CompTIA - Network Vulnerability Assessment Professional (Security+/PenTest+)

Curriculum

Security+

1.0 Threats, Attacks and Vulnerabilities

• 1.1 Given a scenario, analyse indicators of compromise and determine the type of malware.
• 1.2 Compare and contrast types of attacks.
• 1.3 Explain threat actor types and attributes.
• 1.4 Explain penetration testing concepts.
• 1.5 Explain vulnerability scanning concepts.
• 1.6 Explain the impact associated with types of vulnerabilities.

2.0 Technologies and Tools

• 2.1 Install and configure network components, both hardwareand software-based, to support organisational security.
• 2.2 Given a scenario, use appropriate software tools to assess the security posture of an organisation.
• 2.3 Given a scenario, troubleshoot common security issues.
• 2.4 Given a scenario, analyse and interpret output from security technologies.
• 2.5 Given a scenario, deploy mobile devices securely.
• 2.6 Given a scenario, implement secure protocols.

3.0 Architecture and Design

• 3.1 Explain use cases and purpose for frameworks, best practices and secure configuration guides.
• 3.2 Given a scenario, implement secure network architecture concepts.
• 3.3 Given a scenario, implement secure systems design.
• 3.4 Explain the importance of secure staging deployment concepts.
• 3.5 Explain the security implications of embedded systems.
• 3.6 Summarise secure application development and deployment concepts.
• 3.7 Summarise cloud and virtualisation concepts.
• 3.8 Explain how resiliency and automation strategies reduce risk.
• 3.9 Explain the importance of physical security controls.

4.0 Identity and Access Management

• 4.1 Compare and contrast identity and access management concepts.
• 4.2 Given a scenario, install and configure identity and access services.
• 4.3 Given a scenario, implement identity and access management controls.
• 4.4 Given a scenario, differentiate common account management practices.

5.0 Risk Management

• 5.1 Explain the importance of policies, plans and procedures related to organisational security.
• 5.2 Summarise business impact analysis concepts.
• 5.3 Explain risk management processes and concepts.
• 5.4 Given a scenario, follow incident response procedures.
• 5.5 Summarise basic concepts of forensics.
• 5.6 Explain disaster recovery and continuity of operation concepts.
• 5.7 Compare and contrast various types of controls.
• 5.8 Given a scenario, carry out data security and privacy practices.

6.0 Cryptography and PKI

• 6.1 Compare and contrast basic concepts of cryptography.
• 6.2 Explain cryptography algorithms and their basic characteristics.
• 6.3 Given a scenario, install and configure wireless security settings.
• 6.4 Given a scenario, implement public key infrastructure.

PenTest+

1. Planning and Scoping

• Explain the importance of planning for an engagement
• Explain key legal concepts.
• Explain the importance of scoping an engagement properly.
• Explain the key aspects of compliance-based assessments.

2. Information Gathering and Vulnerability Identification

• Given a scenario, conduct information gathering using appropriate techniques
• Given a scenario, perform a vulnerability scan.
• Given a scenario, analyse vulnerability scan results
• Explain the process of leveraging information to prepare for exploitation.
• Explain weaknesses related to specialised systems

3. Attacks and Exploits

• Compare and contrast social engineering attacks
• Given a scenario, exploit network-based vulnerabilities
• Given a scenario, exploit wireless and RF-based vulnerabilities
• Given a scenario, exploit application-based vulnerabilities
• Given a scenario, exploit local host vulnerabilities
• Summarise physical security attacks related to facilities
• Given a scenario, perform post-exploitation techniques

4. Penetration Testing Tools

• Given a scenario, use Nmap to conduct information gathering exercises
• Compare and contrast various use cases of tools
• Given a scenario, analyse tool output or data related to a penetration test
• Given a scenario, analyse a basic script (limited to Bash, Python, Ruby, and PowerShell)

5. Reporting and Communication

• Given a scenario, use report writing and handling best practices
• Explain post-report delivery activities
• Given a scenario, recommend mitigation strategies for discovered vulnerabilities
• Explain the importance of communication during the penetration testing process