Objective 4.1: Given a scenario, apply common security techniques to computing resources
Cert: CompTIA Security+ (SY0-701) Domain: 4.0 Security Operations Weight: ~28% of SY0-701 (Domain 4 total) Depth: Apply. Be able to read a scenario, name the correct technique, and tie it to a platform. Cover secure baselines, the ten hardening targets, wireless installations, mobile solutions, wireless security, application security, sandboxing, and monitoring.
What this objective tests
You should be able to read a security scenario, pick the strongest primary technique, and name the platform it applies to. The objective sprawls because Domain 4 is the biggest domain on the exam (28%), and 4.1 is the foundation lesson the rest of Domain 4 builds on. The exam questions on this objective lean toward "Given a scenario, which technique applies." Memorize the families and the one or two moves that go with each platform.
Key facts
Secure baselines
A baseline is the documented standard for how a system should be configured. Three phases:
- Establish. Pick the source and tailor it. Most enterprises use CIS Benchmarks. Federal contractors use DISA STIGs. Vendors publish hardening guides as a starting point.
- Deploy. Push the baseline with the same tooling you use for software. Group Policy and Intune on Windows, Ansible or Puppet on Linux, AWS Config and Azure Policy in cloud, Jamf on macOS.
- Maintain. Watch for drift, document exceptions, re-baseline when the OS major version changes.
Reference standards to know:
| Standard | What it covers |
|---|---|
| NIST SP 800-123 | Guide to General Server Security |
| NIST SP 800-124 | Guidelines for Managing the Security of Mobile Devices |
| NIST SP 800-153 | Guidelines for Securing WLANs |
| NIST SP 800-82 | Guide to ICS Security |
| NIST SP 800-213 | IoT Device Cybersecurity Capability Core Baseline |
| NIST SP 800-128 | Guide for Security-Focused Configuration Management |
| CIS Benchmarks | Industry-published, peer-reviewed configuration standards |
| DISA STIGs | Department of Defense Security Technical Implementation Guides |
| OWASP ASVS | Application Security Verification Standard |
Hardening targets
The objective names ten platform families. Each gets a short list of specific moves.
| Platform | Hardening moves |
|---|---|
| Mobile devices | Full-disk encryption, screen lock policy, MDM enrollment, app store restrictions, remote wipe configured |
| Workstations | Disk encryption (BitLocker, FileVault, LUKS), EDR installed, host-based firewall on, least privilege, USB autorun disabled, patched within SLA |
| Switches | Change default credentials, disable Telnet, enable SSH, port security or 802.1X, syslog to SIEM |
| Routers | Same as switches plus disable HTTP admin (use HTTPS), disable SNMPv1 and SNMPv2c (use SNMPv3), enable routing protocol authentication |
| Cloud infrastructure | MFA on root, scoped IAM roles, encrypt storage by default, CloudTrail or Activity Log on, CIS-aligned config scan running |
| Servers | CIS or STIG baseline applied, scheduled patching, unused services disabled, host EDR, log forwarding to SIEM |
| ICS/SCADA | Air-gap or one-way diode, no internet access, vendor jump host for maintenance, vendor-approved patches only, change managed with safety case |
| Embedded systems | Default-deny network rules, signed firmware only, no SSH unless required (key-based), watchdog timers, physical tamper detection |
| RTOS devices | Vendor-signed firmware only, never internet-facing, dedicated VLAN, monitor for unexpected reboots, treat as safety equipment |
| IoT | Change default password BEFORE first network connection, segment to dedicated VLAN, disable UPnP, monitor for command-and-control, replace if vendor will not patch |
Three common patterns across the matrix:
- Default credentials are the universal first move. Change them on every platform that ships with one.
- Segmentation is the universal second move. Whatever the device, it belongs on a VLAN that matches its risk class.
- Logging is the universal third move. No telemetry, no monitoring, no detection.
Wireless installations
Before you mount an access point you survey the building. The two artifacts are the site survey (the walkthrough) and the heat map (the visual deliverable).
