Core 2 Domain 2: Security (28%)¶

Overview¶

Security ties with Operating Systems as the largest Core 2 domain. It is the technician's view of security: physical and logical controls, securing Windows, wireless protocols, malware and how to remove it, social engineering, hardening workstations and phones, destroying data safely, and locking down SOHO routers and browsers. It overlaps with Security+ but stays practical. Expect "given a scenario, configure" questions, and a PBQ that orders the malware removal steps.

The objectives are:

• 2.1 Summarize various security measures and their purposes.
• 2.2 Given a scenario, configure and apply basic Microsoft Windows OS security settings.
• 2.3 Compare and contrast wireless security protocols and authentication methods.
• 2.4 Summarize types of malware and tools/methods for detection, removal, and prevention.
• 2.5 Compare and contrast common social engineering attacks, threats, and vulnerabilities.
• 2.6 Given a scenario, implement procedures for basic SOHO malware removal.
• 2.7 Given a scenario, apply workstation security options and hardening techniques.
• 2.8 Given a scenario, apply common methods for securing mobile devices.
• 2.9 Compare and contrast common data destruction and disposal methods.
• 2.10 Given a scenario, apply security settings on SOHO wireless and wired networks.
• 2.11 Given a scenario, configure relevant security settings in a browser.

2.1 Security Measures¶

Physical security¶

Physical access security¶

Key fobs, smart cards, mobile digital keys (phone as badge), physical keys, and biometrics: retina scanner, fingerprint scanner, palm print scanner, facial recognition technology (FRT), and voice recognition.

Logical security¶

MFA strength: SMS and voice codes can be intercepted by SIM swapping, so authenticator apps and hardware tokens are stronger. Two passwords are not MFA, they are the same factor.

2.2 Windows Security Settings¶

Microsoft Defender Antivirus and Firewall¶

• Defender Antivirus - Built in. Activate or deactivate (it disables itself when a third-party antivirus is installed), and update definitions (through Windows Update or manually).
• Defender Firewall - Activate or deactivate per profile, configure port security (allow only needed ports), and application security (allow specific apps).

📖 Microsoft Defender Antivirus in Windows - How the built-in antivirus works and is managed

Users and groups¶

Log-in options¶

Username and password, PIN (tied to the device and TPM, not usable remotely), fingerprint, facial recognition, SSO, and Windows Hello / passwordless.

📖 Windows Hello for Business - Microsoft's passwordless sign-in documentation

NTFS vs share permissions¶

This is one of the most tested concepts in the domain.

• Combined rule: when accessing over the network, the most restrictive of the share and NTFS permissions wins.
• Inheritance: folders and files inherit permissions from their parent unless inheritance is disabled.
• Move vs copy: moving a file within the same NTFS volume keeps its permissions. Copying, or moving to a different volume, takes the destination folder's permissions.
• Explicit deny beats allow.
• File and folder attributes such as read-only, hidden, and archive are separate from permissions.

flowchart LR
    U["Remote user"] --> S{"Share permission"}
    S --> N{"NTFS permission"}
    N --> R["Effective access =<br/>most restrictive of the two"]
    L["Local user at the PC"] --> N2{"NTFS permission only"}
    N2 --> R2["Effective access =<br/>NTFS"]

Network access passes through both share and NTFS permissions, and the stricter one wins. Local access uses NTFS alone.

Run as administrator and UAC¶

• Run as administrator elevates one app with admin rights.
• User Account Control (UAC) prompts before changes that need admin rights. It stops malware silently making system changes. Do not turn it off.

Encryption¶

📖 BitLocker Overview - Microsoft's BitLocker documentation

Active Directory tasks¶

The objective lists the tasks a technician does in AD:

• Joining a domain - System properties, needs a Pro or higher edition and domain admin (or delegated) credentials.
• Assigning a log-in script - Runs at sign-in, often to map drives.
• Moving objects within organizational units (OUs) - Moving a user or computer to another OU changes which Group Policy applies.
• Assigning home folders - A personal network folder for each user.
• Applying Group Policy - Linked to sites, domains, or OUs. Refresh with gpupdate /force.
• Selecting security groups - Assign permissions to groups, not individuals.
• Configuring folder redirection - Stores Documents and Desktop on a server, so they follow the user and get backed up.

📖 Active Directory Domain Services Overview - How AD DS stores and manages identities

2.3 Wireless Security and Authentication¶

Protocols and encryption¶

Authentication¶

2.4 Malware¶

Types¶

Tools and methods¶

2.5 Social Engineering, Threats, and Vulnerabilities¶

Social engineering¶

Threats¶

Vulnerabilities¶

Non-compliant systems, unpatched systems, unprotected systems (missing antivirus or firewall), EOL operating systems, and BYOD devices outside IT's control.

