RANGER GAMEZ

CompTIA Security+ (SY0-701) · chapter 15 of 27

Month 6: Harden everything (and count it)

In this chapter Objectives 4.1, 4.2

  1. Baselines and hardening targets
  2. Wireless settings and application security
  3. Asset management, cradle to grave
  4. Practice questions
  5. Chapter recap

Objective 4.1

Baselines and hardening targets

Secure baselines: establish, deploy, maintain

A secure baseline is the approved, documented secure configuration for a type of system. Establish it from trusted guidance (CIS Benchmarks, vendor security guides) and test it. Deploy it the same way everywhere with tools (Group Policy, MDM, configuration management, IaC templates). Maintain it: update it when patches, new threats or new versions arrive, and scan for drift away from it.

Exam tip Exam tip: "one approved configuration plus a tool that flags drift" = secure baseline.

Hardening targets

Hardening = removing what is not needed and locking down the rest. Each target has its own focus:

  • Mobile devices: screen lock, encryption, MDM, app store only. Workstations: patches, EDR, no local admin, host firewall.
  • Switches and routers: change default creds, disable unused ports and services, SSH not Telnet, secure management access.
  • Cloud infrastructure: least-privilege IAM, no public storage by default, logging on, secure templates.
  • Servers: minimal roles and services, patching, strong admin access, logging.
  • ICS/SCADA, embedded systems, RTOS and IoT devices: change defaults, segment, apply vendor firmware when available, compensate when not.

Wireless installation: site surveys and heat maps

Before installing access points, do a site survey: walk the building, measure signal and interference, and find where APs should go. The result is often a heat map, a floor plan colored by signal strength. Good placement keeps coverage inside the building (less signal leaking to the parking lot) and also reveals rogue access points that should not be there.

Mobile solutions

Mobile device management (MDM) pushes policies to phones and tablets: passcodes, encryption, approved apps, remote wipe, separating work and personal data.

  • BYOD (bring your own device): employee owns it; hardest to control, privacy concerns.
  • COPE (corporate-owned, personally enabled): company owns it, user may use it personally.
  • CYOD (choose your own device): user picks from an approved list; company owns and manages it.
  • Connection methods: Cellular (carrier network, bypasses company Wi-Fi controls), Wi-Fi (watch for rogue APs and evil twins), Bluetooth (turn off discoverable mode, pair only known devices).

Exam tip Trap: BYOD and CYOD sound alike. BYOD = the employee owns it. CYOD = the company owns it, the employee picked it.

Objective 4.1

Wireless settings and application security

Wireless security settings

WPA3 replaces WPA2's pre-shared key exchange with SAE, which resists offline password guessing and gives forward secrecy; protected management frames are required. AAA/RADIUS: WPA2/WPA3-Enterprise sends each user's login through 802.1X to a RADIUS server for authentication, authorization and accounting. Cryptographic protocols: WPA2 uses CCMP with AES; WPA3 keeps AES and adds a 192-bit mode with GCMP-256. Avoid WEP and TKIP. Authentication protocols: EAP methods such as EAP-TLS (certificates), PEAP and EAP-TTLS.

Exam tip Exam tip: "users log in with their own accounts on Wi-Fi" = Enterprise mode with 802.1X and RADIUS, not a shared password.

Application security

Build security into the code:

  • Input validation: check every input on the server against what is allowed (type, length, format). Stops injection and overflows.
  • Secure cookies: the Secure attribute sends the cookie only over HTTPS; HttpOnly hides it from scripts; SameSite limits cross-site sending.
  • Static code analysis (SAST): scans source code without running it. Finds flaws early; can raise false positives.
  • Code signing: a digital signature proves who published the code and that it was not altered. It does not prove the code is safe.

Exam tip Trap: client-side (browser) validation is for user convenience. Attackers skip it; server-side validation is the control.

Sandboxing and monitoring

Sandboxing runs code in an isolated environment with no access to the real system: test new apps, open suspicious attachments, detonate malware safely. Mobile OSes sandbox every app from the others. Monitoring watches systems and applications for unusual behavior (crashes, odd logins, unexpected outbound connections) so problems are caught early.

Objective 4.2

Asset management, cradle to grave

Acquisition and assignment

Acquisition/procurement process: buy only from approved vendors, with security requirements in the purchase (supported OS, patch commitments, no default passwords). Assignment/accounting: every asset gets ownership: an owner, a person accountable for it, and a classification (how sensitive or critical it is), which decides how it must be protected.

Monitoring and asset tracking

You must know what you have. Inventory is the maintained list of assets: hardware, software and licenses, with owner, location and status. Enumeration is actively discovering and listing what is really out there (network scans, agent check-ins, cloud APIs) so unknown or rogue devices show up and can be compared against the inventory.

Exam tip Exam tip: "a scan finds devices not on the list" = enumeration exposing inventory gaps (shadow IT).

Disposal and decommissioning

When an asset leaves service, its data must not leave with it.

