CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

Security exercises borrow their vocabulary from military wargaming, and CompTIA expects you to know which colour does what. The three that matter most are red, blue and purple; white and yellow round out the set. The teams Team Role Red Offensive — attacks, emulating an adversary Blue Defensive — detects and responds Purple Collaboration between red and blue White Referees and manages the exercise Yellow Builders — developers and architects Red team Offensive. Simulates a real adversary to test whether defences actually work, usually with a specific objective — reach the customer database, obtain domain administrator — rather than a list of systems. The distinction from penetration testing is worth being precise about, because the exam draws it. A penetration test is scoped by systems and aims for breadth: find as many exploitable weaknesses as possible in the agreed scope. A red team engagement is scoped by objective and aims for depth: reach the goal without being stopp...

Four exercises get used interchangeably in procurement conversations and answer completely different questions. Buying the wrong one is the most common way organizations spend a security budget and learn nothing, so the distinction is worth being precise about. Vulnerability scanning: what is wrong Automated, broad and shallow. A scanner enumerates hosts and services, identifies software and versions, and reports known vulnerabilities and misconfigurations. It answers "what known weaknesses exist across the estate," runs continuously, and costs very little per asset. It does not confirm anything is exploitable, does not chain findings, and produces false positives and negatives — the matching problems described under CPE . Authenticated scanning finds substantially more than unauthenticated, and running it is the baseline hygiene that should be in place before anything else is purchased. Penetration testing: what is exploitable Manual, scoped and deep. A tester attemp...

Adversary emulation is the practice of imitating a specific, known threat actor — using their tools, their techniques and their sequence of operations — to find out whether your defences would actually catch them. That last part is the point. A penetration test asks whether an attacker could get in. Adversary emulation asks whether your detection and response would notice a particular attacker while they did it. The deliverable is different, and CompTIA tests that difference. How it differs from the neighbouring activities Activity Question it answers Vulnerability scan What weaknesses exist? Penetration test Can those weaknesses be exploited to reach something valuable? Red team engagement Can we reach a specific objective without being stopped? Adversary emulation Would we detect and respond to this particular actor's methods? A penetration test is scoped by systems. Adversary emulation is scoped by behaviour. You start by choosing a threat actor who plausibly targets ...