Tags: a+, CompTIA
As I explained in my last post, CompTIA has released a new version of the A+ certification by rolling out the 220-901 and 220-902 exams on December 15, 2015. The old 220-801 and 220-802 exams are still available, but they will retire on June 30, 2016 in the United States.
In this post, I will cover the first two objectives for 220-901, Hardware and Networking. I’ll give you the entire overview of each objective, list each subobjective, tell you where each topic fell in the old A+ 800-series (if applicable), and put all changes or additions in RED ITALICS.
I will not call out any deleted topics, although CompTIA has removed some topics (for example, floppy drives and SCSI). This is because I am not really sure if those topics were actually removed from the exam, or if they are just so insignificant that they aren’t called out in the objective listing, but are still floating around in some test questions. Remember that CompTIA’s objective listing contains a disclaimer that says,
“The lists of examples provided in bulleted format below each objective are not exhaustive lists. Other examples of technologies, processes or tasks pertaining to each objective may also be included on the exam although not listed or covered in this objectives document.”
For this reason, I didn’t want to focus on what was removed. My exam experience has shown that the bullet lists are not exhaustive. Spending time focusing on what was removed may give you a false sense of security by making you think you don’t need to study those topics. So I am just ignoring any topic removals.
First, a note about “Bloom’s Levels”
In this and subsequent posts, you’ll see me refer to topics changing their Bloom’s level. In the instructional design world, Bloom’s taxonomy is a model for describing the depth or complexity of a learning outcome, much like the OSI model describes the level at which a network component operates. Level 1 is basic memorization (what is a router?), where level 6 is complete mastery of a concept (designing a network from scratch).
If I mention here that a Bloom’s level has changed, it generally means that CompTIA is asking for something more complex than memorization. While these changes shouldn’t scare you, there is a bit more “rubber meeting the road” to the higher Bloom’s levels. For example, instead of recognizing various LCD technologies from a list, you may be asked to evaluate which LCD is the best choice for a given scenario. Instead of answering a question about how CIDR notation behaves in abstract, you may be asked to configure a subnet mask.
220-901 Objective 1: Hardware
A+ 220-801 covered hardware in its own domain and included BIOS, motherboards, RAM, expansion cards, storage devices, CPUs and cooling, connectors and cables, power supplies, custom configurations, display devices, and peripherals. In A+ 220-901, hardware has been expanded to include UEFI and printers and multi-functional devices (which was its own objective in 220-801). In some cases, minor wording changes occured at the subobjective level.
1.1 Given a scenario, configure settings and use BIOS/UEFI tools on a PC. – From Objective 1, subobjective 1 in the old version. The Bloom’s level for this objective increased, because the “Given a scenario” qualification is now part of this objective. Instead of simply identifying what a setting does, you will likely be asked to choose the correct setting for a given set of conditions. There is only one new topic:
- Secure boot – added to BIOS security sub-section
1.2 Explain the importance of motherboard components, their purpose, and properties. – From Objective 1, subobjective 2 in 220-801. The Bloom’s level (and therefore the difficulty) for this objective changed as well, because the “Explain the importance” phrase is used instead of “Differentiate between” (demonstrating knowledge without application) in the old version. One new topic was added:
- Mini-ITX – added to Sizes section
1.3 Compare and contrast various RAM types and their features. – From Objective 1, subobjective 3 in 220-801. One new topic was added:
- Buffered versus unbuffered – added to Types section
1.4 Install and configure PC expansion cards. – From Objective 1, subobjective 4 in 220-801. One new topic was added:
- Storage cards – added
1.5 Install and configure storage devices and use appropriate media. – From Objective 1, subobjective 5 in 220-801. New topics include:
- Hybrid and eMMC – added to Solid state/flash drives section
1.6 Install various types of CPUs and apply the appropriate cooling methods. – From Objective 1, subobjective 6 in 220-801. The Bloom’s level for this objective changed because the “Install” phrase (using acquired knowledge) is used instead of “Differentiate among” (demonstrating knowledge without application) in the old version. New topics include:
- Intel 1150, 2011 – added to Socket types section
- AMD FM2, FM2+ – added to Socket types section
- Disable execute bit – added to Characteristics section
- Fanless/passive – added to Cooling section
1.7 Compare and contrast various PC connection interfaces, their characteristics and purpose. – From Objective 1, subobjective 7 in 220-801. New topics include:
- Analog and Digital (Optical connector) – added to Audio sub-section
- NFC – added to Wireless connections section
- Quality and DRM – added to Characteristics section
1.8 Install a power supply based on given specifications. – From Objective 1, subobjective 8 in 220-801. One new topic was added:
- Dual rail – added to Specifications section
1.9 Given a scenario, select the appropriate components for a custom PC configuration, to meet customer specifications or needs. – From Objective 1, subobjective 9 in 220-801. The Bloom’s level for this objective was raised to include “Given a scenario.” New topics are:
- Multicore processor – changed from Powerful processor in Graphic / CAD / CAM design workstation section. This change simply updates the test’s language to current PC technology, as all “powerful” processors today will be multicore by default.
- Multicore processor – changed from Powerful processor in Gaming PC section. Again, this is not new knowledge, but rather an update of the test’s nomenclature.
- Meets recommended requirements for selected OS – changed from Meets recommended requirements for Windows in Standard thick client section. This is an important change because it shows a shift back to including other operating systems besides Windows, which hasn’t been the case in the past few A+ releases.
- Meets minimum requirements for selected OS – changed from Meets minimum requirements for running Windows in Thin client section.
- Network connectivity – added to Thin client section.