  • Sanitization: wipe data so it cannot be recovered, leaving the media reusable (overwrite, secure erase, cryptographic erase).
  • Destruction: physically ruin the media (shredding, pulverizing, incinerating; degaussing for magnetic media).
  • Certification: a documented certificate of sanitization or destruction, usually from the disposal vendor, as proof.
  • Data retention: keep data only as long as law and policy require, then dispose of it. Do not destroy what you must keep.

Exam tip Trap: degaussing works on magnetic media (hard disks, tapes), not on SSDs or flash. Use secure erase, crypto erase or shredding for SSDs.

Check yourself 1A developer's login page checks the email format with JavaScript in the browser. A tester sends a SQL injection string straight to the server with a proxy tool and it works. What fix is needed?

  1. Add code signing to the JavaScript file
  2. Validate input on the server side
  3. Mark the session cookie as Secure
  4. Run the page in a sandbox
Show the answer

Answer: B. Validate input on the server side

Attackers can skip browser checks entirely, so input must be validated on the server. Code signing and cookie flags do not stop injection.

Check yourself 2Kibble & Co. retires 60 laptops with SSDs. The recycler will resell the drives. Which approach protects the data AND lets the drives be reused?

  1. Degaussing each drive
  2. Shredding the drives
  3. Deleting the user folders
  4. Sanitizing with secure erase
Show the answer

Answer: D. Sanitizing with secure erase

Sanitization (such as secure erase or cryptographic erase) makes data unrecoverable while leaving the drive usable. Degaussing does not work on SSDs.

Practice questions

Answer in your head, then open the answer. Ranger's Cyber Patrol has 60 questions like these for Security+, with mock exams.

Question 1Kibble & Co.'s warehouse has 80 handheld scanners that support only WPA2-Personal and cannot be replaced this year, plus staff laptops that support WPA3-Enterprise. Today everything shares one WPA2-Personal SSID on the corporate VLAN. Which design BEST improves security without stranding the scanners?

  1. Keep the one WPA2 SSID, but hide it and filter by MAC address
  2. Laptops on WPA3-Enterprise; scanners on an isolated WPA2 SSID and VLAN
  3. Switch the shared SSID to WPA2-Enterprise with 802.1X for every device
  4. Move every device to WPA3-Personal with SAE on the corporate VLAN
Show the answer

Answer: B. Laptops on WPA3-Enterprise; scanners on an isolated WPA2 SSID and VLAN

Laptops get per-user 802.1X authentication, and the scanners, which can only do WPA2-Personal, are confined to their own SSID and VLAN with a strong key, so a leaked key cannot reach corporate systems. Hidden SSIDs and MAC filters are easily bypassed.

Question 2Kibble & Co.'s server baseline history is in the exhibit. What is the BEST next step?

  1. Accept the drift, since 46 of 60 servers still match v1
  2. Create a separate baseline just for the 14 servers that drifted from v1
  3. Review the drift, update the baseline for 2.1, then redeploy it
  4. Rebuild the 14 drifted servers from the January images
Show the answer

Answer: C. Review the drift, update the baseline for 2.1, then redeploy it

Secure baselines must be maintained: reviewed when benchmarks change and enforced again when systems drift. Rebuilding from January images restores outdated settings and may wipe changes the app teams legitimately need.

Question 3Kibble & Co. will buy and own phones for its sales staff. Staff may install personal apps and use the phones after hours, but the company must be able to wipe the entire device if it is lost. Everyone gets the same standard model. Which deployment model fits BEST?

  1. CYOD (choose your own device)
  2. VDI (virtual desktop infrastructure)
  3. BYOD (bring your own device)
  4. COPE (corporate-owned, personally enabled)
Show the answer

Answer: D. COPE (corporate-owned, personally enabled)

COPE devices are bought, owned and fully managed by the company while still allowing personal use. CYOD also uses company-owned devices, but it lets staff choose from a list of models, which the company is not offering.

Question 4A pen test of the shop found the response header in the exhibit. The tester stole session cookies two ways: with script injected into a product review page, and by sniffing a customer's plain HTTP request on hotel Wi-Fi. Which TWO attributes should be added to stop both? (Choose two.)

  1. SameSite=None
  2. Secure
  3. Expires one year ahead
  4. HttpOnly
  5. Domain=.kibbleco.example
Show the answer

Answers: B. Secure, D. HttpOnly

HttpOnly stops page scripts from reading the cookie, which blocks theft through injected script, and Secure makes the browser send it only over HTTPS, which blocks sniffing on open Wi-Fi. The other options loosen the cookie's scope or lifetime.

Question 5Kibble & Co. reviews the media disposal records in the exhibit. Policy requires proven sanitization or destruction for any media that held confidential data. Which record is out of compliance?

  1. LT-204
  2. SRV-07
  3. LT-118
  4. TP-003
Show the answer

Answer: A. LT-204

A quick format only removes the file table, so LT-204's confidential data can still be recovered, and nothing proves sanitization. A verified crypto erase on an SSD and vendor shredding with a certificate both meet policy; TP-003 held public data.

Practice it in Ranger's Cyber PatrolThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.