Skip to main content
Back to Study
CompTIA Security+ · SY0-701 · Objective SP-4.5

Given a scenario, modify enterprise capabilities to enhance security

Drill flashcardsFocused quizBrowse all objectives (sidebar view)
VideosComing soon

Walkthrough video for this lesson.

Objective 4.5: Given a scenario, modify enterprise capabilities to enhance security

Cert: CompTIA Security+ (SY0-701) Domain: 4.0 Security Operations Weight: ~28% of SY0-701 (Domain 4 total) Depth: Apply. Be able to read a SOC scenario, name the right capability to modify, and explain in plain English what the configuration change looks like. Cover the full menu: firewall, IDS/IPS, web filter, OS security, secure protocols, DNS filtering, email security trio (SPF, DKIM, DMARC) plus gateway, FIM, DLP, NAC, EDR, XDR, and UBA.

What this objective tests

SP-4.5 is the longest list of named capabilities in the entire SY0-701 blueprint. You should be able to walk into any SOC, read a ticket, and name which enterprise capability needs to be modified. You need to know what each capability does in plain English, what its main tuning knobs look like, and how it fits in a layered defense. Every "Given a scenario" question in Domain 4 expects you to pick a capability modification as the answer, not a vendor name and not a brand-new product.

Key facts

Firewall

The firewall is still the most exam-tested enterprise capability. SY0-701 wants you to recognize four sub-topics.

  • Rules. A firewall rule has five fields: source, destination, port, protocol, action. Rules are evaluated top to bottom and the first match wins.
  • Access lists. An ACL (Access Control List) is the underlying data structure of a firewall rule set. Network ACLs filter at the router or switch, host ACLs filter on the operating system itself.
  • Ports and protocols. Each rule pins one or more ports and protocols. Common allow rules: 443/TCP for HTTPS, 22/TCP for SSH, 53/UDP for DNS, 123/UDP for NTP. Common deny rules: 23/TCP for Telnet, 21/TCP for plaintext FTP, 445/TCP for SMB from the internet.
  • Screened subnets (DMZ). A DMZ holds servers that need to be reached from the internet (mail relay, public web app, VPN concentrator) so a compromise on those servers does not directly land an attacker in the internal network.

The implicit deny is the unwritten last rule on every modern firewall. If no rule explicitly allows the traffic, the firewall blocks it. This is the exam answer to "Why was the traffic dropped" when no rule referenced it.

The authoritative reference is NIST SP 800-41 Guidelines on Firewalls and Firewall Policy. You do not memorize the document. You recognize the name.

IDS and IPS

The IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) share the same engine. The difference is placement and action.

  • IDS: sits on a tap or span port. Sees a copy of the traffic. Detects and alerts only. Cannot block.
  • IPS: sits inline. Sees the traffic directly. Can detect and block the same traffic.

SY0-701 names two tuning sub-topics inside IDS/IPS:

  • Signatures. Fingerprints that uniquely identify a known exploit, known malware command-and-control pattern, or known attack tool. Strong against known threats. Blind to threats with no signature yet.
  • Trends. Anomalies compared to a baseline. A sudden spike in failed logins. An unusual outbound volume from a database server. A new process spawning across many hosts at once. Catches insider abuse and novel threats that signatures miss.

Modern enterprise IDPS combines both. The authoritative reference is NIST SP 800-94 Guide to Intrusion Detection and Prevention Systems.

Web filter

A web filter blocks or allows web requests before the user reaches the site. SY0-701 names five sub-topics.

  • Agent-based. Software on the laptop itself enforces the filter. Works on home Wi-Fi, hotel Wi-Fi, anywhere.
  • Centralized proxy. A server every workstation routes through on the way to the internet. Works only on the corporate network unless paired with VPN-back or SASE.
  • URL scanning. The filter inspects each URL before fetch. Real-time URL reputation and category lookup.
  • Content categorization. The filter blocks by category: gambling, adult, social media, anonymizer, cryptocurrency mining, newly registered domains.
  • Block rules and reputation. Explicit allow or deny rules per URL or domain, plus a vendor reputation feed that scores risk in real time.

The two most common categories to tune after an incident: newly seen domains and uncategorized. Both are heavily abused by attackers and most organizations leave them allow-by-default.

OS security

Operating system policy is where enterprise capability modification meets the endpoint. SY0-701 names two technologies by name.