- Predictive survey. Software model from blueprints. Use Ekahau, NetSpot, Hamina, or the AP vendor's tool. Sets the budget and AP count.
- Passive survey. Real walkthrough after install. A tech walks every room with a survey app running on a laptop or phone. Records actual signal at chair height.
- Heat map. Floor plan with color overlays. Red is hot signal. Blue is dead zone. Green is the sweet spot.
Common findings:
- Dead zone. A room or zone with signal below the threshold. Fix: add an AP, move an AP, change the AP's antenna.
- Channel overlap. Two or more APs sharing a channel. The most common 2.4 GHz finding. Use channels 1, 6, 11 only on 2.4 GHz.
- Interference. Microwaves on 2.4 GHz, Bluetooth medical equipment, neighboring SSIDs from adjacent businesses. Site survey is the only way to find these.
On the exam, the phrases "dead zone" and "channel overlap" both point to a site survey as the right answer.
Mobile solutions: deployment models
Three models, each solving a different business problem.
| Model | Who owns the device | Strength | Weakness |
|---|---|---|---|
| BYOD (Bring Your Own Device) | User | No hardware cost to the company | Legal complexity, personal data on the same device, wipe risk |
| COPE (Corporate-Owned, Personally Enabled) | Company | Most popular for medium business. Container separates work and personal | Highest device cost per user |
| CYOD (Choose Your Own Device) | Company | Uniformity for support, flexibility for user choice | Less personal flexibility than COPE |
Decision tool: BYOD when the budget is zero. COPE when flexibility matters. CYOD when uniformity matters most.
Mobile solutions: MDM and connection methods
MDM (Mobile Device Management) is the central console that enforces policy on the phone. Every MDM enforces three minimums regardless of deployment model:
- Passcode policy. Length, complexity, lockout threshold.
- Device or container encryption. Whole-device for COPE and CYOD, container for BYOD.
- Remote wipe. Tested at enrollment, not assumed.
MDM platforms to know: Microsoft Intune, Jamf (Apple-focused), VMware Workspace ONE, Google Endpoint Management, Ivanti EPMM (formerly MobileIron).
Connection methods and their default risk:
| Method | Default protection | Hardening move |
|---|---|---|
| Cellular | Carrier-level encryption built in | Lowest worry of the three |
| Wi-Fi | Depends on the SSID. Public Wi-Fi is hostile by default | WPA3 enterprise, or VPN required |
| Bluetooth | Discoverable by default on many devices | Off when not in use, especially healthcare and retail |
| NFC, USB | Allowed by default on most phones | MDM policy: block USB file transfer, restrict NFC sharing |
Wireless security settings
WPA3 is the standard since 2018. Mandatory on Wi-Fi 6 and later. Two modes:
- WPA3-Personal. Uses SAE (Simultaneous Authentication of Equals). Fixes the offline dictionary attack that broke WPA2-Personal. Per-connection forward secrecy.
- WPA3-Enterprise. Uses 802.1X over EAP. Every user signs in with their own identity. AP forwards the EAP frames to a RADIUS server.
WPA2 is still common. Plan the WPA3 migration; do not assume it just works. Legacy IoT clients that only speak WPA2 are the most common migration blocker. Mixed-mode (WPA2/WPA3 transition) is allowed during migration, never as the long-term posture.
WEP and WPA1 are broken. Calling them out as wrong answers on the exam is fair game.
AAA and RADIUS.
- AAA stands for Authentication, Authorization, Accounting. The framework for every enterprise access decision.
- RADIUS (Remote Authentication Dial-In User Service) is the most common AAA server protocol. Used for Wi-Fi auth, VPN auth, switch port auth (802.1X), and admin login to network gear.
- TACACS+ is the Cisco alternative for admin auth on network gear. Encrypts the whole packet (RADIUS encrypts only the password).
Cryptographic protocols stack on top of wireless when needed:
- TLS (Transport Layer Security) for web sessions and email.
