34,99 €
Mehr erfahren.
- Herausgeber: John Wiley & Sons
- Kategorie: Wissenschaft und neue Technologien
- Sprache: Englisch
Join over 250,000 IT professionals who've earned Security+certification If you're an IT professional hoping to progress in your career,then you know that the CompTIA Security+ exam is one of the mostvaluable certifications available. Since its introduction in 2002,over a quarter million professionals have achieved Security+certification, itself a springboard to prestigious certificationslike the CASP, CISSP, and CISA. The CompTIA Security+ StudyGuide: SY0-401 covers 100% of the Security+ exam objectives,with clear and concise information on crucial security topics. You'll find everything you need to prepare for the 2014 versionof the Security+ certification exam, including insight fromindustry experts on a wide range of IT security topics. Readersalso get access to a robust set of learning tools, featuringelectronic flashcards, assessment tests, robust practice testenvironment, with hundreds of practice questions, and electronicflashcards. * CompTIA authorized and endorsed * Includes updates covering the latest changes to the exam,including better preparation for real-world applications * Covers key topics like network security, compliance andoperational security, threats and vulnerabilities, access controland identity management, and cryptography * Employs practical examples and insights to provide real-worldcontext from two leading certification experts * Provides the necessary tools to take that first important steptoward advanced security certs like CASP, CISSP, and CISA, inaddition to satisfying the DoD's 8570 directive If you're serious about jump-starting your security career, youneed the kind of thorough preparation included in the CompTIASecurity+ Study Guide: SY0-401.
Sie lesen das E-Book in den Legimi-Apps auf:
Seitenzahl: 814
Veröffentlichungsjahr: 2014
Ähnliche
Table of Contents
Cover
Title Page
Copyright
Publisher's Note
Dedication
About the Authors
Acknowledgments
Table of Exercises
CompTIA
Introduction
Exam SY0-401 Exam Objectives
Assessment Test
Answers to Assessment Test
Chapter 1: Measuring and Weighing Risk
Risk Assessment
Developing Policies, Standards, and Guidelines
Summary
Exam Essentials
Review Question
Chapter 2: Monitoring and Diagnosing Networks
Monitoring Networks
Understanding Hardening
Securing the Network
Security Posture
Reporting Security Issues
Differentiating between Detection Controls and Prevention Controls
Summary
Exam Essentials
Review Question
Chapter 3: Understanding Devices and Infrastructure
Mastering TCP/IP
Designing a Secure Network
Understanding the Various Network Infrastructure Devices
Summary
Exam Essentials
Review Question
Chapter 4: Access Control, Authentication, and Authorization
Understanding Access Control Basics
Understanding Remote Access Connectivity
Understanding Authentication Services
Understanding Access Control
Implementing Access Controlling Best Practices
Summary
Exam Essentials
Review Question
Chapter 5: Protecting Wireless Networks
Working with Wireless Systems
Understanding Wireless Devices
Wireless Vulnerabilities to Know
Summary
Exam Essentials
Review Question
Chapter 6: Securing the Cloud
Working with Cloud Computing
Working with Virtualization
Security and the Cloud
Summary
Exam Essentials
Review Question
Chapter 7: Host, Data, and Application Security
Application Hardening
Host Security
Protecting Data Through Fault Tolerance
Application Security
Best Practices for Security
Summary
Exam Essentials
Review Question
Chapter 8: Cryptography
