CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

Geographic restrictions — also called geofencing , geolocation-based access control , or simply geo-blocking — limit access to systems and data based on where the request appears to originate. They show up on the Security+ exam in two distinct contexts, and conflating them is the common mistake. Geographic restrictions are used both as an access control, deciding who may connect, and as a compliance control, deciding where data may physically live. The Two Uses As an access control. If your organization operates only in North America, there is no legitimate reason for an authentication attempt from another continent. Blocking or challenging those requests removes a large volume of opportunistic attack traffic immediately, and it is one of the cheapest risk reductions available. As a compliance control — data sovereignty. A great many regulations require that certain data stay within a jurisdiction. GDPR constrains transfers of EU personal data outside the EEA. Various nation...

Identity and access management is the set of processes that decide who exists in your systems, what they may do, and when that stops being true. It is less glamorous than most security work and it is where a large share of breaches actually begin — through an account that should have been disabled, or one with permissions nobody could justify. The four pillars Identification is the claim: this is who I am. Authentication is proving it. Authorization is what that proven identity may do. Accounting is the record of what it did. Exam questions often hinge on separating authentication from authorization. A user who signs in successfully and then gets a permission error has authenticated and failed authorization — two different systems, two different fixes. The lifecycle Joiner. An account is created with the access appropriate to the role, ideally driven automatically from the HR system so the authoritative source of "who works here" is the system that knows. Manual ...

Access control models define who decides what a subject may do with an object. Security+ tests five, and the questions are nearly always scenarios where one phrase identifies the model. The five models Model Who decides Scenario clue DAC — discretionary The data owner "The file owner grants access" MAC — mandatory The system, by policy Clearances and classification labels RBAC — role-based Assigned roles "Members of the Accounting role" ABAC — attribute-based Evaluated attributes Conditions: department, time, location, device Rule-based Predefined rules Firewall ACLs, time-of-day restrictions Discretionary access control The owner of a resource decides who may access it and can pass that permission on at their discretion. Standard file systems work this way — NTFS permissions and Linux file permissions are both DAC. It is flexible and it is why most data sprawls. A user can share a sensitive file with anyone, and nothing at the system level prevents it. ...

Linux permissions look cryptic until you see the pattern, and then they are genuinely simple. Every file and directory has an owner, a group, and a set of three permissions applied to three categories of user. That is the whole model. Three permissions — read, write, execute — applied to three audiences: the owner, the group, and everyone else. Reading the Output of ls -l A listing line begins with something like -rwxr-xr-- . Ten characters, and each position means something specific. Position 1: the file type. - is a regular file, d a directory, l a symbolic link, c a character device, b a block device. Positions 2–4: the owner's permissions. Positions 5–7: the group's permissions. Positions 8–10: everyone else — "other". So -rwxr-xr-- is a regular file where the owner can read, write and execute; the group can read and execute; and everyone else can only read. The Numeric Shorthand Each permission has a value, and you add them. Permissio...