CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

 The Sarbanes‑Oxley Act (SOX)  The Sarbanes‑Oxley Act of 2002, often called SOX, is a U.S. federal law enacted in response to catastrophic corporate accounting scandals, most notably Enron and WorldCom, that destroyed investor confidence in U.S. financial markets. The Act established strict reforms to improve corporate governance , financial reporting accuracy, and auditor independence . Its primary goal is to protect investors by requiring public companies to maintain truthful financial disclosures and strong internal controls .  1. Why SOX Was Created: The Historical Background Between the late 1990s and early 2000s, several major corporations engaged in fraudulent accounting practices, including the use of shell entities, the concealment of losses, and the manipulation of financial statements to mislead investors. These abuses led to massive stock collapses and wiped out employee retirement funds. SOX was enacted to restore trust, stop fraud, and ensure transparency. 2...

Security awareness training has a reputation problem, and mostly it is deserved. An annual compliance video that everyone clicks through at 4:50 p.m. on the last day of the quarter changes nobody's behavior. CompTIA tests awareness as a program with components, cadence and metrics — not as an event. Why It Is a Control at All People are involved in the large majority of breaches, usually through phishing, credential reuse or misconfiguration. Technical controls handle what they can, but no filter catches every message and no policy engine stops someone from approving a fraudulent invoice. Awareness is the control that addresses the decision itself. It is a compensating control, not a primary one. If your answer to a phishing question is "train the users" and nothing else, the answer is incomplete. Training reduces the rate; layered technical controls handle what gets through. Program Components Security+ expects familiarity with the standard pieces: Onboardin...

TOTP and HOTP are the two algorithms behind almost every authenticator app and hardware token you will encounter. They generate one-time passwords — the six-digit codes you type after your password — and the difference between them comes down to a single design decision. HOTP codes change when you use them. TOTP codes change when the clock does. Both are open standards, both use HMAC with a shared secret, and both produce the same kind of short numeric code. The distinction is what goes into the hash alongside the secret: a counter, or the time. HOTP — HMAC-Based One-Time Password Defined in RFC 4226. The server and the token share a secret key and a counter. To generate a code, both sides compute an HMAC-SHA-1 of the secret and the current counter value, then truncate the result to six or eight digits. The counter increments only when a code is generated or used . A code stays valid until it is consumed, which may be minutes or days later. That creates the characteristic...

 Mandatory Vacation A mandatory vacation (also called forced vacation or required time off) is a policy requiring employees to take a minimum number of consecutive days away from work each year. During this time, the employee must fully disconnect, no emails, calls, or remote work. Unlike regular PTO, which employees may choose to use or not, mandatory vacation is enforced by the organization. Why Organizations Use Mandatory Vacation 1. Fraud Prevention & Internal Controls Mandatory vacation is widely used in industries like finance, banking, auditing, and cybersecurity because taking employees out of their routine for consecutive days can: Expose fraudulent activity Reveal irregularities that might go unnoticed Break the ability to conceal ongoing misconduct Many financial institutions require at least 5–10 consecutive business days away for this reason. 2. Risk Management & Business Continuity Organizations use it to ensure: Teams do not rely too heavily on a single perso...

 SCEP (Simple Certificate Enrollment Protocol) SCEP (Simple Certificate Enrollment Protocol) is a protocol used to automate the enrollment, distribution, and renewal of digital certificates in large-scale environments. It enables devices, such as laptops, mobile devices, network hardware, and servers, to request and receive certificates from a Certificate Authority (CA) securely without manual intervention. Originally created by Cisco, SCEP is widely used in: Network infrastructure (routers, switches, firewalls) Mobile Device Management (MDM) (Microsoft Intune, MobileIron, Workspace ONE) VPN and Wi-Fi authentication Zero-trust and identity-based security models IoT devices that need certificates What Problem Does SCEP Solve? In enterprise networks, certificates are used for: Device authentication User authentication TLS encryption Wi-Fi 802.1X VPN access Secure email (S/MIME) Without SCEP, certificates would need to be installed manually, which is: Time-consuming Error-prone Imp...

 What Is E‑Discovery?  E‑Discovery (electronic discovery) is the process of identifying, collecting, preserving, and producing electronic information that is relevant to a legal case, compliance investigation, audit, or regulatory request. It applies in litigation, HR investigations, cybersecurity events, FOIA/public‑records requests, internal compliance probes, and more. E‑Discovery focuses specifically on ESI (Electronically Stored Information), which includes: Emails and attachments Documents, spreadsheets, presentations Chat messages (Teams, Slack, SMS, WhatsApp) Databases and logs Cloud data (Microsoft 365, Google Workspace, Salesforce, AWS, etc.) Mobile device data Social media content Audio and video recordings Metadata (timestamps, authorship, access logs, etc.) The E‑Discovery Process (The EDRM Model) Most organizations follow the EDRM (Electronic Discovery Reference Model), which outlines 9 stages: 1. Information Governance Policies and procedures for how data is cre...