An Overview of Cryptography
Modern Cryptography
Using Cryptographic Systems
Understanding Cryptography Standards and Protocols
Using Public-Key Infrastructure
Summary
Exam Essentials
Review Question
Chapter 9: Malware, Vulnerabilities, and Threats
Understanding Malware
Surviving Viruses
Understanding Various Types of Attacks
Identifying Types of Application Attacks
Tools for Finding Threats
Summary
Exam Essentials
Review Question
Chapter 10: Social Engineering and Other Foes
Understanding Social Engineering
Understanding Physical Security
Environmental Controls
Control Types
Data Policies
Summary
Exam Essentials
Review Question
Chapter 11: Security Administration
Third-Party Integration
Understanding Security Awareness and Training
Classifying Information
Information Access Controls
Complying with Privacy and Security Regulations
Mobile Devices
Alternative Methods to Mitigate Security Risks
Summary
Exam Essentials
Review Question
Chapter 12: Disaster Recovery and Incident Response
Issues Associated with Business Continuity
Reinforcing Vendor Support
Penetration Testing
Summary
Exam Essentials
Review Questions
Appendix A: Answers to Review Questions
Chapter 1: Measuring and Weighing Risk
Chapter 2: Monitoring and Diagnosing Networks
Chapter 3: Understanding Devices and Infrastructure
Chapter 4: Access Control, Authentication, and Authorization
Chapter 5: Protecting Wireless Networks
Chapter 6: Securing the Cloud
Chapter 7: Host, Data, and Application Security
Chapter 8: Cryptography
Chapter 9: Malware, Vulnerabilities, and Threats
Chapter 10: Social Engineering and Other Foes
Chapter 11: Security Administration
Chapter 12: Disaster Recovery and Incident Response
Appendix B: About the Additional Study Tools
Additional Study Tools
System Requirements
Using the Study Tools
Troubleshooting
Free Online Study Tools
End User License Agreement
Pages
xxi
xxii
xix
xxiii
xxiv
xxv
xxvi
xxvii
xxviii
xxix
xxx
xxxi
xxxii
xxxiii
xxxiv
xxxv
xxxvi
xxxvii
xxxiii
xxxix
xl
x1i
xlii
xliii
xliv
xlv
xlvi
1
2
3
4
5
6
7
9
8
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
37
36
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
429
430
431
432
433
434
436
435
437
438
441
439
440
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
Guide
Cover
Table of Contents
Introduction
Chapter 1: Measuring and Weighing Risk
List of Illustrations
Figure 1.1
Figure 2.1
Figure 2.2
Figure 2.3
Figure 3.1
Figure 3.2
Figure 3.3
Figure 3.4
Figure 3.5
Figure 3.6
Figure 3.7
Figure 3.8
Figure 3.9
Figure 3.10
Figure 3.11
Figure 3.12
Figure 3.13
Figure 3.14
Figure 3.15
Figure 3.16
Figure 3.17
Figure 3.18
Figure 3.19
Figure 3.20
Figure 3.21
Figure 3.22
Figure 3.23
Figure 3.24
Figure 3.25
Figure 4.1
Figure 4.2
Figure 4.3
Figure 4.4
Figure 4.5
Figure 4.6
Figure 4.7
Figure 5.1
Figure 5.2
Figure 5.3
Figure 5.4
Figure 5.5
Figure 5.6
Figure 5.7
Figure 5.8
Figure 5.9
Figure 5.10
Figure 5.11
Figure 5.12
Figure 6.1
Figure 6.2
Figure 6.3
Figure 6.4
Figure 6.5
Figure 7.1
Figure 7.2
Figure 8.1
Figure 8.2
Figure 8.3
Figure 8.4
Figure 8.5
Figure 8.6
Figure 8.7
Figure 8.8
Figure 8.9
Figure 8.10
Figure 8.11
Figure 8.12
Figure 8.13
Figure 8.14
Figure 8.15
Figure 8.16
Figure 8.17
Figure 8.18
Figure 9.1
Figure 9.2
Figure 9.3
Figure 9.4
Figure 9.5
Figure 9.6
Figure 9.7
Figure 9.8
Figure 9.9
Figure 9.10
Figure 9.11
Figure 9.12
Figure 9.13
Figure 10.1
Figure 10.2
Figure 10.3
Figure 10.4
Figure 10.5
Figure 10.6
Figure 10.7
Figure 10.8
Figure 10.9
Figure 10.10
Figure 10.11
Figure 10.12
Figure 10.13
Figure 10.14
Figure 10.15
Figure 11.1
Figure 12.1
Figure 12.2
Figure 12.3
Figure 12.4
Figure 12.5
Figure 12.6