- IPsec for site-to-site and remote-access VPN.
- SSH for admin shell to network gear and servers.
Authentication protocols for 802.1X:
- EAP-TLS (cert-based, gold standard). Both client and server present certificates.
- EAP-PEAP (cert plus password). Server cert protects the password tunnel.
- EAP-TTLS (similar to PEAP). Less common in current shops.
Application security techniques
Four techniques. Each one shuts a specific door.
- Input validation. Reject any data that does not match the expected format. The first line of defense against injection attacks. A login email field should reject SQL syntax. A phone field should reject letters. Validation is allow-list: define what is allowed, reject everything else.
- Secure cookies. Three flags. Secure (only sent over HTTPS). HttpOnly (not visible to JavaScript, prevents XSS-driven theft). SameSite (not sent to other origins, prevents CSRF). Set all three on session cookies.
- Static code analysis (SAST). A scanner that reads source code before it runs and flags known dangerous patterns. Finds unparameterized SQL, hardcoded credentials, weak crypto, deserialization risks. SAST tools: SonarQube, Semgrep, Checkmarx, Veracode, GitHub CodeQL.
- Code signing. A digital signature on the compiled binary that proves the publisher and that the binary has not been tampered with since signing. The OS verifies the signature on install. Examples: Windows Authenticode, Apple notarization (now mandatory on macOS), Android APK signing, Linux package signatures (RPM, DEB).
Reference: OWASP ASVS (Application Security Verification Standard) is the working checklist most modern shops use to anchor app security requirements.
Sandboxing
Containment by design. Run the suspect code in an isolated environment that has no access to the rest of the host.
- Browser sandbox. Every tab in Chrome, Edge, Firefox, and Safari runs in its own OS process with no filesystem access to the host.
- Mobile sandbox. Every iOS and Android app runs in its own sandbox by OS design.
- Malware analysis sandbox. A VM where SOC analysts and IR teams detonate suspicious files and observe behavior. Tools: Cuckoo Sandbox, Any.Run, Joe Sandbox, Hybrid Analysis.
- Container as sandbox. Docker and Kubernetes give a weaker but useful isolation layer for application workloads.
Sandbox limit: anti-sandbox malware exists. Some samples detect they are in a VM (CPU features, mouse activity, registry hints) and refuse to run. Sandboxing is a layer, not the only layer. Pair with EDR and SIEM monitoring.
Monitoring
Whatever you harden, you also watch. Every technique on this objective produces telemetry that should flow into a SIEM.
| Source | What it tells you |
|---|---|
| EDR | Process injection, unsigned executables, lateral movement attempts |
| MDM | Device compliance status, jailbreak detection, missing patches |
| RADIUS logs | Wi-Fi and VPN authentication outcomes |
| Switch and router syslog | Configuration changes, port state changes, ACL hits |
| Cloud audit logs | IAM changes, root account use, security group edits |
| Web Application Firewall | SQL injection blocks, XSS attempts, rate-limit hits |
| Code-signing failures | Unsigned executable launch, signature verification failure |
SIEMs to know: Splunk, Microsoft Sentinel, Elastic SIEM, Sumo Logic, Chronicle, Wazuh (open source). NIST CSF function: Detect.
Quick mapping: scenario to technique
The exam loves scenario stems. Use this table as a memory anchor.
| Scenario stem | Primary technique | Platform |
|---|---|---|
| Vendor router still has Telnet open and a default password | Hardening (disable Telnet, change cred) | Switch/router |
| Hospital tablets need to be wiped if lost | MDM with remote wipe | Mobile (COPE) |
| Web form let a SQL injection through | Input validation | Application |
| Three classrooms dropping Wi-Fi | Site survey + heat map | Wireless install |
| Public web app session hijack reports | Secure cookies (Secure, HttpOnly, SameSite) | Application |
| IoT camera batch shipped with "admin" password | Change default credentials, segment VLAN | IoT |
| Patient infusion pump fleet running old firmware | Vendor-signed firmware, do not expose to internet | RTOS |
| Cloud S3 bucket is public | Cloud baseline scan, fix at config layer | Cloud infrastructure |
| Unsigned executable launched from temp | Code signing failure (alert and investigate) | Application |
| Analyst needs to detonate a suspicious file | Sandbox VM | Sandboxing |
Common gotchas
- WPA3 is not a rebrand of WPA2. SAE in WPA3-Personal fixes a real attack. EAP in WPA3-Enterprise requires a RADIUS server. Calling WPA3 "just marketing" is wrong.