 Key Risk Indicators (KRIs) 1. What Are KRIs? Key Risk Indicators (KRIs) are measurable metrics that help an organization detect rising risk exposure before problems occur. They function like the early‑warning sensors of a business, flagging conditions that might lead to operational, financial, strategic, or compliance failures. Think of KRIs as the smoke detectors in an organization’s risk‑management system, alerting you before the fire spreads. 2. Why KRIs Are Important KRIs provide: Early detection of risks:  They monitor patterns or changes that may indicate rising risk, giving time to take corrective action. Proactive decision-making;  KRIs shift organizations from being reactive (fixing problems after damage) to proactive (preventing them). Quantifiable, trackable data:  They turn risk into numbers, allowing trends, comparisons, thresholds, and analysis over time. Alignment with business objectives:  KRIs help ensure risks are monitored in line with strate...

Quantitative risk assessment attaches monetary values to risk so that control spending can be compared against expected loss. The formulas are simple, they appear on the exam as calculations, and knowing where their inputs come from matters as much as the arithmetic. The formulas Asset Value (AV) — what the asset is worth, including replacement, lost revenue during unavailability, and the cost of consequences such as notification and regulatory penalty. Exposure Factor (EF) — the proportion of the asset's value lost in a single occurrence, expressed as a percentage. A fire destroying a building outright is 100 percent; a disk failure in a redundant array may be 5 percent. Single Loss Expectancy (SLE) = AV × EF — the cost of one occurrence. Annualized Rate of Occurrence (ARO) — how many times per year it is expected. Once every four years is 0.25; three times a year is 3. Annualized Loss Expectancy (ALE) = SLE × ARO — the expected ann...

Split Tunneling Explained: What It Is, Why It's Used, and the Risks Sep 26, 2026 · @Ken What Split Tunneling Is Split tunneling is a VPN configuration that sends some of a client's traffic through the encrypted tunnel and lets the rest go straight out to the internet. The client ends up with two paths at the same time: one to the corporate network, one to everything else. Compare that to a full tunnel, sometimes called a forced tunnel. In a full tunnel, every packet the client sends goes through the VPN, including requests to public websites. The traffic reaches the corporate gateway, gets inspected and filtered, then exits to the internet from the company's connection. The reply comes back the same way. The trade-off is the whole story. Split tunneling buys performance and saves bandwidth. Full tunneling buys visibility and control. Both exams expect you to explain that trade-off, not just define the term. How the Traffic Actually Splits The decision happens in the clien...

 NIST AI Risk Management Framework The NIST Artificial Intelligence Risk Management Framework (AI RMF) is a voluntary, sector‑agnostic, and consensus‑driven framework released by the U.S. National Institute of Standards and Technology on January 26, 2023. Its purpose is to help organizations identify, assess, manage, and reduce risks associated with AI systems across their entire lifecycle. The framework remains a living document and is updated periodically. It is intended to support: Trustworthy AI development and deployment Decision-making about AI risks Continual monitoring and governance Cross-functional collaboration across technical, operational, and executive teams  To help organizations operationalize the framework, NIST provides companion resources, including the AI RMF Playbook, Crosswalks, Roadmap, and specialized profiles (including the Generative AI Profile, released July 26, 2024).  1. Purpose and Philosophy of the AI RMF Unlike rigid compliance checklists,...

 MIT AI Risk Repository  The MIT AI Risk Repository is a major research initiative created to provide the world’s most comprehensive, structured, and unified resource on risks posed by artificial intelligence . It functions as a living, continuously updated database of AI risks, taxonomies, and documented sources, developed by the MIT AI Risk Initiative / MIT FutureTech Group. It is publicly accessible at airisk.mit.edu. 1. What the MIT AI Risk Repository Is According to MIT, the AI Risk Repository is: A centralized, living database of AI-related risks, currently listing 700–1700+ risks depending on the version referenced (MIT's web version lists 1700+, while the academic paper documents 777 risks). Compiled from dozens of academic, government, and industry AI frameworks (43–74 frameworks, depending on the version). Designed to create a shared vocabulary for researchers, policymakers, auditors, and companies when discussing AI risks. Open-access and designed to be extensible, ...