CompTIA Security+ prep
You meet the five Security+ exam domains in a real Kali lab and practise every topic yourself, from detection to hardening.
Level 201 · 25 lessons · 24 practice labs
Lessons
Concepts, threats and architecture
- General security concepts: You will be able to explain core security ideas such as confidentiality, integrity and availability, and the types of controls, in exam terms.
- Threats, vulnerabilities and weaknesses: You will recognise threat actors, common vulnerability types and why weaknesses appear, and tell which defences answer each.
- Social engineering and malware types: You will recognise social engineering such as phishing and the types of malware, and list the measures that protect people and systems.
- Secure network architecture: You will be able to explain what secure network design parts such as segmentation, firewalls and a DMZ do and where they are used.
- Secure protocols and PKI: You will understand why secure protocols such as TLS and SSH are needed, and how PKI (certificate infrastructure) establishes trust.
- Identity and access management: You will tell apart authentication, authorisation, multi-factor verification and access models, and know which fits a given scenario.
- Cryptography in practice: You will be able to explain with examples when to use symmetric and asymmetric encryption, hashing and digital signatures.
- Short task: map one company’s assets, threats and controls on a single page
Detection and response labs
- Vulnerability management and security operations: You will understand how everyday security operations work, such as vulnerability scanning, patch management and log monitoring.
- The incident response process: You will be able to describe the stages of incident response in order: preparation, detection, containment, eradication and recovery.
- Recognising signs of malware on Linux: You will check unexpected processes, open connections and scheduled jobs to look for traces of malware on a system.
- Password policies and detecting password-guessing attempts: You will set password length and lockout policy and spot repeated failed logins in the logs.
- Checking your own systems for exposed services with Nmap: You will list open ports on a machine you are authorised to test with Nmap and decide which services to close.
- Monitoring logs and extracting indicators of an incident: You will filter abnormal session and error records with grep and journalctl and write a short incident summary.
- Collecting digital evidence and preserving its integrity: You will copy a disk or file and record its hash to prove the evidence has not changed since.
- Short task: trace an attack on a suspicious server and preserve the evidence
Protection and governance labs
- Input validation and code integrity: You will practise why input must be validated and why a downloaded program’s signature or hash must be checked.
- Data resilience: backups and file integrity monitoring: You will test a backup by restoring it and detect unauthorised changes to critical files by comparing hashes.
- Hardening an endpoint: the firewall and unneeded services: You will stop unneeded services on a Linux endpoint and make the firewall active from boot.
- Examining network traffic and secure remote access: You will tell cleartext from encrypted traffic with tcpdump and show why SSH is preferred for remote access.
- Security baselines and compliance checks: You will compare a system with an approved configuration list and report deviations and fix priority.
- Governance, risk and compliance: You will understand how governance ideas such as policy, risk assessment and regulatory compliance steer security in an organisation.
- Short task: harden a server and produce its compliance report
Exam preparation
- Exam strategy and practice questions: You will recognise exam question patterns, learn to manage your time and use practice questions to see which areas need work.
- Capstone: assess a small company’s security posture end to end
Practice labs
- Turn off root login over SSH: You disable direct root login over SSH on a server and verify login still works with an admin account.
- Switch SSH to key-only login: On Selvi Klinik's booking server you turn off password login, set up keys for two admins and show password login is refused.
- Bring the SSH configuration in line with a checklist: You fix an sshd configuration with weak ciphers, open forwarding and a long idle timeout against a checklist and verify it with a scanner.
- List listening services and their owners: You map every listening port on a server to its process and package and mark which ones are needed.
- Remove old FTP and Telnet services: You stop and remove FTP and Telnet services the business doesn't need and prove the ports stay closed after a reboot.
- Write a default-deny firewall for a server: You set up a firewall policy that allows only web and SSH from the management network, drops and logs the rest, and scan it from outside.
- Count failed logins: You count the last 24 hours of failed logins in the authentication log by user and source IP.
- Password spraying or brute force?: In one night's log you separate an attack trying few passwords on many accounts from many tries on one account and report each source.
- Set an account lockout and password policy: You set a five-attempt temporary lockout and a length rule with PAM, replay the attack and prove the lockout works.
- Scan your own server and count exposures: You scan your authorised lab server with nmap and write open ports and service versions to an inventory file.
- Find forgotten services on a subnet: You scan Kozalak Mobilya's lab subnet, find three open services not in policy and write a notice to their owners.
- Catch the difference between two scans: You write a script comparing yesterday's and today's scans, find the newly opened port and investigate its cause on the server.
- Extract indicators from a log: You pull attacker IPs, paths used and user agents out of a web server log into a list.
- Find signs of malware on a Linux server: You find a hidden high-CPU process, a suspicious scheduled job and a foreign connection and link them together.
- Sweep indicators across several servers: You write a script that sweeps three servers for given file hashes, IPs and paths and report which server is affected.
- Hash the evidence files: You take SHA-256 hashes of collected logs and files and write them to an evidence list with date and collector.
- Collect volatile data in the right order: You collect processes, network connections and sessions from a suspicious server in order before shutting anything and hash each output.
- Find the break in a chain of custody: In an incident folder you find the file whose hash doesn't match and the undocumented handover and justify which evidence is unreliable.
- Sign a file and verify the signature: You sign a configuration file with GPG and show that verification fails once the file changes.
- Inspect a web server's certificate: With openssl you check an internal web server's certificate chain, validity dates and name mismatch and write the findings.
- Issue a server certificate from an internal CA: You set up a small internal CA, issue a server certificate with the right alternative names, install it and verify it on a client.
- Create a file integrity baseline: You create an integrity-monitoring baseline for critical system directories and see the alert after changing a file.
- Test a backup by restoring it: You back up Pusulam Sigorta's policy folder, restore it to another directory and prove by comparing hashes that the backup is sound.
- Harden a server and produce a compliance report: You run a script that checks a basic security checklist, fix the failing items and prepare a before-and-after report.
About this course
You meet the five Security+ exam domains in a real Kali lab and practise every topic yourself, from detection to hardening.
What you will learn
- Concepts, threats and architecture
- Detection and response labs
- Protection and governance labs
- Exam preparation
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.