- BYOD vs COPE. BYOD = user owns the phone. COPE = company owns the phone, user is allowed personal apps. Do not flip them.
- MDM minimums are three. Passcode, encryption, remote wipe. App push and store restriction are common features but not the universal minimum.
- Input validation vs sanitization. Validation rejects. Sanitization cleans. Use both. Validation first, sanitization as defense-in-depth.
- Secure cookie flags. Three: Secure, HttpOnly, SameSite. Drop one and the exam will ask about the missing flag.
- Sandboxing is a layer. Anti-sandbox malware detects VMs and refuses to run. Treat sandbox as defense-in-depth, not the only layer.
- ICS/SCADA patching has prerequisites. Safety case first, vendor-approved patch second, change management always. "Just patch it" is wrong on this gear.
- IoT default passwords are the Mirai lesson. Change them BEFORE the device connects to the network. The 2016 Mirai botnet built on devices that still had factory passwords.
- Site survey vs heat map. Site survey is the activity. Heat map is the deliverable. The exam will ask which one solves a "dead zone" question (answer: site survey).
- CIS Benchmarks are tailored, not applied verbatim. Every real shop drops settings that break business apps. Tailoring is part of the establish phase.
Real-world context
A SOC Tier 1 analyst sees the consequences of every technique on this objective every day. Splunk alert on multiple WPA2 auth failures from one MAC is a rogue or misconfigured client. Intune compliance alert is MDM enforcement triggering. EDR alert on an unsigned executable from temp is code signing failing. SIEM rule firing on SSH login to a switch from a non-admin subnet is a port hardening exception. AWS Config alert on a public S3 bucket is baseline drift, fixed at the config layer. WAF blocking a SQL injection is input validation working at the perimeter, while the app log shows whether the same payload also tried the back end.
A help desk technician at an MSP sees the front end of these same techniques every day. A small business calls because Wi-Fi feels weird. The answer is rarely "buy a new router." More often the answer is a quick site survey, a channel change, and an AP firmware update. A new hire onboarding ticket triggers a full hardening checklist: BitLocker, EDR, Intune enrollment, standard user account, default password change.
This objective maps directly to entry-level cybersecurity job postings. SOC Tier 1 analysts triage EDR alerts, review RADIUS auth logs, and detonate suspicious files in a sandbox. Systems administrators apply CIS or STIG baselines, author MDM policy, and harden servers. MSP technicians run Wi-Fi site surveys, harden small business networks, and provision mobile devices. Junior pentesters find the Telnet ports, default credentials, and unsigned binaries on client engagements. Students who can name the technique, match it to the platform, and explain it in plain English can speak the vocabulary of every team they walk into.
Sources
- CompTIA SY0-701 Exam Objectives, Objective 4.1.
- NIST SP 800-123, Guide to General Server Security.
- NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices.
- NIST SP 800-153, Guidelines for Securing WLANs.
- NIST SP 800-82 Rev. 3, Guide to ICS Security.
- NIST SP 800-213, IoT Device Cybersecurity Capability Core Baseline.
- NIST SP 800-128, Guide for Security-Focused Configuration Management.
- CIS Benchmarks (https://www.cisecurity.org/cis-benchmarks).
- DISA STIGs (https://public.cyber.mil/stigs/).
- OWASP Application Security Verification Standard (ASVS).
- OWASP Top 10 (https://owasp.org/Top10/).