Home > Store

CompTIA Security+ SY0-501 Cert Guide, Academic Edition, 2nd Edition

EPUB (Watermarked)

Not for Sale

Also available in other formats.

Register your product to gain access to bonus material or receive a coupon.


  • Copyright 2018
  • Dimensions: 8" x 10"
  • Pages: 600
  • Edition: 2nd
  • EPUB (Watermarked)
  • ISBN-10: 0-13-484605-2
  • ISBN-13: 978-0-13-484605-7

This is the eBook of the printed book and may not include any media, website access codes, or print supplements that may come packaged with the bound book.

Learn, prepare, and practice for CompTIA Security+ SY0-501 exam success with this CompTIA Security+ SY0-501 Cert Guide, Academic Edition from Pearson IT Certification, a leader in IT Certification learning. The companion website features three complete practice exams, complete video solutions to hands-on labs, plus interactive flash-based simulations that include drag-and-drop and matching to reinforce the learning.

·         Master the CompTIA Security+ SY0-501 exam topics

·         Assess your knowledge with chapter-ending quizzes

·         Reinforce your knowledge of key concepts with chapter review activities

·         Practice with realistic exam questions online

·         Includes complete video solutions to hands-on labs, plus interactive simulations on key exam topics

·         Work through Flash Cards in Q&A and glossary term format

·         Includes free access to the Premium Edition eBook

CompTIA Security+ SY0-501 Cert Guide, Academic Edition includes video solutions to the hands-on labs, practice tests, and interactive simulations that let the reader learn by doing. Best-selling author and expert instructor David L. Prowse shares preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.

The book presents you with an organized test-preparation routine through the use of proven series elements and techniques. Exam topic lists make referencing easy. Chapter review activities help you drill on key concepts you must know thoroughly. Review questions help you assess your knowledge, and a final preparation chapter guides you through tools and resources to help you craft your approach to passing the exam.

The companion Academic Edition website contains the powerful Pearson Test Prep practice test engine, with three complete practice exams and hundreds of exam-realistic questions and free access to the Premium Edition eBook. The assessment engine offers you a wealth of customization options and reporting features, laying out a complete assessment of your knowledge to help you focus your study where it is needed most. Work through Flash Cards in Q&A and glossary term format to help reinforce your knowledge of key concepts and facts. The Academic Edition companion site also includes complete video solutions to hands-on labs in the book and interactive simulations on key exam topics to reinforce the learning by doing. Learn activities such as testing password strength, matching the type of malware with its definition, finding security issues in the network map, and disallowing a user to access the network on Saturday and Sunday.

Well regarded for its level of detail, assessment features, and challenging review questions and exercises, this CompTIA study guide helps you master the concepts and techniques that will allow you to succeed on the exam the first time.

The CompTIA study guide helps you master all the topics on the Security+ exam, including