1.10 Compare and contrast types of display devices and their features. – From Objective 1, subobjective 10 in 220-801. The Bloom’s level for this objective changed because the “Compare and contrast” phrase is used instead of “Given a scenario, evaluate” in the old version. New topics include:
- TN vs. IPS and Flourescent vs. LED backlighting – added in the LCD sub-section
- Refresh / frame rates – added frame rates
- Aspect ratios (16:9, 16:10, and 4:3) – added specific ratios
1.11 Identify common PC connector types and associated cables. – From Objective 1, subobjective 11 in 220-801. New topics include:
- Adapters and converters (DVI to HDMI, USB A to USB B, USB to Ethernet, DVI to VGA, Thunderbolt to DVI, PS/2 to USB, and HDMI to VGA) – all added, and all reflective of the cables commonly available in today’s computing environments.
1.12 Install and configure common peripheral devices. – From Objective 1 subobjective 12 in 220-801. New topics include:
- Biometric devices, Motion sensor, Touch pads, Smart card readers, and Digital cameras – added to the Input devices section
- Smart TV and Set-Top Box – added to the Input & Output devices section
1.13 Install SOHO multifunction device / printers and configure appropriate settings. – From Objective 4, subobjective 2 in 220-801. The Bloom’s level for this objective changed because the “Given a scenario” phrase has been removed. In addition, multifunction devices have been added and configuration knowledge is required. The new topics include:
- Configuration settings (Duplex, Collate, Orientation, and Quality) – added to the Use appropriate drivers for a given operating system section
- Infrastructure vs. adhoc – added to the Wireless sub-section
- Cloud printing/remote printing – added to the Device sharing section
- TCP/Bonjour/AirPrint – added to the Sharing local/networked device via Operating System settings sub-section
- Data privacy (User authentication on the device and Hard drive caching) – added to the Public/shared devices section
1.14 Compare and contrast differences between the various print technologies and the associated imaging process. – From Objective 4, subobjective 1 in 220-801. The wording changed to “Compare and contrast” from “Explain the differences between,” but in my opinion, this change did not affect the Bloom’s level. New topic is:
- Virtual (Print to file, Print to PDF, Print to XPS, and Print to image) – added
1.15 Given a scenario, perform appropriate printer maintenance. – From Objective 4, subobjective 3 in 220-801. New topics include:
- Inkjet (Clean heads, replace cartridges, calibration, clear jams) – added
220-901 Objective 2: Networking
A+ 220-801 covered networking in its own domain and included network cables and connectors, TCP/IP, TCP and UDP ports and protocols, wireless networking standards and encryption, SOHO wireless/wired router installation and configuration, Internet connection types, network types, network devices, and networking tools. In A+ 220-901, minor wording changes occurred at the subobjective level. All changes are in RED ITALICS.
2.1 Identify the various types of network cables and connectors. – From Objective 2, subobjective 1 in 220-801. This subobjective had no changes.
2.2 Compare and contrast the characteristics of connectors and cabling. – From Objective 2, subobjective 2 in 220-801. Slight wording change at subobjective level, but no change in the Bloom’s level. New topics include:
- CAT6e, CAT7 – added to Twisted pair section
- Splitters and effects on signal quality – added to Twisted pair and Coaxial sections
2.3 Explain the properties and characteristics of TCP/IP. – From Objective 2, subobjective 3 in 220-801. New topics include:
- Public vs. private vs. APIPA/link local – added link local
- Subnet mask vs. CIDR – added CIDR
2.4 Explain common TCP and UDP ports, protocols, and their purpose. – From Objective 2, subobjective 4 in 220-801. New topics include:
- 22 – SSH; 137-139, 445 – SMB; and 548 or 427 – AFP – added to Ports section
- CIFS and AFP – added to Protocols section
2.5 Compare and contrast various WiFi networking standards and encryption types. – From Objective 2, subobjective 5 in 220-801. New topics include:
- 802.11ac – added to Standards section
2.6 Given a scenario, install and configure SOHO wireless/wired router and apply appropriate settings. – From Objective 2, subobjective 6 in 220-801. The Bloom’s level for this objective changed because the “Given a scenario” qualification is now part of this objective. New topics include:
- NAT / DNAT – added DNAT
- Firmware – added
- UPnP – added
2.7 Compare and contrast Internet connection types, network types, and their features. – From Objective 2, subobjective 7 and 8 in 220-801. New topics include:
- Tethering – added in the Cellular subsection
2.8 Compare and contrast network architecture devices, their functions, and features. – From Objective 2, subobjective 9 in 220-801. New topics include:
- Patch panel– added
- Repeaters/extenders – added
- Ethernet over Power – added
- Power over Ethernet injector – added
2.9 Given a scenario, use appropriate networking tools. – From Objective 2, subobjective 10 in 220-801. New topics include:
- Cable stripper – added
- Tone generator & probe – added generator
- WiFi analyzer – added
As you can see, I am just covering the high points and not delving too deeply into these topics. My point here is to help those who already know the A+ understand exactly what new topics they need to study. CompTIA has started a series of Webinars called Deep Dive: A Look Inside the A+ 900 Series Objectives that cover these topics much more deeply than I do. You can access these Webinars by joining the CompTIA Instructor Network at http://bit.ly/1Sxj3h9.
Remember, this post is part of a series of posts I will be completing. Here are the details for those posts:
- The New A+ 900 Series: What’s New (Part 1 of 5) – already released post that contains introductory information that you need to know
- The New A+ 900 Series: What’s New (Part 2 of 5) – this post that contains information on 220-901 objective 1 and 2
- The New A+ 900 Series: What’s New (Part 3 of 5) – the next post that will contain information on 220-901 objective 3 and 4
- The New A+ 900 Series: What’s New (Part 4 of 5) – the post that will contain information on 220-902 objective 1 and 2
- The New A+ 900 Series: What’s New (Part 5 of 5) – the final post that will contain information on 220-902 objective 3, 4, and 5
To help you get through the holiday doldrums and start your 2016 study schedule off right, we just launched our 220-901 practice test! It includes performance-based questions and covers all the 220-901 topics.