List of Tables
Table 1.1
Table 1.2
Table 1.3
Table 3.1
Table 3.2
Table 5.1
Table 7.1
Table 8.1
Table 9.1
Table 10.1
CompTIA® Security+™
Sixth Edition
Emmett Dulaney
Chuck Easttom
Senior Acquisitions Editor: Jeff Kellum
Development Editor: Gary Schwartz
Technical Editors: George Murphy and Josh More
Production Editor: Rebecca Anderson
Copy Editor: Elizabeth Welch
Editorial Manager: Pete Gaughan
Production Manager: Tim Tate
Vice President and Executive Group Publisher: Richard Swadley
Associate Publisher: Chris Webb
Media Project Manager 1: Laura Moss-Hollister
Media Associate Producer: Josh Frank
Media Quality Assurance: Doug Kuhn
Book Designers: Judy Fung and Bill Gibson
Proofreader: Kim Wimpsett
Indexer: Johnna VanHoose Dinse
Project Coordinator, Cover: Todd Klemme
Cover Design: Wiley
Cover Image: ©Getty Images Inc./Jeremy Woodhouse
Copyright © 2014 by John Wiley & Sons, Inc., Indianapolis, Indiana
Published simultaneously in Canada
ISBN: 978-1-118-87507-0
ISBN: 978-1-118-87508-7 (ebk.)
ISBN: 978-1-118-87547-6 (ebk.)
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.
For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.
Library of Congress Control Number: 2014930408
TRADEMARKS: Wiley and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CompTIA and Security+ are trademarks or registered trademarks of CompTIA Properties, LLC. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.
10 9 8 7 6 5 4 3 2 1
Dear Reader,
Thank you for choosing CompTIA Security+ Study Guide, Sixth Edition. This book is part of a family of premium-quality Sybex books, all of which are written by outstanding authors who combine practical experience with a gift for teaching.
Sybex was founded in 1976. More than 30 years later, we're still committed to producing consistently exceptional books. With each of our titles, we're working hard to set a new standard for the industry. From the paper we print on to the authors we work with, our goal is to bring you the best books available.
I hope you see all that reflected in these pages. I'd be very interested to hear your comments and get your feedback on how we're doing. Feel free to let me know what you think about this or any other Sybex book by sending me an email at [email protected]. If you think you've found a technical error in this book, please visit http://sybex.custhelp.com. Customer feedback is critical to our efforts at Sybex.
Best regards,Chris WebbAssociate PublisherSybex
For Karen, Kristin, Evan, and Spencer
—Emmett
About the Authors
Emmett Dulaney is a professor at Anderson University and the former director of training for Mercury Technical Solutions. He is a columnist for both Certification Magazine and Campus Technology as well as the author of more than 30 books on certification, operating systems, and cross-platform integration. Emmett can be reached at [email protected].
Chuck Easttom is a teacher, consultant, and expert witness in the field of computer security. He has expertise in software engineering, operating systems, databases, web development, and computer networking. His website is http://chuckeasttom.com/index.htm.
Acknowledgments
This book would not exist were it not for Mike Pastore, the author of the first edition. He took a set of convoluted objectives for a broad exam and wrote the foundation of the study guide that you now hold in your hands. All subsequent editions are indebted to his hard work and brilliance so early on.
Thanks are also due to Jeff Kellum, one of the best acquisitions editors in the business; Gary Schwartz; and all of those at Wiley who worked on this title.
