• 1

  General Security ConceptsCIA triad, authentication, authorization, accounting, Zero Trust

  12%

  Core Topics: The CIA Triad (Confidentiality, Integrity, Availability) is the foundation of information security. Confidentiality ensures data is only accessible to authorized parties — think encryption and access controls. Integrity guarantees data hasn't been tampered with — hashing and digital signatures are key tools here. Availability means systems and data are accessible when needed — redundancy, failover, and backups support this.

  Authentication & Authorization: Authentication verifies identity (passwords, biometrics, MFA). Authorization determines what an authenticated user can do (RBAC, ABAC, DAC, MAC). Accounting tracks what users actually did — audit logs and monitoring.

  Zero Trust: "Never trust, always verify." Every access request is authenticated and authorized, regardless of where it originates. Microsegmentation, least-privilege access, and continuous monitoring are core Zero Trust principles.

  💡 Study Tip: Create a real-world scenario for each CIA triad element. For example, a hospital: Confidentiality = patient records encrypted, Integrity = lab results unaltered, Availability = ER systems always online.
• 2

  Threats, Vulnerabilities & MitigationsAttack types, threat actors, social engineering, vulnerability management

  22%

  Malware Types: Ransomware encrypts files and demands payment. Trojans disguise as legitimate software. Worms self-replicate across networks. Rootkits hide deep in the OS. Each requires different detection and mitigation strategies.

  Social Engineering: Phishing (email), vishing (voice calls), smishing (SMS), and impersonation attacks exploit human psychology. Tailgating and shoulder surfing are physical social engineering tactics. Security awareness training is the #1 defense.

  Threat Actors: Script kiddies use pre-built tools. Hacktivists have political motives. Organized crime seeks financial gain. APT (Advanced Persistent Threat) groups are nation-state actors with long-term objectives. Insider threats — both malicious and accidental — are among the most dangerous.

  Vulnerability Management: Regular scanning, CVSS scoring, patch management, and penetration testing help identify and remediate weaknesses before attackers exploit them.

  💡 Study Tip: Build flashcards pairing each attack type with a real-world example and its primary mitigation. Understanding the "how" makes the "fix" intuitive.
• 3

  Security ArchitectureNetwork design, cloud security, virtualization, resilience & recovery

  18%

  Network Architecture: DMZs host public-facing services between the internet and your internal network. Firewalls filter traffic. VLANs segment networks. VPNs encrypt communications. Network access control (NAC) ensures only compliant devices connect.

  Cloud Models: IaaS gives you the most control (you manage OS and apps). PaaS handles the platform. SaaS is fully managed software. The shared responsibility model defines who secures what — the provider secures the cloud infrastructure, you secure your data and configurations.

  Resilience: The 3-2-1 backup rule (3 copies, 2 media types, 1 offsite). High availability through load balancing and clustering. Site resiliency: hot (immediate failover), warm (hours), cold (days).

  💡 Study Tip: Draw network diagrams. Visualizing where firewalls, DMZs, and internal subnets sit makes architectural concepts concrete and memorable.
• 4

  Security OperationsIncident response, monitoring, forensics, hardening, scripting

  28%

  Incident Response: NIST framework — Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity. Have an IR plan, a trained team, and practiced procedures before an incident happens.

  Monitoring & Forensics: SIEM systems aggregate and correlate logs for real-time threat detection. Digital forensics requires preserving the chain of custody and maintaining data integrity. Know the order of volatility when collecting evidence.

  Hardening: Disable unnecessary services, apply least-privilege, enforce strong password policies, and use configuration baselines. Patch management is critical — unpatched systems are the #1 attack vector.

  Scripting & Automation: Python, PowerShell, and Bash can automate security tasks like log analysis, account provisioning, and threat hunting. Basic scripting skills are increasingly expected in security roles.

  💡 Study Tip: This is the largest domain. Practice writing simple PowerShell or Python scripts. Set up a free SIEM lab (like Splunk Free) to explore log analysis hands-on.
• 5

  Security Program Management & OversightGovernance, risk, compliance, policies, business continuity

  20%

  Risk Management: Identify assets and threats, assess vulnerabilities, determine impact and likelihood. Quantitative risk uses numerical values (ALE = SLE × ARO). Qualitative uses categories (low/medium/high). Risk can be accepted, mitigated, transferred, or avoided.

  Compliance: GDPR (EU data privacy), PCI-DSS (credit card security), HIPAA (healthcare data), SOX (financial reporting integrity). Each has specific requirements — know which applies to which industry.

  Policies & Governance: AUP (acceptable use), BPA (business partnership agreement), SLA (service level agreement), incident response policy, and data classification policy. Policies set expectations; standards define how to meet them.

  Business Continuity: BCP (Business Continuity Plan) keeps the business running during disruption. DRP (Disaster Recovery Plan) focuses on IT recovery. Regular testing — tabletop exercises, simulations, and full failover tests — validates readiness.

  💡 Study Tip: Map each compliance standard to a real company. GDPR → any business with EU customers. PCI-DSS → retailers processing cards. HIPAA → hospitals and insurers. Context anchors the concepts.

📬 Want to know when A+ launches? Drop us a message and we'll notify you.

📬 Interested in Network+? Let us know and we'll keep you posted.

⭐ Want 3 full 90-question exams? Explore the Premium Bundle.

📧 Or email us directly: info@lightpointpro.com