·         Core computer system security

·         OS hardening and virtualization

·         Application security

·         Network design elements and threats

·         Perimeter security

·         Network media and devices security

·         Physical security and authentication models

·         Access control

·         Vulnerability and risk assessment

·         Monitoring and auditing

·         Cryptography, including PKI

·         Redundancy and disaster recovery

·         Policies and procedures

Sample Content

Table of Contents

Introduction xxii

Chapter 1 Introduction to Security 2

Foundation Topics 3

Security 101 3

    The CIA of Computer Security 3

    The Basics of Information Security 4

Think Like a Hacker 6

Threat Actor Types and Attributes 7

Chapter Review Activities 9

Chapter 2 Computer Systems Security Part I 12

Foundation Topics 13

Malicious Software Types 13

    Viruses 13

    Worms 14

    Trojan Horses 14

    Ransomware 15

    Spyware 15

    Rootkits 16

    Spam 16

    Summary of Malware Threats 17

Delivery of Malware 17

    Via Software, Messaging, and Media 18

    Botnets and Zombies 19

    Active Interception 19

    Privilege Escalation 19

    Backdoors 19

    Logic Bombs 20

Preventing and Troubleshooting Malware 20

    Preventing and Troubleshooting Viruses 20

    Preventing and Troubleshooting Worms and Trojans 23

    Preventing and Troubleshooting Spyware 24

    Preventing and Troubleshooting Rootkits 25

    Preventing and Troubleshooting Spam 26

    You Can’t Save Every Computer from Malware! 27

    Summary of Malware Prevention Techniques 27

Chapter Review Activities 29

Chapter 3 Computer Systems Security Part II 34

Foundation Topics 35

Implementing Security Applications 35

    Personal Software Firewalls 35

    Host-Based Intrusion Detection Systems 36

    Pop-Up Blockers 38

    Data Loss Prevention Systems 38

Securing Computer Hardware and Peripherals 39

    Securing the BIOS 39

    Securing Storage Devices 41

        Removable Storage 41

        Network Attached Storage 41

        Whole Disk Encryption 42

        Hardware Security Modules 43

    Securing Wireless Peripherals 43

Securing Mobile Devices 44

    Malware 44

    Botnet Activity 45

    SIM Cloning and Carrier Unlocking 45

    Wireless Attacks 46

    Theft 46

    Application Security 47

    BYOD Concerns 49

Chapter Review Activities 53

Chapter 4 OS Hardening and Virtualization 58

Foundation Topics 59

Hardening Operating Systems 59

    Removing Unnecessary Applications and Services 59

    Windows Update, Patches, and Hotfixes 65

        Patches and Hotfixes 66

        Patch Management 68

    Group Policies, Security Templates, and Configuration Baselines 69

    Hardening File Systems and Hard Drives 71

Virtualization Technology 74

    Types of Virtualization and Their Purposes 74

    Hypervisor 75

    Securing Virtual Machines 76

Chapter Review Activities 79

Chapter 5 Application Security 86

Foundation Topics 87

Securing the Browser 87

    General Browser Security Procedures 88

        Implement Policies 88

        Train Your Users 90

        Use a Proxy and Content Filter 91

        Secure Against Malicious Code 92

    Web Browser Concerns and Security Methods 92

        Basic Browser Security 92

        Cookies 92

        LSOs 93

        Add-ons 94

        Advanced Browser Security 94

Securing Other Applications 95

Secure Programming 99

    Software Development Life Cycle 99

    Core SDLC and DevOps Principles 100

    Programming Testing Methods 102

        White-box and Black-box Testing 102

        Compile-Time Errors Versus Runtime Errors 102

        Input Validation 103

        Static and Dynamic Code Analysis 104

        Fuzz Testing 104

    Programming Vulnerabilities and Attacks 104

        Backdoors 105

        Memory/Buffer Vulnerabilities 105

        Arbitrary Code Execution/Remote Code Execution 106

        XSS and XSRF 107

        More Code Injection Examples 107

        Directory Traversal 109

        Zero Day Attack 109

Chapter Review Activities 111

Chapter 6 Network Design Elements 118

Foundation Topics 119

Network Design 119

    The OSI Model 119

    Network Devices 120

        Switch 120

        Bridge 122

        Router 122

    Network Address Translation, and Private Versus Public IP 123

    Network Zones and Interconnections 125

        LAN Versus WAN 125

        Internet 126

        Demilitarized Zone (DMZ) 126

        Intranets and Extranets 127

    Network Access Control (NAC) 128

    Subnetting 128

    Virtual Local Area Network (VLAN) 130

    Telephony 131

        Modems 131

        PBX Equipment 132

        VoIP 132

Cloud Security and Server Defense 133

    Cloud Computing 133

    Cloud Security 135

    Server Defense 137

        File Servers 137

        Network Controllers 137

        E-mail Servers 138

        Web Servers 139

        FTP Server 140

Chapter Review Activities 142

Chapter 7 Networking Protocols and Threats 148

Foundation Topics 149

Ports and Protocols 149

    Port Ranges, Inbound Versus Outbound, and Common Ports 149

    Protocols That Can Cause Anxiety on the Exam 155

Malicious Attacks 155

    DoS 155

    DDoS 158

    Sinkholes and Blackholes 158

    Spoofing 159

    Session Hijacking 159

    Replay 161

