Center for Qualified CyberSecurity Excellence & Mastery

Get Q/ualified!

CompTIA Security+™

CompTIA Security+™ Training

The Security+ exam covers the most important foundational principles for securing a network and managing risk.  Access control, identity management and cryptography are important topics on the exam, as well as selection of appropriate mitigation and deterrent techniques to address network attacks and vulnerabilities.  Security concerns associated with cloud computing, BYOD and SCADA are addressed in the SY0-401 exam.

While there is no required prerequisite, reading TCP/IP or Network+ is recommended before taking the Security+ exam.

CompTIA 8570 package - $1,995 per person! or $1,400 for groups of 5 or more - exam fee not included
FREE online Quizzes to engage you in Security+ materials, excellent instructor led training, with on-site exam last day.

SU Security+™® Class Security+™ (SY0-401) Exam Objectives
SU Security+™® Class + eStudy $1,995
SU Security+™® Class + eStudy + Exam $2,393
SU Security+™® Class + eStudy Learning Aid + iPad, $2,995
Instructor Led VIDEO SECURITY+ Training on iPad $3,495 incl 5 day class fee - must attend class.

Puchase online at SU registrations/ VIDEO

Security Plus Domain_1.mp4 54296 KB
Security Plus Domain_2.mp4 46578 KB
Security Plus Domain_3.mp4 43326 KB
Security Plus Domain_4.mp4 46212 KB
Security Plus Domain_5.mp4 40343 KB
Security Plus Domain_6.mp4 53651 KB

Certifications obtained after Jan 2011, are only good for 3 years.

The 2011 Edition of the CompTIA® Security+™ exam places greater emphasis on knowing how to address specific security issues, rather than simply being able to recognize these issues. The new exam covers six major objectives, or topics: Network Security; Compliance and Operational Security; Threats and Vulnerabilities; Application, Data, and Host Security; Access Control and Identity Management; Cryptography.

CompTIA surveyed of more than 2,000 individuals with responsibilities for information security found that more organizations are requiring security certifications, such as CompTIA Security+, for their IT staff because certified staff is better able to identify potential security risks proactively, and to respond more quickly when security breaches do occur. 

Who Should Attend:

COMPTIA Security + Bootcamp class is ideal for those working toward or who have already attained positions as Senior Network Security Engineers, Senior Security Systems Analysts or Senior Security Administrators and looking for their first security credentials. It is also useful to IT Auditors who are looking to deepen their IT infrastructure audit skills beyond the CISA. It is considered the appropriate pre-requisite knowledge level to enter the Security University Q/ISP curriculum.

Class Fee: $1,995 ($2,350 including SYO-401 exam voucher)
Time: 8:00am - 6pm
Learning Level: Beginner
Prerequisites: No pre-requisite is required
CPE Credits 40
Instructor: Ken Cutler, Security+, CISSP, CISA, CISM , Q/EH
Method of Delivery - Residential On Ground
Method of Evaluation: 1. 95 % attendance 2. 100 % completion of Lab
Grading: Pass = 95% Attendance and 100% Completion of Labs and Practical
Fail => 95% Attendance and > 100% Completion of Labs and Practical

We're here to help! CALL NOW 877-357-7744

security plus certification

A thoughtful blend of lecture/demo, case studies, and performance based exercises.

Our Security+ BootCamp covers the following material during our case studies and performance-based exercises:
SU Security+™® Class Security+™ (SY0-401) Exam Objectives

•  Configuring Firewalls: basic firewall configuration walk-through.
Wireless Network Security: configuring a wireless access point to maximum security
•  Analyzing VPN Architectures: evaluate IPSec, SSL, L2TP, PPTP VPN security features and packet structures.
•  Network Scanning: fundamental network and host vulnerability assessment using port scanners and network vulnerability scanners.
Network Application Risk Assessment: identifying key port numbers and risks, fundamental network and host vulnerability assessment using port scanners and network vulnerability scanners.
Web Attack: observe impact of poor input validation and programming in web applications.
Packet Sniffing: learn the fundamental use and abuse of packet analysis and corresponding countermeasures.
System Hardening: evaluate industry baselines for server and network device hardening.
Access Control: learn how to prevent unintended access with NTFS and Unix permissions.
Encryption Deployment: identify and apply cryptographic algorithms through hardware and software encryption