Thanks again for reading!
Tags: a+, exam expirations
It’s that time again! CompTIA has released a new version of the A+ certification by rolling out the 220-901 and 220-902 exams on December 15. The 220-801 and 220-802 exams are still available, but will retire June 30, 2016 in the United States. This deadline should give you enough time to finish studying for the 800 series if you have already taken one test, because you cannot mix and match exam versions. If you pass the 220-801 or 220-802 exam, you must pass the other 800-series exam to obtain your A+. If you pass the 220-901 or 220-902 exam, you must take the other 900-series exam to obtain the A+.
To help you get through the holiday doldrums and start your 2016 study schedule off right, we just launched our 220-901 practice test!
Once again, with a new release, we see another small shift in the structure and topic coverage of the two exams. Years ago (and I am going to date myself here), the two exams were referred to as a Hardware exam and a Software exam. While I think the topic coverage is moving in this direction again, CompTIA is NOT referring to them in these terms, and all documentation from CompTIA will refer to them as 220-901 and 220-902. Broadly, though, I think of the tests as “hardware and networking” and “software and security.”
For the 220-901 exam, you will be expected to understand installing, configuring, and troubleshooting desktop, laptop, mobile device, and printer hardware, as well as basic networking topics. The breakdown of the exam’s topics are as follows:
- Hardware – 34%
- Networking – 21%
- Mobile Devices – 17%
- Hardware & Network Troubleshooting – 28%
For the 220-902 exam, you will be expected to understand installing, configuring, and troubleshooting Windows Vista, Windows 7, Windows 8, Windows 8.1, Mac OS, Linux, and mobile device operating systems. (Notice that Windows 10 is NOT included in this list.) It includes virtualization, cloud, and. server technologies. It also covers security, including security devices and configuring and troubleshooting security components. Finally, it covers those soft skills and operational procedures required by the IT technician. The breakdown of the exam’s topics are as follows:
- Windows Operating System – 29%
- Other Operating Systems & Technologies – 12%
- Security – 22%
- Software Troubleshooting – 24%
- Operational Procedures – 13%
When the 800-series A+ was released back in 2012, many test candidates decided to knock out both exams on the same day because there was so much overlap between the topics being covered. For those exams, this was probably a good strategy. But with the 900-series exams, the structure has changed enough that I would suggest that you prepare to take them separately, NOT on the same day. As you can see from the topic listings above, there is hardly any overlap between the two exams.
Over the next few weeks, I will be posting four more parts to this series and discuss changes to each topic area in depth:
- Part 2 – 220-901 obj 1 (Hardware) and obj 2 (Networking)
- Part 3 – 220-901 obj 3 (Mobile Devices) and obj 4 (Hardware & Network Troubleshooting)
- Part 4 – 220-902 obj 1 (Windows Operating Systems) and obj 2 (Other Operating Systems & Technologies)
- Part 5 – 220-902 obj 3 (Security), obj 4 (Software Troubleshooting), and obj 5 (Operational Procedures)
CompTIA has launched a new CompTIA Instructor Network (CIN), which I encourage all CompTIA instructors to join. It’s easy as going here to sign up. It is a great way to network with other instructors. Recently, they started a Deep Dive series of Webinars on the new A+ exams! To access the A+ Deep Dive series, go here.
Watch for my upcoming posts!
CompTIA Linux+, SUSE, and LPIC-1: Three certifications for the price of one – with a special deal on top!December 18, 2015 at 3:57 pm | Posted in Certification Paths, CompTIA, LPI, Vendor news | Leave a comment
Tags: linux+, LPIC, suse
When even Microsoft is getting into the Linux game, you must know that Linux certification is one of those hot certs that all the cool admins and devs are getting. What you may not know is that a Linux certification is, hands down, the best value we know of in the certification sphere. Thanks to a partnership between three major certifying bodies – CompTIA, Linux Professional Institute (LPI), and SUSE – you can now pass one series of exams to earn three industry certifications from all three vendors at the same time.
CompTIA and LPI first partnered on the joint certification project in 2010, at which time passing the Linux+ exams from CompTIA also earned you LPIC-1 credentials. The 2015 revision loops SUSE into the game, so you now have the ability to earn THREE separate vendor certifications in one exam sitting. (In case you’re confused, SUSE and LPI previously shared a joint certification program, as did LPI and CompTIA – but not all three together.)
So what exactly do I get, and what’s the catch?
You’ll need to pass the two 2015 Linux+ exams offered by CompTIA, LX0-103 and LX0-104. (The 2010 versions were named LX0-101 and LX0-102.) When you do so, you’ll be able to add these three certifications to your resume, LinkedIn account, and brag sheet:
- SUSE Certified Linux Administrator (CLA)
- LPI’s LPIC-1: Linux Server Professional Certification
- CompTIA’s Linux+
There’s no catch, but you do have to arrange your ducks into a particular row, and you must take the CompTIA exams in particular – you cannot earn the LPIC-1 from LPI and then apply to retroactively earn the Linux+ certification. Here are the exact steps listed on CompTIA’s website as of this writing:
Being who we are, we tested these steps ourselves before blogging about it. Here’s the cheat sheet:
- Configure your CompTIA account settings so that they know to forward the results to LPI. It’s a dropdown box under the Settings tab of your CompTIA cert account.
- Wait a bit. (I got my email from LPI in about 48 hours.)
- Look through the email. You should get instructions and a link to verify your credentials with SUSE.
- Sit back and celebrate the holidays like a Linux pro!
Is there a difference in the cost?