  • Group Policy. The Windows mechanism that pushes configuration from Active Directory to every domain-joined machine. GPOs (Group Policy Objects) cover password policy, audit policy, software restriction (AppLocker, Windows Defender Application Control), firewall settings, BitLocker, USB control, screen lock, SmartScreen. End users cannot turn off GPO settings.
  • SELinux. Security-Enhanced Linux. Mandatory access control built into modern Linux kernels (Red Hat, Rocky, Oracle Linux, Fedora, Android). Confines what each process can touch even when the process runs as root. Three modes: enforcing (block violations), permissive (log only), disabled.

The Sec+ exam wants you to recognize that GPO and SELinux are the mandatory enforcement layers on Windows and Linux respectively. AppArmor is the Ubuntu equivalent of SELinux but the exam names SELinux specifically.

Implementation of secure protocols

This is where Net+ and Sec+ overlap. SY0-701 names three sub-topics.

  • Protocol selection. Pick the secure variant. TLS for web (not plaintext HTTP). SSH for remote shell (not Telnet). SFTP or FTPS for file transfer (not plaintext FTP). IPsec or WireGuard for site-to-site VPN. STARTTLS or implicit TLS for SMTP submission.
  • Port selection. Pin the right port for the secure protocol. 443/TCP for HTTPS. 22/TCP for SSH and SFTP. 500/UDP and 4500/UDP for IPsec. 587/TCP for SMTP submission with STARTTLS. 465/TCP for SMTP with implicit TLS. 853/TCP for DNS over TLS.
  • Transport method. TCP for sessions that need reliability and ordering (HTTPS, SSH, SFTP). UDP for sessions that need low latency and tolerate loss (DNS, NTP, VPN data plane). TLS rides on TCP. DTLS rides on UDP.

The exam loves the secure replacement pair: Telnet to SSH, HTTP to HTTPS, FTP to SFTP, SNMPv1/v2 to SNMPv3, LDAP to LDAPS.

DNS filtering

DNS filtering refuses to resolve known-bad domains at the resolver layer. The user typing a phishing URL never gets back an IP. This is the cheapest exam-tested control and the highest-leverage one most schools and small businesses do not turn on.

Common products: Quad9 (free), Cisco Umbrella (paid), Cloudflare for Teams, OpenDNS, Akamai SIA, NextDNS. Most SASE platforms include DNS filtering. Tune categories like malware, phishing, command-and-control, cryptocurrency mining, and newly seen domains.

Email security

Email is the highest-volume attack vector in every enterprise. SY0-701 names four sub-topics that together stop most phishing at the perimeter.

  • SPF (Sender Policy Framework). DNS TXT record listing the IPs allowed to send mail for the domain. Recipient compares the sending IP to the SPF record. If sender is not on the list, SPF fails. SPF only validates the envelope sender, not the visible From header.
  • DKIM (DomainKeys Identified Mail). Cryptographic signature added to every outgoing message. Signed with a private key on the sending server, verified with a public key in DNS. Proves the message has not been altered in transit and was sent by the domain owner.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance). DNS policy that ties SPF + DKIM together. Tells receivers what to do on failure (p=none, p=quarantine, p=reject) and asks for a feedback report (rua= and ruf= addresses). Standard rollout: p=none for 4 to 12 weeks while you read reports, then p=quarantine for 2 to 4 weeks, then p=reject.
  • Gateway. A secure email gateway sits inline (in front of or replacing the mailbox server) and scans inbound for phishing, malware, lookalike domains, malicious links, and malicious attachments. Scans outbound for data leaks. Common products: Microsoft Defender for Office 365, Proofpoint, Mimecast, Cisco Secure Email.

The authoritative reference is NIST SP 800-177 Trustworthy Email. The US federal government mandates DMARC at p=reject for all executive branch domains via Binding Operational Directive 18-01.

File Integrity Monitoring (FIM)

FIM watches critical files and alerts when they change unexpectedly. Watch lists usually include system binaries, web roots, configuration files, scheduled tasks, registry hives. The classic alert: a new PHP file appears in the web root at 2 AM that nobody on the team wrote. FIM is required by PCI DSS for cardholder data environments and by CIS Controls v8 control 3.13 (data protection: deploy a data loss prevention solution).