Table of Exercises
Exercise 1.1
Risk-Assessment Computations
Exercise 2.1
Viewing the Event Logs
Exercise 3.1
Viewing the Active TCP and UDP Ports
Exercise 3.2
Installing Snort in Linux
Exercise 3.3
Configuring Web Filtering
Exercise 4.1
Validating a Trust Relationship
Exercise 5.1
Changing the Order of Preferred Networks
Exercise 5.2
Configuring a Wireless Connection Not Broadcasting
Exercise 7.1
Configuring a Pop-up Blocker
Exercise 7.2
Configuring Windows Firewall
Exercise 7.3
Verifying the Presence of a TPM Chip in Windows 7
Exercise 8.1
Encrypting a Filesystem in Linux
Exercise 8.2
SSL Settings in Windows Server 2012
Exercise 8.3
Looking for Errors in IPSec Performance Statistics
Exercise 8.4
Viewing a Certificate
Exercise 9.1
Viewing Running Processes on a Windows-Based Machine
Exercise 9.2
Viewing Running Processes on a Linux-Based Machine
Exercise 9.3
Scanning with Microsoft Baseline Security Analyzer
Exercise 9.4
Validating a Trust Relationship
Exercise 10.1
Test Social Engineering
Exercise 10.2
Security Zones in the Physical Environment
Exercise 12.1
Creating a Backup in SUSE Linux
Exercise 12.2
Using Automated System Recovery in Windows Server 2012
It Pays to Get Certified
In a digital world, digital literacy is an essential survival skill. Certification proves that you have the knowledge and skill to solve business problems in virtually any business environment.
Certification makes you more competitive and employable. Research has shown that people who study technology get hired. In the competition for entry-level jobs, applicants with high school diplomas or college degrees who included IT coursework in their academic load fared consistently better in job interviews, and were hired in significantly higher numbers. If considered a compulsory part of a technology education, testing for certification can be an invaluable competitive distinction for IT professionals.
How Certification Helps Your Career
Security is one of the highest demand job categories,
which has grown in importance as the frequency and severity of security threats continue to be a major concern for organizations around the world.
Jobs for security administrators are expected to increase by 18%
—the skill set required for these types of jobs maps to the CompTIA Security+ certification.
Network Security Administrators
can earn as much as $106,000 per year.
CompTIA Security+ is the first step
in starting your career as a Network Security Administrator or Systems Security Administrator.
More than
250,000 individuals worldwide are CompTIA Security+ certified.
CompTIA Security+ is regularly used in organizations
such as Hitachi Systems, Fuji Xerox, HP, Dell, and a variety of major U.S. government contractors.
CompTIA Security+ is approved by the U.S. Department of Defense (DoD)
as one of the required certification options in the DoD 8570.01-M directive, for Information Assurance Technical Level II and Management Level I job roles.
Steps to Getting Certified and Staying Certified
• Review Exam Objectives
Review the Certification objectives to make sure that you know what is covered in the exam:
http://certification.comptia.org/examobjectives.aspx
• Practice for the Exam
After you have studied for the certification, review and answer the sample questions to get an idea what types of questions might be on the exam.
http://certification.comptia.org/samplequestions.aspx
• Purchase an Exam Voucher
Purchase exam vouchers on the CompTIA Marketplace:
www.comptiastore.com
• Take the Test!
Go to the Pearson VUE website, and schedule a time to take your exam:
www.pearsonvue.com/comptia/locate/
• Stay Certified! Continuing Education
New CompTIA Security+ certifications are valid for three years from the date of certification. There are a number of ways the certification can be renewed. For more information, go to:
http://certification.comptia.org/ce
How to Obtain More Information
Visit CompTIA (
http://certification.comptia.org/home.aspx
) to learn more about getting CompTIA certified.
Contact CompTIA—call 866-835-8020 and choose Option 2—or email
.
Connect with us on LinkedIn, Facebook, Twitter, Flicker, and YouTube
Introduction
If you're preparing to take the Security+ exam, you'll undoubtedly want to find as much information as you can about computer and physical security. The more information you have at your disposal and the more hands-on experience you gain, the better off you'll be when attempting the exam. This study guide was written with that in mind. The goal was to provide enough information to prepare you for the test, but not so much that you'll be overloaded with information that's outside the scope of the exam.
This book presents the material at an intermediate technical level. Experience with and knowledge of security concepts, operating systems, and application systems will help you get a full understanding of the challenges you face as a security professional.
We've included review questions at the end of each chapter to give you a taste of what it's like to take the exam. If you're already working in the security field, we recommend that you check out these questions first to gauge your level of expertise. You can then use the book mainly to fill in the gaps in your current knowledge. This study guide will help you round out your knowledge base before tackling the exam.
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
Lesen Sie weiter in der vollständigen Ausgabe!