If you went straight to each vendor and took their exams without the three-in-one deal, you’d pay $376 for EITHER the two-exam CompTIA series (LX0-103 and LX0-104) or the LPIC-1 series (Exam 1 and Exam 2). If you only wanted the SUSE certification, it’s a relative bargain to take their standard test ($125 in the US). Please note that these are US prices, and don’t include any special voucher deals, discounts, sales, or student bundles.
So if your budget extends to the two-exam series, then it makes no financial sense to leave the three-certification package on the table.
Okay, sold! Where do I start?
First, an unscheduled commercial break. (We have bills to pay around here.) If you’re in the market for training material, Transcender is offering a special discount on Linux practice tests, eLearning, and practice labs.
From now until December 31, 2015, you can pick your deal (or mix and match). We’re offering $25 off all practice tests (excluding 30-day and CD/voucher bundle), including LX0-103. And we’re offering a special 20% off discount on our newly released LX0-104/LPI 400-102 practice test (excluding 30-day and CD/voucher bundle). As of today that discount also extends to our eLearning and practice lab products for Linux.
To activate your discount, click through the shiny red button (or use promo code PRODUCT20). The deal expires at 10 PM CST.
To add products to your page, choose either LPI or CompTIA / Linux+ from the main menu, then select the relevant product from the desired test.
We also offer eLearning packages for each exam, and a separate series of online practice labs that let you develop proficiency with hardware that you may not have available to practice with otherwise.
Whether or not you choose to take advantage of our study products, you should DEFINITELY take advantage of the three-in-one Linux certification partnership – a deal we’ve never seen replicated in the professional IT certification world.
We wish you best of luck with your Linux certifying!
Tags: Cyber Security Awareness Month, instructing the instructors, webinar
Are you a CompTIA instructor? Are you aware of CompTIA’s ongoing webinar series that discusses current and changing IT trends? As Cyber Security Awareness month draws to a close, CompTIA will offer instructors a FREE interactive webinar highlighting security frameworks, with a panel of expert speakers available to answer questions.
As October Cyber Security Awareness month draws to a close join CompTIA’s James Stanger, Patrick Lane, and Stephen Schneiter as they take a look at current IT security trends and why it is important for IT professionals to understand and interpret information from data analytics. The session will define and discuss the growing importance of implementing security frameworks to protect information. Instructors will have the opportunity to ask questions to the panel about security trends and delivering this knowledge to students in our classrooms.
The webinar runs on October 29, 2015 at 1030am CT / 1130am ET / 330pm GMT. To register, click here: https://www.comptia.org/events/webinars/registration?eventid=ce102915
This webinar series is for instructors who teach CompTIA certification courses and are members of the CompTIA Instructor Network.
Tags: casp, exam expirations, Security+
Winter holidays are crunch time for many folks. Certification test-takers are no exception, as vendors typically choose the end of the calendar year to retire exams. Those seeking to earn (or renew) their Security+ have until December 31, 2014 to take the older edition of the exam, SY0-301 / JK0-018.
When the newer edition of this exam, SY0-401, was released earlier this year, Robin Abernathy blogged extensively about the changes to the objectives, topic weighting, and method of item delivery, and how these changes would affect your plan of study. If you’re on the fence about whether to knock out the 301 or wait a little longer to sit the 401, her posts may give you the information you need to make that decision:
- Part One: Depth of topic coverage and item types
- Part Two: Changes to topics in domains 1, 2, and 3
- Part Three: Changes to domains 4, 5, and 6, plus new acronyms
You can still purchase the Transcender practice exam for Cert-SY0-301.
On an additional note, CompTIA has announced they will release an updated CASP certification exam, CAS-002, launching on January 20, 2015. The new exam will repleace CAS-001, which will retire in May 2015.
Tags: casp, CompTIA, Performance-Based Testing, Security+
It’s getting close to that time of year again, folks. The CompTIA Academy Educator Conference will be held on August 1-3 in beautiful Phoenix, Arizona. (Now, I’m just taking everyone else’s word on the beautiful part. This will be my first visit there! But the pictures I’ve seen are lovely.)
This three-day event is well worth your time if you are an educator at any level (high school, college, professional) and you instruct individuals who are seeking CompTIA certifications. As a peer-to-peer networking resource, it’s beyond compare. You also get to rub elbows with some great folks – ehem – ME! Also, you don’t have to be a CompTIA Academy educator to attend. However, the sessions are designed to benefit Academy Partners. If your organization is not an Academy Partner, visit this site to learn how (and why) to become one: http://partners.comptia.org/Academy-Partner.aspx.
With the recent release of a new Security+ exam and the new CASP and Network+ exams due to be released in the coming months, it’s a great idea to attend this conference just to stay on top of things. My presentation on Friday will cover the new Security+ exam, the CASP exam, some techniques for covering the new performance-based items in your classroom. I will also share some information about braindumps/piracy and why you should never use this type of content in your classroom. You can see the full schedule here: http://www2.comptia.org/events/events/academy-educator-conference/agenda.aspx
For all conference related information, including the agenda, registration information, exhibitor information, and hotel information, visit the CompTIA Academy Educator Conference page. If you register before July 31st, you pay $199 instead of $399 at the event. Believe me when I say that this will be the best $199 you will spend.
I would LOVE to see you there!
Tags: CompTIA, Security+
In my first post, I covered the overall changes from SY0-301 to SY0-401. I described how the exam is moving from “tell” to “show and tell,” with more emphasis on applying your knowledge to scenarios than simply answering fact-based questions.
In my second post, I went into detailed changes in the first three domains. This post will wrap up the topic-level changes that will affect those who previously studied for the SY0-301, as well as those who are approaching the Security+ exam for the first time. I’ll also cover the alphabet soup of new acronyms added to the list of “terms you should be familiar with.” Hang on to your hats!