    Null Sessions 161

    Transitive Access and Client-Side Attacks 162

    DNS Poisoning and Other DNS Attacks 162

    ARP Poisoning 164

    Summary of Network Attacks 164

Chapter Review Activities 167

Chapter 8 Network Perimeter Security 174

Foundation Topics 175

Firewalls and Network Security 175

    Firewalls 175

    Proxy Servers 179

    Honeypots and Honeynets 181

    Data Loss Prevention (DLP) 182

NIDS Versus NIPS 183

    NIDS 183

    NIPS 184

    Summary of NIDS Versus NIPS 185

    The Protocol Analyzer’s Role in NIDS and NIPS 185

    Unified Threat Management 186

Chapter Review Activities 187

Chapter 9 Securing Network Media and Devices 194

Foundation Topics 195

Securing Wired Networks and Devices 195

    Network Device Vulnerabilities 195

        Default Accounts 195

        Weak Passwords 195

        Privilege Escalation 196

        Back Doors 197

        Network Attacks 197

        Other Network Device Considerations 197

    Cable Media Vulnerabilities 198

        Interference 198

        Crosstalk 199

        Data Emanation 199

        Tapping into Data and Conversations 200

Securing Wireless Networks 201

    Wireless Access Point Vulnerabilities 202

        The Administration Interface 202

        SSID Broadcast 202

        Rogue Access Points 202

        Evil Twin 203

        Weak Encryption 203

        Wi-Fi Protected Setup 205

        Ad Hoc Networks 205

        VPN over Open Wireless 205

    Wireless Access Point Security Strategies 205

    Wireless Transmission Vulnerabilities 208

    Bluetooth and Other Wireless Technology Vulnerabilities 209

        Bluejacking 209

        Bluesnarfing 210

    RFID and NFC 210

        More Wireless Technologies 210

Chapter Review Activities 212

Chapter 10 Physical Security and Authentication Models 218

Foundation Topics 219

Physical Security 219

    General Building and Server Room Security 219

    Door Access 220

    Biometric Readers 221

Authentication Models and Components 222

    Authentication Models 222

    Localized Authentication Technologies 224

        802.1X and EAP 224

        LDAP 226

        Kerberos and Mutual Authentication 227

        Remote Desktop Services 229

    Remote Authentication Technologies 230

        Remote Access Service 230

        Virtual Private Networks 231

        RADIUS Versus TACACS 234

Chapter Review Activities 236

Chapter 11 Access Control Methods and Models 244

Foundation Topics 245

Access Control Models Defined 245

    Discretionary Access Control 245

    Mandatory Access Control 246

    Role-Based Access Control (RBAC) 247

    Attribute-based Access Control (ABAC) 248

    Access Control Wise Practices 249

Rights, Permissions, and Policies 250

    Users, Groups, and Permissions 251

    Permission Inheritance and Propagation 255

    Moving and Copying Folders and Files 256

    Usernames and Passwords 256

    Policies 258

    User Account Control (UAC) 261

Chapter Review Activities 262

Chapter 12 Vulnerability and Risk Assessment 270

Foundation Topics 271

Conducting Risk Assessments 271

    Qualitative Risk Assessment 272

    Quantitative Risk Assessment 273

    Security Analysis Methodologies 274

    Security Controls 275

    Vulnerability Management 276

        Penetration Testing 277

        OVAL 279

        Additional Vulnerabilities 279

Assessing Vulnerability with Security Tools 280

    Network Mapping 280

    Vulnerability Scanning 282

    Network Sniffing 283

    Password Analysis 284

Chapter Review Activities 287

Chapter 13 Monitoring and Auditing 294

Foundation Topics 295

Monitoring Methodologies 295

    Signature-Based Monitoring 295

    Anomaly-Based Monitoring 295

    Behavior-Based Monitoring 296

Using Tools to Monitor Systems and Networks 296

    Performance Baselining 297

    Protocol Analyzers 299

        Wireshark 299

    SNMP 301

    Analytical Tools 302

    Use Static and Dynamic Tools 304

Conducting Audits 304

    Auditing Files 305

    Logging 306

    Log File Maintenance and Security 310

    Auditing System Security Settings 311

    SIEM 314

Chapter Review Activities 315

Chapter 14 Encryption and Hashing Concepts 322

Foundation Topics 323

Cryptography Concepts 323

    Symmetric Versus Asymmetric Key Algorithms 326

        Symmetric Key Algorithms 326

    Asymmetric Key Algorithms 327

    Public Key Cryptography 327

    Key Management 328

    Steganography 328

Encryption Algorithms 329

    DES and 3DES 329

    AES 329

    RC 330

    Blowfish and Twofish 331

    Summary of Symmetric Algorithms 331

    RSA 331

    Diffie-Hellman 333

    Elliptic Curve 333

    More Encryption Types 334

        One-Time Pad 334

        PGP 335

        Pseudorandom Number Generators 336

Hashing Basics 336

    Cryptographic Hash Functions 337

        MD5 338

        SHA 338

        RIPEMD and HMAC 338

    LANMAN, NTLM, and NTLMv2 339

        LANMAN 339

        NTLM and NTLMv2 340

    Hashing Attacks 341

        Pass the Hash 341

        Happy Birthday! 341

    Additional Password Hashing Concepts 342

Chapter Review Activities 343

Chapter 15 PKI and Encryption Protocols 350

Foundation Topics 351

Public Key Infrastructure 351

    Certificates 351

        SSL Certificate Types 352

        Single-Sided and Dual-Sided Certificates 352