2.6 SOHO Malware Removal¶

CompTIA lists the procedure in ten numbered steps. Learn the order exactly: PBQs ask you to arrange it.

flowchart TB
    S1["1. Investigate and verify<br/>malware symptoms"] --> S2["2. Quarantine the infected system"]
    S2 --> S3["3. Disable System Restore<br/>(Windows Home)"]
    S3 --> S4["4. Remediate infected systems"]
    S4 --> S5["5. Update anti-malware software"]
    S5 --> S6["6. Scan and removal techniques<br/>(safe mode, preinstallation environment)"]
    S6 --> S7["7. Reimage/reinstall if needed"]
    S7 --> S8["8. Schedule scans and run updates"]
    S8 --> S9["9. Enable System Restore and<br/>create a restore point"]
    S9 --> S10["10. Educate the end user"]

The ten-step malware removal procedure from objective 2.6. Steps 4 to 7 are the remediation phase.

Why each step matters:

• Quarantine stops the malware spreading. Disconnect from the network, and do not plug in USB drives from other machines.
• Disable System Restore because restore points may contain the malware. Once clean, re-enable it and create a fresh, clean restore point.
• Update anti-malware before scanning so the newest signatures are used. If the malware blocks updates, download definitions on a clean machine.
• Safe Mode or a preinstallation environment (WinPE) stops the malware loading, so the scanner can remove it.
• Reimage when you cannot be sure the system is clean, such as with rootkits.
• Educate the user so it does not happen again.

2.7 Workstation Hardening¶

2.8 Securing Mobile Devices¶

2.9 Data Destruction and Disposal¶

Physical destruction¶

Recycling or repurposing¶

Outsourcing and compliance¶

• Third-party vendor - A certified destruction or recycling company.
• Certificate of destruction/recycling - Proof for auditors that media was destroyed.
• Regulatory and environmental requirements - Data regulations (HIPAA, GDPR, and similar) and e-waste laws.

📖 NIST SP 800-88 - Guidelines for Media Sanitization - Clear, purge, and destroy methods for every media type

2.10 SOHO Network Security¶

Router settings¶

• Change default passwords - The first thing to do.
• IP filtering - Allow or block by address.
• Firmware updates - Fix vulnerabilities.
• Content filtering - Block categories of websites.
• Physical placement/secure locations - Keep the router where visitors cannot reset it.
• UPnP - Lets devices open ports automatically. Convenient but abused by malware. Disable unless needed.
• Screened subnet - Formerly DMZ. A zone for public-facing devices, separate from the internal network.
• Configure secure management access - HTTPS only, disable remote (WAN-side) administration.

Wireless settings¶

• Change the SSID from the default so it does not reveal the router model.
• Disabling SSID broadcast hides the name from casual view. It is not real security, since the SSID is still visible in traffic.
• Encryption settings - WPA3 or WPA2-AES with a long passphrase.
• Guest access - A separate network, isolated from internal devices.

Firewall settings¶

• Disable unused ports on the router and switch.
• Port forwarding/mapping - Send inbound traffic on a port to one internal device (such as a camera DVR or game server). Forward only what is needed.

2.11 Browser Security¶

Private browsing does not hide activity from the network, employer, or ISP. It only stops history and cookies being saved locally.

Exam Tips and Traps¶

1. Access control vestibule stops tailgating.
2. Share plus NTFS = most restrictive. Moving within a volume keeps permissions.
3. Home edition has no BitLocker. Use device encryption if supported, or upgrade to Pro.
4. EFS encrypts files, BitLocker encrypts drives.
5. WPA3 with SAE is the best wireless answer. TKIP is outdated.
6. TACACS+ = TCP, separates AAA, encrypts everything. RADIUS = UDP, encrypts password only.
7. Malware removal order: investigate, quarantine, disable System Restore, remediate (update, scan, reimage), schedule scans, re-enable System Restore, educate.
8. Degaussing does not work on SSDs. Standard format does not remove data.
9. Disable UPnP and WPS, change default credentials, update firmware.
10. Hiding the SSID is not security.
11. Evil twin is a fake access point. On-path is interception.
12. Rootkit means reimage.

Related Notes¶

• 06 - Operating Systems - Which editions support which security features
• 08 - Software Troubleshooting - Recognizing infections from symptoms
• 02 - Networking - Ports and SOHO network setup
• Security+ (SY0-701) - The next step for this material