CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

EAP — Extensible Authentication Protocol — is a framework, not a single protocol. It defines how authentication messages are carried; the individual methods define what actually happens. WPA2 and WPA3 Enterprise use EAP over 802.1X, and the exam expects you to distinguish the common methods. Where EAP sits In 802.1X the roles are supplicant (the client), authenticator (the access point or switch) and authentication server (usually RADIUS). EAP messages travel from supplicant to authenticator encapsulated in EAPOL — EAP over LAN — and from authenticator to server inside RADIUS. The authenticator relays without understanding the method, which is why adding a new EAP method needs changes only at the client and the server. The methods Method Server certificate Client certificate Security EAP-TLS Required Required Strongest PEAP Required No Strong EAP-TTLS Required Optional Strong EAP-FAST Optional (PAC) Optional Moderate LEAP No No Broken — do not use EAP-MD5 No No Broken —...

Part 1 covered how malware arrives and Part 2 covered what it does. This article covers the two problems every attacker must solve after that: staying hidden, and surviving a reboot. Rootkits and the level they operate at A rootkit hides the presence of malware by interfering with what the system reports about itself. What it can hide depends entirely on how deep it runs, and the exam cares about that hierarchy. User-mode rootkits hook application-level functions, so a process or file is missing from a listing produced by normal tools. They are the easiest to write and the easiest to find, because anything querying the kernel directly sees past them. Kernel-mode rootkits load as a driver and manipulate the operating system's own data structures. At that point the system is lying to every tool running on it, including security software, because they are all asking the compromised kernel. Driver signing requirements and kernel integrity protections exist specifically to make...

Part 1 classified malware by how it arrives. This article classifies it by what it does once it is running — the payload — because that is what determines your impact, your response, and which control would have helped. Ransomware Ransomware encrypts data and demands payment for the key. It is the payload with the clearest business impact, and the model has evolved in ways worth knowing. Double extortion is now standard: data is stolen before it is encrypted, so paying for decryption does not remove the threat of publication. This broke the reasoning that good backups make ransomware survivable — backups restore availability and do nothing about disclosure, which is a breach requiring notification regardless of whether you paid. Modern operations are human-operated rather than automatic. Attackers gain access, spend days moving laterally and stealing credentials, identify and destroy backups, then deploy encryption everywhere at once. That dwell time is also the...

Malware is classified two different ways, and mixing them up is the fastest route to a wrong answer. One axis is how it gets there — propagation. The other is what it does once it arrives — payload. A single sample usually has one of each: a trojan that delivers ransomware, or a worm that installs a backdoor. This article covers propagation. Part 2 covers payloads, and Part 3 covers stealth and persistence. Viruses A virus attaches itself to a host file or program and spreads when a user executes that host. It cannot run on its own, and it cannot spread without human action — that dependency is its defining characteristic. Subtypes appear on exams. A boot sector virus infects the boot record and loads before the operating system. A macro virus lives in a document's scripting language, which is why macros from the internet are disabled by policy in any well-run environment. A polymorphic virus changes its own code each time it replicates to defeat signature mat...

Both A+ and Linux+ test command-line knowledge, at very different depths. A+ expects recognition of common commands and what they do; Linux+ expects you to use them with options and combine them. Grouping by task makes them easier to hold than an alphabetical list. Navigation and inspection pwd prints the working directory. cd changes it — cd ~ for home, cd - for the previous directory. ls lists; ls -l gives the long format with permissions and ownership, ls -a includes hidden files beginning with a dot, and ls -lh gives human-readable sizes. find searches the filesystem by name, size, age or type. locate is faster because it queries a pre-built database, at the cost of being only as current as the last database update. which shows the path of an executable. Files and directories cp copies, with -r for directories. mv moves and also renames. rm removes, rm -r recursively — and rm -rf deletes without prompting and without mercy, which is worth respecting. mkdir -p...

Linux permissions look cryptic until you see the pattern, and then they are genuinely simple. Every file and directory has an owner, a group, and a set of three permissions applied to three categories of user. That is the whole model. Three permissions — read, write, execute — applied to three audiences: the owner, the group, and everyone else. Reading the Output of ls -l A listing line begins with something like -rwxr-xr-- . Ten characters, and each position means something specific. Position 1: the file type. - is a regular file, d a directory, l a symbolic link, c a character device, b a block device. Positions 2–4: the owner's permissions. Positions 5–7: the group's permissions. Positions 8–10: everyone else — "other". So -rwxr-xr-- is a regular file where the owner can read, write and execute; the group can read and execute; and everyone else can only read. The Numeric Shorthand Each permission has a value, and you add them. Permissio...

Symmetric encryption uses one key for both encryption and decryption. That single fact produces both its great advantage — it is fast, by orders of magnitude — and its central difficulty: everyone who needs to read the data needs the key, and getting the key to them safely is a harder problem than the encryption itself. AES, and What Came Before AES is the standard, with key sizes of 128, 192 and 256 bits and a fixed 128-bit block size. All three key sizes remain secure; 256-bit is chosen for long-lived data and where regulation requires it, not because 128-bit is broken. The historical ciphers still appear as distractors. DES used a 56-bit key and is trivially brute-forced today. 3DES applied DES three times to extend the effective key length and is now deprecated, partly for weakness and partly because its 64-bit block size makes collisions practical on large data volumes. RC4 , a stream cipher, is broken and removed from TLS. Blowfish and Twofish are secure but...

Asymmetric encryption uses two mathematically related keys instead of one shared secret. What one key locks, only the other can unlock — and knowing the public key does not let you derive the private one. That property solves the problem symmetric cryptography cannot: establishing security with someone you have never met and share no secret with. The key distribution problem it solves Symmetric encryption is fast and requires both parties to already hold the same key. Getting that key to the other party securely is the difficulty, and it does not scale — n parties who all need to talk privately require a key pair count that grows quadratically. With asymmetric cryptography each party has one key pair. The public key is published freely; the private key never leaves its owner. Anyone can encrypt to you using your published key, and only you can read the result. The number of keys grows linearly, and no secret has to be exchanged beforehand. Two operations, opposite dir...

I am a CompTIA Certified Instructor. I do not work for CompTIA, but rather a technical training school. My main job is as a Network Administrator. My specialty on the teaching side is as a Boot Camp Instructor for CompTIA's A+, Network+, and Security+ classes. Classes begin on Monday morning, and the class takes the exam on Friday at 1:00PM. Over 90% of my students have to pass the class t keep their jobs. Most of the students work for the Department of Defense contractors and need this certification to comply with the DOD 8570 directive. Eighty-five percent of the individuals do jobs other than network administration. The majority are software engineers. My current pass rate is 93%.  Unlike most boot camps, I do not teach from a brain dump, but instead, teach concepts. My goal in this blog will be to educate exam candidates on the concepts of what is covered in the SYO-501 exam.  I hope to add at least two objectives each day until all of the objectives are covere...