Domain 4: Application, Data and Host Security Changes
Domain 4.1 is “Explain the importance of application security controls and techniques.” There are two new topics for this domain: NoSQL databases vs. SQL databases, and Server-side vs. Client-side validation.
In SY0-301, mobile devices were covered as a subdomain of Domain 4.2, “Carry out appropriate procedures to establish host security.” The 2014 test makes mobile devices the sole topic of Domain 4.2, which is now called “Summarize mobile security concepts and technologies.” This domain covers these topics, all of which are new to the Security+ exam (with the exception of GPS):
- Device security
- Full device encryption
- Remote wiping
- GPS (included in 4.2 in SY0-301)
- Application control
- Storage segmentation
- Asset tracking
- Inventory control
- Mobile device management
- Device access control
- Removable storage
- Disabling unused features
- Application security
- Key management
- Credential management
- Application whitelisting
- Transitive trust/authentication
- BYOD concerns
- Data ownership
- Support ownership
- Patch management
- Antivirus management
- Adherence to corporate policies
- User acceptance
- Architecture/infrastructure considerations
- Legal concerns
- Acceptable use policy
- On-board camera/video
The non-mobile device topics from the old Domain 4.2 are now in the new Domain 4.3, which states “Given a scenario, select the appropriate solution to establish host security.” There are a few new topics in this domain: OS hardening, white listing vs. black listing applications, trusted OS, host-based intrusion detection, and virtualization subtopics (including snapshots, patch compatibility, host availability/elasticity, security control testing, and sandboxing).
Domain 4.4 now states “Implement the appropriate controls to ensure data security” where this SY0-301 domain (which was 4.3) merely asked you to explain concepts in data security importance. The new topics in this domain are cloud storage, SAN, Handling Big Data, data in-transit/data at-rest/data in-use, permissions/ACL, and data policies (including wiping, disposing, retention, and storage).
Domain 4.5 is another new domain, called “Compare and contrast alternative methods to mitigate security risks in static environments” (aka “Did someone hack your refrigerator?”). The topics are divided into Environments and Methods, with the following subtopics:
- Embedded (Printer, Smart TV, HVAC control)
- Android and iOS
- Game consoles
- In-vehicle computing systems
- Network segmentation
- Security layers
- Application firewalls
- Manual updates
- Firmware version control
- Control redundancy and diversity
Domain 5: Access Control and Identity Management Changes
Domain 5.1 now states “Compare and contrast the function and purpose of authentication services” where the SY0-301 domain was about explaining this information. There are only two new topics here: SAML and Secure LDAP.
Domain 5.2 now states “Given a scenario, select the appropriate authentication, authorization or access control,” where the SY0-301 domain asked you to simply explain these concepts. Many of the topics have changed their wording, but are essentially the same concept. The only new topics in this category are authentication (TOTP, HOTP, CHAP, PAP), federation, and transitive trust/authentication.
Domain 5.3 now states “Install and configure security controls when performing account management, based on best practices.” The new topics included in this domain are as follows:
- Account policy enforcement (credential management; Group policy; password history, reuse, and length; and generic account prohibition)
- User access reviews
- Continuous monitoring
Domain 6: Cryptography Changes
Domain 6.1 now states “Given a scenario, utilize general cryptography concepts” where the SY0-301 domain asked you to summarize these concepts, so this is another domain that will now involved scenario-based questions. This domain has four new topics: session keys, in-band vs. out-of-band key exchange, ephemeral key, and perfect forward secrecy.
Domain 6.2 now states “Given a scenario, use appropriate cryptographic methods,” where this SY0-301 domain did NOT mention scenarios. The new topics for this domain are Diffie-Hellman, DHE, ECDHE, cipher suites (specifically strong vs. weak ciphers), and key stretching (PBKDF2, Bcrypt).
Domain 6.3 now states “Given a scenario, use appropriate PKI, certificate management and associated components” and is the result of combining Domains 6.3 and 6.4 from SY0-301 and adding the scenario stipulation. This domain has added topic coverage for certificate authorities and digital certificates, including OCSP and CSR.
Alphabet Soup: Acronyms to Know and Love
The Security+ exam objectives also include a list of acronyms. While I don’t advocate trying to memorize the entire list, it’s good to skim it and read up on terms you’re not familiar with. You may know that concept in practice, but not by the specific name it’s called on the Security+ exam. Or it may be a concept so familiar that it never occurred to you to make an acronym of it (such as TOTP – Top of the Page ).
There are seventy new acronyms on the list (and only one removed – they no longer ask you to remember BOTS as Network Robots). I repeat, don’t panic: many of the new additions to the acronym list were already included as subtopics or topics on SY0-301. Also, the majority of these terms are familiar to anyone who does any kind of work in computers.