COMPTIA Security+ SY0-401 Class Outline:
Security + Certification / What You Will Learn:
The Security+ exam contains six domain areas:

security+ COMPTIA Security+ Class Outline:

  1. Security + Certification / What You Will Learn:
    The Security+ exam contains five domain areas:

    1.0 Network Security 21%
    2.0 Compliance and Operational Security 18%
    3.0 Threats and Vulnerabilities 21%
    4.0 Application, Data, and Host Security 16%
    5.0 Access Control and Identity Management 13%
    6.0 Cryptography 11%

    1.0 Network Security

    1.1 Explain the security function and purpose of network devices and technologies

    - Firewalls
    - Routers
    - Switches
    - Load Balancers
    - Proxies
    - Web security gateways
    - VPN concentrators
    - NIDS and NIPS (Behavior based, signature based, anomaly based, heuristic)
    - Protocol analyzers
    - Sniffers
    - Spam filter, all-in-one security appliances
    - Web application firewall vs. network firewall
    - URL filtering, content inspection, malware inspection

    1.2 Apply and implement secure network administration principles
    - Rule-based management
    - Firewall rules
    - VLAN management
    - Secure router configuration
    - Access control lists
    - Port Security
    - 802.1x
    - Flood guards
    - Loop protection
    - Implicit deny
    - Prevent network bridging by network separation
    - Log analysi

    1.3 Distinguish and differentiate network design elements and compounds
    - DMZ
    - Subnetting
    - VLAN
    - NAT
    - Remote Access
    - Telephony
    - NAC
    - Virtualization
    - Cloud Computing

    1.4 Implement and use common protocols
    - TCP/IP: IPv4 vs. IPv6
    - IPSec
    - SNMP
    - SSH/SCP
    - DNS
    - SSL/TLS
    - TELNET
    - ICMP
    - NetBIOS
    - RDB

    1.5 Identify commonly used default network ports

    1.6 Implement wireless network in a secure manner
    - WPA/ WPA2
    - WEP
    - MAC filter
    - SSID broadcast
    - TKIP
    - AES/CCMP
    - Antenna Placement
    - Power level controls

    2.0 Compliance and Operational Security

  2. 2.1 Explain risk related concepts
    - Control types: Technical, Management, Operational
    - False positives
    - Importance of policies in reducing risk: Privacy, Acceptable use, Security
    - Mandatory vacations
    - Job rotation
    - Separation of duties
    - Least privilege
    - Risk calculation: Likelihood, Annualized Loss Expectancy (ALE), Impact
    - Quantitative vs. qualitative
    - Risk-avoidance, transference, acceptance, mitigation, deterrence
    - Risks associated to Cloud Computing and Virtualization

    2.2 Carry out appropriate risk mitigation strategies
    - Implement security controls based on risk
    - Change management
    - Incident management
    - User rights and permissions reviews
    - Perform routine audits
    - Implement policies and procedures to prevent data loss or theft

    2.3 Execute appropriate incident response procedures
    - Basic forensic procedures
    - Evidence data collection and preservation
    - Damage and loss control
    - Chain of custody - Incident response: first responder

    2.4 Explain the importance of security related awareness and training
    - Security policy training and procedures
    - Personally identifiable information
    - Information classification: Sensitivity of data (hard or soft)
    - Data labeling, handling and disposal
    - Compliance with laws, best practices and standards
    - User habits
    - Threat awareness: New Malware, Phishing, Zero days exploits
    - Use of social networking and P2P