        Certificate Chain of Trust 352

        Certificate Formats 352

    Certificate Authorities 353

    Web of Trust 356

Security Protocols 356

    S/MIME 357

    SSL/TLS 357

    SSH 359

    PPTP, L2TP, and IPsec 359

        PPTP 359

        L2TP 359

        IPsec 360

Chapter Review Activities 361

Chapter 16 Redundancy and Disaster Recovery 368

Foundation Topics 369

Redundancy Planning 369

    Redundant Power 370

    Redundant Power Supplies 371

    Uninterruptible Power Supplies 371

    Backup Generators 372

    Redundant Data 374

    Redundant Networking 376

    Redundant Servers 377

    Redundant Sites 378

    Redundant People 379

Disaster Recovery Planning and Procedures 379

    Data Backup 379

    DR Planning 382

Chapter Review Activities 385

Chapter 17 Social Engineering, User Education, and Facilities Security 390

Foundation Topics 391

Social Engineering 391

    Pretexting 391

    Malicious Insider 391

    Diversion Theft 392

    Phishing 392

    Hoaxes 393

    Shoulder Surfing 394

    Eavesdropping 394

    Dumpster Diving 394

    Baiting 394

    Piggybacking/Tailgating 394

    Watering Hole Attack 395

    Summary of Social Engineering Types 395

User Education 396

    Facilities Security 398

    Fire Suppression 398

        Fire Extinguishers 398

        Sprinkler Systems 399

        Special Hazard Protection Systems 399

    HVAC 400

    Shielding 401

    Vehicles 402

Chapter Review Activities 404

Chapter 18 Policies and Procedures 410

Foundation Topics 411

Legislative and Organizational Policies 411

    Data Sensitivity and Classification of Information 411

    Personnel Security Policies 413

        Privacy Policies 414

        Acceptable Use 414

        Change Management 414

        Separation of Duties/Job Rotation 415

        Mandatory Vacations 415

        Onboarding and Offboarding 415

        Due Diligence 416

        Due Care 416

        Due Process 416

        User Education and Awareness Training 416

        Summary of Personnel Security Policies 417

    How to Deal with Vendors 417

    How to Dispose of Computers and Other IT Equipment Securely 419

Incident Response Procedures 420

IT Security Frameworks 424

Chapter Review Activities 426

Chapter 19 Taking the Real Exam 432

    Getting Ready and the Exam Preparation Checklist 432

    Tips for Taking the Real Exam 435

    Beyond the CompTIA Security+ Certification 438

Practice Exam 1: SY0-501 440

Glossary 458

Elements Available Online

Appendix A: Answers to the Review Questions

Answers to Practice Exam 1

View Recommended Resources

Real-World Scenarios

Flash Cards

9780789759122   TOC   10/31/2017


Submit Errata

More Information

Pearson IT Certification Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Pearson IT Certification and its family of brands. I can unsubscribe at any time.


Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Pearson IT Certification products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information

To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.


Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites; develop new products and services; conduct educational research; and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.


If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email information@informit.com.

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information

Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.


Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.


This site is not directed to children under the age of 13.


Pearson may send or direct marketing communications to users, provided that

  • Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
  • Such marketing is consistent with applicable law and Pearson's legal obligations.
  • Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
  • Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information

If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at customer-service@informit.com and we will process the deletion of a user's account.


Users can always make an informed choice as to whether they should proceed with certain services offered by Adobe Press. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive: www.pearsonitcertification.com/u.aspx.

Sale of Personal Information

Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to NevadaDesignatedRequest@pearson.com.

Supplemental Privacy Statement for California Residents

California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure

Pearson may disclose personal information, as follows:

  • As required by law.
  • With the consent of the individual (or their parent, if the individual is a minor)
  • In response to a subpoena, court order or legal process, to the extent permitted or required by law
  • To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
  • In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
  • To investigate or address actual or suspected fraud or other illegal activities
  • To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
  • To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
  • To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.


This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact

Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice

We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020