The completely new concepts are:
API – Application Programming Interface
ASP – Application Service Provider
BAC – Business Availability Center
BIA- Business Impact Analysis
BPA – Business Partners Agreement
BYOD – Bring Your Own Device
CAPTCHA- Completely Automated Public Turning Test to Tell Computers and Humans Apart
CIO– Chief Information Officer
COOP – Continuity of Operation Planning
CP – Contingency Planning (included as “IT contingency planning” in Domain 2.5 in SY0-301)
CSR – Control Status Register
CSU – Channel Service Unit
CTO- Chief Technology Officer
DHE – Data-Handling Electronics
DNAT – Destination Network Address Transaction
DSL – Digital Subscriber line
DSU – Data Service Unit
ECDHE – Elliptic Curve Diffie-Hellman Key Exchange
ESN- Electronic Serial Number
GPO – Group Policy Object
HOTP – HMAC based One Time Password
HTML – HyperText Markup Language
IRP – Incident Response Procedure
ISA – Interconnection Security Agreement
ISSO- Information Systems Security Officer
ITCP – IT Contingency Plan (included as “IT contingency planning” in Domain 2.5 in SY0-301)
LAN – Local Area Network (was LANMAN, Local Area Network Manager, in SY0-301)
MaaS- Monitoring as a Service
MOU – Memorandum of Understanding
MPLS – Multi-Protocol Layer Switch
MTBF – Mean Time Between Failures (a topic in 2.7 in SY0-301)
MTTR – Mean Time to Recover (a topic in 2.7 in SY0-301)
MTTF – Mean Time to Failure (a topic in 2.7 in SY0-301)
NDA – Non-Disclosure Agreement
OCSP – Online Certificate Status Protocol
OLA – Open License Agreement
P2P – Peer to Peer
PAM – Pluggable Authentication Modules
PBKDF2 – Password Based Key Derivation Function 2
PCAP – Packet Capture
PIV – Personal Identity Verification
ROI – Return of Investment
RPO – Recovery Point Objective
SAML – Security Assertions Markup Language
SAN – Storage Area Network
SCADA – System Control and Data Acquisition
SCEP- Simple Certificate Enrollment Protocol
SEH – Structured Exception Handler
SIEM – Security Information and Event Management
SOAP – Simple Object Access Point
SQL – Structured Query Language
SSD – Solid State Drive
TOTP – Top of the Page
TSIG – Transaction Signature
UEFI – Unified Extensible Firmware Interface
UDP- User Datagram Protocol
URI- Uniform Resource Identifier
UTM- Unified Threat Management
VDI – Virtualization Desktop Infrastructure
WPS – WiFi Protected Setup
WTLS – Wireless TLS
XML – Extensible Markup Language
That’s all, folks!
We have released our SY0-401 practice test, a feat we are especially proud of because we are the first product to market. Please visit the product page for more information!
Well, that’s all I have to say for now. I am sure that you will be hearing from me soon! -Robin
Tags: CompTIA, Performance-Based Testing, Security+, study tips, sy0-401
In my previous post, I covered the overall changes from SY0-301 to SY0-401. I described how the exam is moving from “tell” to “show and tell,” with more emphasis on applying your knowledge to scenarios than simply answering fact-based questions.
In this post I’ll delve into the first three domains and draw out the topic-level changes that may affect your study plan, especially if approaching your three-year renewal in Security+.
(In my final post, I’ll cover domains 4 through 6 and the list of acronyms.)
Domain 1: Network Security Changes
Domain 1.1 now states “Implement security configuration parameters on network devices and other technologies,” where this SY0-301 domain only asked you to explain each security function and its purpose. In addition, all-in-one security appliances are now referred to as UTM security appliances. These are now listed as including URL filters, content inspection, and malware inspection.
Domain 1.2 now states “Given a scenario, use secure network administration principles” where this SY0-301 domain focused on applying and implementing these principles. This particular change means that all questions now written for this domain will include scenarios.
Domain 1.3 now states “Explain network design elements and components” where they SY0-301 domain was only about distinguishing and differentiating between these components. The Cloud computing topic within this domain now has four new subtopics: Private, Public, Hybrid, and Community.
Domain 1.4 now states “Given a scenario, implement common protocols and services” where this SY0-301 domain was only about implementing common protocols. This particular change means that all questions now written for this domain will include scenarios. New protocols added to this domain include: iSCSI, Fibre Channel, FCoE, FTP, SFTP, TFTP, TELNET, HTTP, and NetBIOS. (Most of these were listed in Domain 1.5 in SY0-301 and were moved to this domain.) Also, this domain now includes a listing of port numbers that you should definitely know: 21, 22, 25, 53, 80, 110, 139, 143, 443, and 3389.
Domain 1.5 now states “Given a scenario, troubleshoot security issues related to wireless networking” where this SY0-301 domain was actually domain 1.6, where it read “Implement wireless network in a secure manner.” Once again, this domain change means that all questions now written for this domain will include scenarios. In addition, there are four new topics for this domain:
All of the new topics added to this domain are:
- Application-aware devices (1.1)
- Unified threat management (1.2)
- Layered security / Defense in depth (1.3)
- OSI relevance (1.4)
- Captive portals (1.5)
- Antenna types (1.5)
- Site surveys (1.5)
- VPN (over open wireless) (1.5)
Domain 2: Compliance and Operational Security Changes
There were so many new topics added in this domain that I have chosen to list them in the domain description (to prevent slow death by bulleted list).
Domain 2.1 now states “Explain the importance of risk-related concepts” instead of just defining the concepts, as in SY0-301. The topics that have been added to this domain are: False negatives, SLE, ARO, MTTR, MTTF, MTBF, Vulnerabilities, Threat vectors, Probability / threat likelihood, Recovery time objective, and recovery point objective.
Domain 2.2 is a new objective: “Summarize the security implications of integrating systems and data with third parties.” The topics included in this domain are as follows:
- On-boarding/off-boarding business partners
- Social media networks and/or applications
- Interoperability agreements
- Privacy considerations
- Risk awareness
- Unauthorized data sharing
- Data ownership
- Data backups
- Follow security policy and procedures
- Review agreement requirements to verify compliance and performance standards
Domain 2.3 now states “Given a scenario, implement appropriate risk mitigation strategies” instead of just carrying out these strategies as in SY0-301. One new topic was added to this domain: Enforce technology controls, including Data Loss Prevention (DLP).
Domain 2.4 is technically a new domain, but it was actually listed as a topic under Domain 2.4 in SY0-301. It states “Given a scenario, implement basic forensic procedures.” This is another domain that will include only scenario-based questions. Only one new topic is listed here: Big data analysis.
