protocol. An attacker who can spoof the source address of an access point or client can send a forged deauthentication frame , and the receiving device disconnects immediately, no credentials required. This single trick shows up across three exams because it's genuinely multi-purpose: it's a denial-of-service technique, a stepping stone to capturing a WPA/WPA2 handshake, and the forcing function behind most evil twin attacks. Security+, PenTest+, and Network+ each test it from a different angle — defending against it, executing it under authorization, and recognizing it as a troubleshooting symptom, respectively.

 Deserialization Attacks: A CEH and PenTest+ Exam Prep Guide What Is a Deserialization Attack? Serialization converts an in-memory object into a byte stream or string so it can be stored or sent over a network; deserialization reverses the process, rebuilding the object on the other end. Most application frameworks do this constantly — session tokens, cached objects, and API payloads all pass through serialization at some point. An insecure deserialization attack happens when an application deserializes data from an untrusted source without first verifying it. Because the deserialization process itself can trigger code execution — not just rebuild harmless data — an attacker who controls the serialized input can potentially hijack that process entirely. For both CEH and PenTest+, this sits under the OWASP Top 10: it was A8:2017-Insecure Deserialization and now lives inside A08:2021-Software and Data Integrity Failures , alongside other attacks that abuse an application's trust i...

 Bluto Explained: CEH and PenTest+ Exam Prep Guide What Is Bluto? Bluto is a Python-based reconnaissance tool built for the earliest phase of an engagement: passive and active DNS and OSINT footprinting . In one run, it can attempt a DNS zone transfer, brute-force subdomains against a wordlist, and harvest email addresses and metadata tied to a target domain from public sources. It matters to both CEH and PenTest+ candidates because it packages several classic footprinting techniques — the kind exam questions describe individually — into a single utility. Knowing what Bluto does is  shorthand for understanding what  zone transfers ,  subdomain enumeration , and  email harvesting   reveal about a target, and why a real engagement almost always starts here rather than jumping straight to scanning or exploitation.

  STP Attacks: A CompTIA Pentest &  CEH Exam Prep Guide What Is an STP Attack? Every switched network with redundant links relies on the Spanning Tree Protocol (STP) to prevent Layer 2 loops. STP works quietly in the background, electing a root bridge and blocking backup paths so frames can't circle endlessly and melt down the network with a broadcast storm. That quiet trust is exactly what attackers exploit. An STP attack targets this loop-prevention logic itself. By injecting forged Bridge Protocol Data Units (BPDUs), an attacker can force the switched network to recalculate its topology, seize the root bridge role, or trigger a denial-of-service condition. For the CEH exam, STP attacks sit alongside VLAN hopping, ARP spoofing, and MAC flooding as core Layer 2 network-based attacks you're expected to recognize, execute conceptually, and defend against.

  The video above walks through the whole DHCP exchange step by step. This write-up covers the same ground in text, so you can review it quickly before exam day or jump straight to the part you need. DHCP appears on both the CompTIA A+ and Network+ exams, and the heart of it is a four-message exchange known as DORA.

 Link Aggregation Explained:  A CompTIA Network+ Study Guide Eventually, a single cable between two switches isn't enough. Traffic grows, users complain, and one failed port can take down a whole floor. Buying faster hardware is one fix. A cheaper, more resilient option is to bundle the links you already have. That's link aggregation, and you should expect it on the CompTIA Network+ exam, where it appears in the Network Implementation domain alongside other Ethernet switching features like VLANs, 802.1Q tagging, and spanning tree. This guide covers what link aggregation is, how it works, the protocols behind it, and the details the exam likes to test.

Obfuscation: A Security+ Exam Prep Obfuscation is a data protection concept that CompTIA Security+ candidates must understand before test day. It appears in questions about protecting sensitive data, hiding information in plain sight, and how attackers conceal malicious code. This guide breaks down obfuscation from a Security+ perspective, including the three techniques CompTIA tests most often, key comparisons, exam scenarios, and a practice question. What Is Obfuscation? Obfuscation is the practice of making information difficult to understand, interpret, or recognize without necessarily encrypting it. The goal is not to make data mathematically unreadable. The goal is to make data confusing, hidden, or meaningless to anyone who should not be using it. Simple Definition Obfuscation hides the meaning of data rather than locking the data itself. For example: A credit card number displayed as ****-****-****-4416 A customer record replaced by a random reference value A secre...

 Acquisition in Digital Forensics:  Security+ and CySA+ Exam Prep Security+ SY0-701 Domain 4.8 · CySA+ CS0-004 Incident Response & Management Acquisition is the moment digital forensics either succeeds or quietly fails. It's the step where an analyst captures evidence from a live or compromised system — and if that capture is done sloppily, every conclusion built on top of it is worthless, no matter how good the later analysis is. Security+ tests whether you know what proper acquisition looks like. CySA+ tests whether you can make the right acquisition call under the pressure of an active incident. This article covers both. What acquisition actually means In the forensic process, acquisition is the step where data is copied from its original source — a hard drive, RAM, a network device, a cloud service — into a form that can be preserved and analyzed without altering the original. It sits right after evidence is identified and before it's formally analyzed, and it's...

  Here is a Security+ (SY0-701) Exam Cram Guide for the topics most frequently tested. CIA Triad + Non-Repudiation Confidentiality Goal: Prevent unauthorized disclosure of data. Keywords Encryption Access control Permissions Data classification Need-to-know Least privilege Data masking Tokenization Examples AES encryption TLS/HTTPS VPNs File permissions MFA Exam Tip If the question is about keeping information secret, think Confidentiality. Examples: Encrypting emails Securing customer data Preventing unauthorized viewing Integrity Goal: Ensure data is accurate and has not been altered. Keywords Hashing Digital signatures Checksums Change management File integrity monitoring Examples SHA-256 MD5 (not secure, but tested) Digital signatures Certificates Exam Tip If the question asks whether data was modified, think Integrity. Examples: Verifying a downloaded file Detecting tampering Validating data accuracy Availability Goal: Ensure systems and data are accessible when needed. Ke...