    2.5 Compare and contrast aspects of business continuity
    - Business impact analysis
    - Removing single points of failure
    - Business continuity planning and testing
    - Continuity of operations
    - Disaster recovery
    - IT contingency planning
    - Succession planning

    2.6 Explain the impact and proper use of environmental controls
    - HVAC
    - Fire suppression
    - EMI shielding
    - Hot and cold aisles
    - Environmental monitoring
    - Temperature and humidity controls
    - Video monitoring

    2.7 Execute disaster recovery plans and procedures
    - Backup / backout contingency plans or policies
    - Backups, execution and frequency
    - Redundancy and fault tolerance: Clustering, RAID
    - High availability
    - Cold site, hot site, warm site
    - Mean time to restore, mean time between failures, recovery time objectives and recovery point objectives

    2.8 Exemplify the concepts of confidentiality, integrity and availability (CIA)

    3.0 Threats and Vulnerabilities
    3.1 Analyze and differentiate among types of malware
    - Adware
    - Virus
    - Worms
    - Spyware
    - Trojan
    - Rootkits
    - Backdoors
    - Logic bomb
    - Botnets

    3.2 Analyze and differentiate among types of attacks
    - Man-in-the-middle
    - DDoS
    - DoS
    - Replay
    - Smurf attack
    - Spoofing
    - Spam
    - Spim
    - Xmas attack
    - Pharming
    - Privilege escalation
    - Malicious insider threat
    - DNS poisoning and ARP poisoning
    - Transitive access
    - Client-side attacks

    3.3 Analyze and differentiate among types of social engineering attacks
    - Shoulder surfing
    - Dumpster diving
    - Tailgating
    - Impersonation
    - Hoaxes
    - Phishing: Spear Phishing, Whaling, Vishing

    3.4 Analyze and differentiate among types of wireless attacks
    - Rogue access points
    - Interference
    - Evil twin
    - War driving
    - Bluejacking/Bluesnarfing
    - War chalking
    - IV attack
    - Packet sniffing

    3.5 Analyze and differentiate among types of application attacks
    - Cross-site scripting
    - SQL injection
    - LDAP injection
    - XML injection
    - Directory traversal/command injection
    - Buffer overflow
    - Cookies and attachments
    - Malicious add-ons
    - Session hijacking
    - Header manipulation

    3.6 Analyze and differentiate among types of mitigation and deterrent techniques
    - Manual bypassing of electronic controls
    - Failsafe/failsecure/ failopen
    - Monitoring system logs
    - Physical security
    - System and Application hardening
    - Port security: MAC limiting, 802.1x, disabling unused ports
    - Security posture: baselines, continuous monitoring, remediation
    - Reporting: alarms, alerts, trends
    - Detection controls vs. prevention controls: IDS vs. IPS, camera vs. guard

    3.7 Implement assessment tools and techniques to discover security threats and vulnerabilities
    - Vulnerability scanning tools and results interpretation: port scanner, vulnerability scanner
    - Protocol analyzer, sniffer
    - Honeypots, honeynets, tarpits
    - Risk calculations: threat vs. likelihood
    - Assessment types: risk, threat, vulnerability
    - Assessment techniques: baseline, design and code reviews, threat modeling

    3.8 Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning
    - Penetration testing
    - Vulnerability scanning
    - Identify common misconfiguration: Black box, White box, Gray box

    4.0 Application, Data and Host Security
    4.1 Explain the importance of application security
    - Fuzzing
    - Secure coding concepts: error and exception handling, input validation
    - Cross-site scripting prevention
    - Cross-site Request Forgery (XSRF) prevention
    - Application configuration baseline (proper settings)
    - Application hardening
    - Application patch management

    4.2 Carry out appropriate procedures to establish host security
    - Operating system security and settings
    - Anti-malware
    - Host-based firewalls
    - Patch management
    - Hardware security
    - Host software baselining
    - Mobile device security
    - Virtualization

