Senior Project - Week 3 Progress Report
- micahwegeleben
- Apr 25
- 2 min read
Hours worked: 3
Total hours worked: 5
This week I set out with the goal of learning what is covered on the SEC+ exam. I found the following article:
General Security Concepts
Includes key cybersecurity terminology and concepts up front to provide a foundation for security controls discussed throughout the exam.
Threats, Vulnerabilities & Mitigations
Focuses on responding to common threats, cyberattacks, vulnerabilities, and security incidents and appropriate mitigation techniques to monitor and secure hybrid environments.
Security Architecture
Includes security implications of different architecture models, principles of securing enterprise infrastructure, and strategies to protect data.
Security Operations
Includes applying and enhancing security and vulnerability management techniques, as well as security implications of proper hardware, software, and data management.
Security Program Management & Oversight
Updated to better reflect the reporting and communication skills required for Security+ job roles relating to governance, risk management, compliance, assessment, and security awareness.
I also thought to ask ChatGPT to see what its "insider knowledge" could say about the exam, considering it is probably keen to a lot of information that is otherwise paywalled!
🛡️ 1. General Security Concepts
Confidentiality, Integrity, Availability (CIA triad)
Security controls (technical, administrative, physical)
Threat actors and threat vectors
Security frameworks and compliance (e.g., NIST, ISO, PCI-DSS)
Risk management basics (likelihood, impact, mitigation)
Cybersecurity roles and responsibilities
🔐 2. Threats, Vulnerabilities, and Mitigations
Malware types (ransomware, spyware, trojans, worms, etc.)
Social engineering attacks (phishing, pretexting, baiting, etc.)
Physical attacks (tailgating, dumpster diving, etc.)
Application attacks (XSS, SQL injection, buffer overflow)
Network attacks (DDoS, MITM, spoofing)
Vulnerability scanning and penetration testing
Threat intelligence and threat hunting
🌐 3. Security Architecture
Secure network design (DMZs, VLANs, segmentation)
Secure protocols (HTTPS, SFTP, DNSSEC, etc.)
Firewalls, IDS/IPS, VPNs, proxies
Endpoint protection (EDR, antivirus)
Cloud security (shared responsibility model, CASB, SaaS/IaaS/PaaS)
Zero Trust Architecture
Virtualization and container security
Wireless security protocols (WPA3, WEP, EAP)
👤 4. Security Operations
Security monitoring and logging (SIEM)
Incident response process (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned)
Digital forensics basics
Backup and recovery strategies
Patch and vulnerability management
Business Continuity and Disaster Recovery (BC/DR)
Security awareness training and user education
🔑 5. Identity and Access Management (IAM)
Authentication types (MFA, biometrics, tokens)
Authorization models (RBAC, ABAC, MAC, DAC)
Identity federation and SSO
LDAP, Kerberos, RADIUS, TACACS+
Identity lifecycle (provisioning, deprovisioning)
Privileged access management
Password policies and credential management
Per my original plan, now that I know what is on the SECURITY+ exam I can figure out what I believe I am weakest at and study from there. I believe an effective study method might be to take a practice exam and see how I do. That way, i could measure my delta and figure out what I need to improve on.
Comments