Domain 2.5 now states “Summarize common incident response procedures” where this SY0-301 domain was about executing the appropriate incident response procedures. All but one of this topics in this domain are new:
- Incident identification
- Escalation and notification
- Mitigation steps
- Lessons learned
- Recovery/reconstitution procedures
- First responder
- Incident isolation
- Device removal
- Data breach
Domain 2.6 is the same as Domain 2.4 in SY0-301. Topics that were added to this domain include: Role-based training, Information classification levels (High, Medium, Low, Confidential, Private, and Public), and Follow up and gather training metrics to validate compliance and security posture.
Domain 2.7 states “Compare and contrast physical security and environmental controls” and pulls some topics from SY0-301 Domain 2.6 Explain the impact and proper use of environmental controls. New topics to this domain include the following:
- Physical security
- Hardware locks
- Video Surveillance
- Proximity readers
- Access list
- Proper lighting
- Protected distribution (cabling)
- Motion detection
- Control types
Domain 2.8 is completely new and states “Summarize risk management best practices.” However, most of the topics in it are repeated from SY0-301 Domains 2.5 and 2.7. The NEW topics in this domain are as follows:
- Risk assessment
- IT contingency planning
- High availability
- Tabletop exercises
Domain 2.9 is completely new, and states “Given a scenario, select the appropriate control to meet the goals of security.” This domain, like many others, will only include scenario-based questions. The topics covered in this domain are as follows:
- Access controls
- Digital signatures
- Fault tolerance
- Escape plans
- Escape routes
- Testing controls
Domain 3: Threats and Vulnerabilities Changes
Domain 3.1 now states “Explain types of malware” where this SY0-301 domain asked you to analyze and differentiate malware. The new topics here are ransomware, polymorphic malware, and armored viruses.
Domain 3.2 now states “Summarize various types of attacks” where this SY0-301 domain was about analyzing and differentiating the attacks. Three new attack types were added to this domain: Password attacks (Brute force, Dictionary attacks, Hybrid, Birthday attacks, and Rainbow tables), typo squatting/URL hijacking, and watering hole attacks.
Domain 3.3 now states “Summarize social engineering attacks and the associated effectiveness with each attack” where this SY0-301 domain was about analyzing and differentiating these attacks. One new topic, Principles (reasons for effectiveness), was added with several subtopics: Authority, Intimidation, Consensus/Social proof, Scarcity, Urgency, Familiarity/liking, and Trust.
Domain 3.4 now states “Explain types of wireless attacks” where this SY0-301 domain was about analyzing and differentiating the attacks. Four new topics have been added to this domain: Near field communication, Replay attacks, WEP/WPA attacks, and WPS attacks.
Domain 3.5 now states “Explain types of application attacks” where this SY0-301 domain was about analyzing and differentiating the attacks. Four new topics have been added to this domain: Integer overflow, LSO (Locally Shared Objects), Flash Cookies, and Arbitrary code execution / remote code execution.
Domain 3.6 now states “Analyze a scenario and select the appropriate type of mitigation and deterrent techniques.” The major change to this domain is that is uses the word scenario, which implies that all questions on this topic will now be scenarios. There are no new topics in this domain.
Domain 3.7 now states “Given a scenario, use appropriate tools and techniques to discover security threats and vulnerabilities” where this Sy0-301 domain was about implementing these tools. Once again, scenarios are specifically mentioned as being the question type for this domain. Two new tools are listed in this domain: Passive vs. active tools and Banner grabbing.
Domain 3.8 now states “Explain the proper use of penetration testing versus vulnerability scanning.” Three vulnerability scanning topics have been added to this domain: Intrusive vs. non-intrusive, Credentialed vs. non-credentialed, and False positive.
Stay tuned next week, when I’ll finish out my summary of changes in Domains 4, 5, and 6!
Until next time!
Tags: CompTIA, Performance-Based Testing, Security+, study tips
Has it been three years already? It seems like just last week I was talking about SY0-301, and now here I am trying to catch my breath after pushing the 2014 Security+ exam, SY0-401, over the finish line and into our practice test lineup. (But really, I am just glad to finally get to write about something other than project management.) As usual, the new Security+ exam will include many of the same topics as the previous version. In this post I’ll focus on the overall differences between SY0-301 and SY0-401. In the next two posts (get excited!) I’ll take a closer look at changes within the examination blueprint, which can be downloaded here from CompTIA. (Note: the download requires you to provide personal information.)
Topics and weightings
At first glance, it may seem that very little has changed. The six domains are the same apart from some shifts in weighting (the percentage of the test devoted to that topic):
1.0 Network Security 20% (21% in SY0-301) 2.0 Compliance and Operational Security 18% (no change) 3.0 Threats and Vulnerabilities 20% (21% in SY0-301) 4.0 Application, Data and Host Security 15% (16% in SY0-301) 5.0 Access Control and Identity Management 15% (13% in SY0-301) 6.0 Cryptography 12% (11% in SY0-301)
As you can see from these numbers, this new distribution will probably only mean one or two questions more for Domains 5 and 6. But it’s more important to note that within each domain, there are many topic-level changes that will affect your study plan. Within these domains CompTIA has added several new topics which were not tested in 301. These new topics include application-aware devices, unified threat management, defense-in-depth, OS hardening, white-listing versus black-listing, and many others that I’ll cover in the next two posts. There are three new sub-domains distributed among Domains 2 and 4. These new sub-domains add topic coverage on mobile security, mitigating security risks in a static environment, and implementing basic forensic procedures. That last sub-domain leads neatly into my next topic: you can expect increased difficulty and more applied concept questions on the new Security+ exam, in comparison to the older style of asking straight knowledge-based questions.
Stop, Drop, & Scenario!