    4.3 Explain the importance of data security
    - Data Loss Prevention (DLP)
    - Data encryption
    - Hardware based encryption devices: TPM, HSM, USB encryption, Hard drive
    - Cloud computing

    5.0 Access Control and Identity Management
    5.1 Explain the function and purpose of authentication services
    - RADIUS
    - PAP
    - CHAP
    - Kerberos
    - LDAP

    5.2 Explain the fundamental concepts and best practices related to authentication, authorization and access control
    - Identification vs. authentication
    - Authentication (single factor) and authorization
    - Multifactor authentication
    - Biometrics
    - Tokens
    - Common access card (CAC)
    - Personal identification verification card - Smart card
    - Least privilege - Separation of duties
    - Single sign on
    - ACLs
    - Access control: Discretionary, mandatory, role/rule-based
    - Implicit deny
    - Time of day restrictions
    - Trusted OS

    5.3 Implement appropriate security controls when performing account management
    - Mitigates issues associated with users with multiple account/roles
    - Account policy enforcement and password management
    - Group based privileges
    - User assigned privileges

    6.0 Cryptography
    6.1 Summarize general cryptography concepts
    - Symmetric vs. asymmetric
    - Fundamental differences and encryption methods: Block vs. stream
    - Transport encryption
    - Non-repudiation
    - Hashing
    - Key escrow
    - Digital signatures
    - Use of proven technologies
    - Elliptic curve and quantum cryptography
    - Steganography

    6.2 Use and apply appropriate cryptographic tools and products
    - WEP vs. WPA/WPA2 and pre-shared key
    - Symmetric key: AES, 3DES, DES, RC4, Blowfish, Twofish, One-Time Pads (OTP)
    - Asymmetric key: RSA, El Gamal, ECC
    - Hashing/MAC: MD5, SHA, HMAC
    - Authentication: LANMAN, NTLM, NTLMv2
    - Pretty Good Privacy (PGP)
    - Comparative strengths of algorithms
    - Use of algorithms with transport encryption: SSL/TLS, IPSec, SSH, HTTPS

    6.3 Explain the core concepts of public key infrastructure
    - Certificate authorities and digital certificates: CA, CRL
    - PKI
    - Recovery agent
    - Public key/ Private key
    - Registration
    - Key escrow
    - Trust models

    6.4 Implement PKI, certificate management and associated component

About the Exam :
Exam Costs
: $293 per attempt.

CompTIA Certification Retake Policy

In the event that you fail your first (1st) attempt to pass any CompTIA certification examination, CompTIA does not require any waiting period between the first (1st) and second (2nd) attempt to pass such examination. However, before your third (3rd) attempt or any subsequent attempt to pass such examination, you shall be required to wait for a period of at least fourteen (14) calendar days from the date of your last attempt to pass such examination.
a. If a Candidate has passed an exam, he/she cannot take it again without prior consent from CompTIA.
b. CompTIA beta examinations may only be taken one (1) time by each candidate.
c. A test result found to be in violation of the retake policy will not be processed, which will result in no credit awarded for the test taken. Repeat violators will be banned from participation in the CompTIA Certification Program.
d. Candidates must pay the exam price each time they attempt the exam. CompTIA does not offer any free re-tests or discounts on retakes.

Exam Location : You can take the exam on site last day of class -we are a mobile testing site
Time Allocated : 90 minutes per exam
Total marks : Graded from 100-900 marks
Minimum Pass Marks : 750
Number Of Questions : 75- 100 questions per exam
Exam format : Linear format; computer-based test (CBT) - multiple choice, multiple answer, performance-based
Prerequisites : None. CompTIA Network+ certification is recommended but not required
Validation Period : : Certification expires after 3 years, unless Continuing Professional Education (CPE) requirements are met - contact for more details
Score Report : Delivered immediate on test completion

Course fees are subject to change.