While many of the sub-domains cover the same list of topics, CompTIA has changed many of the keywords from “understand” and “explain” to “implement” and “troubleshoot.” Several also show the addition of one important phrase: “given a scenario.” Because this phrasing was added to so many domains, I feel I should take a little time to explain the distinction. As many of you know, the Security+ exam has been considered a mostly knowledge-based exam that includes mostly knowledge-based questions. Scenario questions are the next logical step up from knowledge-based questions. They expect you to take those tidbits of knowledge that you have memorized, remember them, and then apply them in the scenario to come up with the correct answer. Let me give you an example. First, look at a sample knowledge-based question from our practice test:
Which of the following is a default port used by FTP? a. 20 b. 53 c. 80 d. 443
Now look at another example, which turns this same question into a scenario:
Your company has recently implemented a new firewall. Users start complaining that they are unable to access resources on your company’s FTP server. What should you do? a. Open ports 20 and 21 on the new firewall. b. Open port 53 on the new firewall. c. Open port 80 on the new firewall. d. Open port 443 on the FTP server.
As you can see from my examples, you still need the same basic knowledge to answer both of these questions. So REALLY, answering these two questions is the same level of difficulty, but by adding the scenario you are ensuring that the student understands how the knowledge applies in a real-world situation. Instead of remembering which port belongs with FTP, the student also has to identify the location where the ports should be configured. I could also increase the difficulty of the scenario question by including more invalid options. We have released our SY0-401 practice test, a feat we are especially proud of because we are the first product to market. Please visit the product page for more information!
The next post will dive into the topic-level changes in Network Security (Domain 1), Compliance and Operational Security (Domain 2), and Threats and Vulnerabilities (Domain 3).
I’ll cover the other three domains in the final post in this series.
Until next time! –Robin
Tags: capm, PMP, Project Management Institute, Project+
Project management is needed in almost all fields and includes both commercial and non-commercial projects. Many colleges and universities offer degrees in the field of project management. Search any job Web site, and you will find project management positions available with many companies.
But what if you want to prove your proficiency in project management? There are many popular project management certifications that you can obtain. In this article, I want to discuss three of those certifications: CompTIA’s Project+, PMI’s Certified Associate in Project Management (CAPM), and PMI’s Project Management Professional (PMP).
Of the three certifications, CompTIA’s Project+ certification is probably the easiest to take. Like most CompTIA certifications, there are no prerequisites or qualifications to take this exam, although CompTIA does recommend one year of managing, directing, or participating in small- to medium-scale projects. The certification also does not require an application process. To take the exam, you simply register for the exam through Vue and pay the examination fee of $261 U.S.
The exam consists of 100 multiple-choice questions. You are given 90 minutes to complete the exam and need to obtain a score of 710 (on a scale of 100-900) to pass the exam.
Currently, this certification does NOT have an expiration date, meaning you will be Project+-certified for life.
PMI’s Certified Associate in Project Management (CAPM)
To take the CAPM exam, you must first complete an online application. To qualify for the exam, you will need to have a high-school diploma (or equivalent) and 1,500 hours of professional experience on a project team OR 23 hours of formal project management education. Once the application is approved for completeness, you must then pay the exam fee of $225 (PMI members) or $300 (non-members). (If your application is selected for audit, you have 90 days to submit the audit materials.) You have one year from the application approval date to take the exam.
The exam consists of 150 multiple-choice questions that focus on the material covered in the PMBOK 5th Edition. You are given 180 minutes to complete the exam. PMI does not publish the minimum score that you need to receive to obtain the certification, but you will receive a report when you complete the exam that lists your score and proficiency in the topic domains.
Currently, this certification expires five years from the date you originally passed the exam. You will need to re-take the exam to re-certify.
PMI’s Project Management Professional (PMP)
Like the CAPM exam, the PMP exam requires the completion of an online application. To qualify for the exam, you should have either of the following:
- High-school diploma, associate’s degree, or equivalent
- 5 years of professional project management experience
- 35 hours of formal project management education
- Four-year degree or equivalent
- 3 years of professional project management experience
- 35 hours of formal project management education
Once the application is approved for completeness, you must then pay the exam fee of $405 (PMI members) or $555 (non-members) for the computer-based exam. (If your application is selected for audit, you have 90 days to submit the audit materials.) You have one year from the application approval date to take the exam.
The exam consists of 200 multiple-choice, scenario-based questions based on the PMBOK 5th Edition. You are given 240 minutes to complete the exam. PMI does not publish the minimum score that you need to receive to obtain the certification, but you will receive a report when you complete the exam that lists your score and proficiency in the topic domains.
To maintain the certification, you must complete 60 professional development units (PDUs) within three years to renew the certification. If you do not obtain and report the PDUs, this certification expires three years from the date you originally passed the exam.
If you are new to the project management field and only have a one or two years of experience, I suggest that you take the Project+ exam first. This exam will be a great start in your career path and will help you to gauge your knowledge of project management.
If you have several years experience in the project management field but do not have enough formal project management education to take the PMP exam, you should take the CAPM exam, which is also the next logical step after the Project+ exam.
As far as formal project management education goes, most college courses or training courses from a reputable training provider qualify. While PMI has a list of approved training providers for CEUs (the training credits required to maintain certification), the educational requirements for taking the certification exams are usually not as strict. However, you may need to provide a transcript or proof of completion. Find out the latest on education, certification requirements, and more on the PMI web site.
Once you have enough experience and formal education, take the PMP exam. This is one of the most highly respected certifications in the industry today.
While experienced project managers might choose to jump right in and take the PMP, newbies should probably start at the Project+ level.
If you are still undecided on whether project management certifications are the right way to go, consider this fact: According to salary.com, the median expected salary for a typical project manager in the United States is $107,056.
For most of us, that salary statistic may speak volumes and help to solidify our resolve to pursue the certifications.
Here’s hoping you achieve certification success in 2014!