Data Loss Prevention (DLP)

DLP inspects data leaving the organization and blocks or alerts when sensitive content moves where it should not. Three modes:

  • Data in motion. Email, web upload, instant message, FTP transfer.
  • Data at rest. Scans file shares, SharePoint, OneDrive, S3 buckets for tagged content that lives somewhere it should not.
  • Data in use. Endpoint agent that blocks copy/paste of tagged content to USB, screenshots of tagged windows, or printing of tagged docs.

Tune DLP with classification labels (Confidential, Internal, Public), pattern matching (credit card numbers, SSNs, PHI), and fingerprinting (specific document hashes).

Network Access Control (NAC)

NAC checks each device joining the network before letting it on. The standard NAC workflow:

  1. Device plugs into a switch port or associates with the Wi-Fi.
  2. Switch port stays closed. NAC challenges the device.
  3. Device authenticates (usually via 802.1X with EAP-TLS, PEAP, or EAP-TTLS).
  4. NAC checks posture: patches up to date, EDR running, disk encrypted, host firewall enabled.
  5. Compliant device gets the production VLAN. Non-compliant device gets a remediation VLAN with internet only. Unknown device gets a guest VLAN or is blocked.

NAC is the practical Zero Trust enforcement layer on a wired and wireless network. Common products: Cisco ISE, Aruba ClearPass, Forescout, FortiNAC.

EDR, XDR, and UBA

The detection stack. These are the highest-rate question targets in Domain 4.

  • EDR (Endpoint Detection and Response). Agent on every host. Watches behavior (not just signatures). Blocks known bad activity. Provides live investigation for SOC analysts. Modern EDR replaces signature-only antivirus. Examples: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Sophos Intercept X.
  • XDR (Extended Detection and Response). EDR plus integrated signals from email, identity, network, and cloud. One console correlates across the whole stack and shows a single incident timeline instead of separate alerts.
  • UBA (User Behavior Analytics). Learns each user's normal pattern (logon times, geographic locations, data access volume, applications used). Alerts when behavior drifts. The most common insider-threat detector. The classic UBA alert: an account suddenly downloads 50 GB at 2 AM from a new country.

The authoritative references: NIST SP 800-83 Guide to Malware Incident Prevention and Handling for the EDR side and MITRE ATT&CK for the technique-mapping that XDR and UBA rules ride on. CIS Controls v8 names all three (controls 8, 10, and 13).

Common gotchas

  • Confusing IDS with IPS. Same engine. Placement (and the ability to block) is the difference.
  • Treating EDR as antivirus. EDR is a behavioral and investigation tool. Antivirus is a signature scanner. They are not the same.
  • Skipping the email trio rollout. Sitting at DMARC p=none forever means SPF and DKIM are visible to attackers but not enforced. Most schools and small businesses sit at p=none for years.
  • Forgetting the implicit deny on a firewall. If no rule allowed the traffic, the firewall dropped it. That is always a possible answer.
  • Picking a vendor name as the answer. SY0-701 names capabilities, not products.
  • Assuming the IPS auto-blocks at line rate. IPS can fail closed and drop legitimate traffic. Tuning matters.
  • Confusing SPF, DKIM, and DMARC roles. SPF authorizes sending IPs. DKIM signs the message. DMARC ties them together and tells receivers what to do on failure.
  • Treating NAC as one-time onboarding. NAC re-evaluates posture every session. A compliant host that drifts out of compliance gets moved to the remediation VLAN.

Real-world context

Every capability on this objective shows up in lab practice and in production tickets. A junior SOC analyst or sysadmin who wants the muscle memory can stand the whole stack up in a home lab. Write five firewall rules in pfSense or OPNsense: allow web, block Telnet, allow DNS, allow NTP, default deny. Test from a client VM. Enable Group Policy on a Windows lab domain: enforce 14-character passwords, audit logon events, require BitLocker on the C: drive. Set SELinux to enforcing on a Red Hat or Rocky Linux VM, try to do something it blocks, then read the audit log. Set up SPF, DKIM, and DMARC for a personal domain. Start at p=none, read the rua report, move to p=quarantine, then p=reject. Install a free EDR (Microsoft Defender for Endpoint on a Windows 11 lab VM, or Sophos Intercept X home edition) and trigger a benign behavior alert. Set up Quad9 or Cloudflare for Families DNS on a home router and confirm the resolver refuses a known-bad demo domain.

In production, the same capabilities run together in layers. A SOC Tier 1 analyst opens a phishing ticket and the response touches the email gateway (block sender, purge from inboxes), the DNS filter (block the C2 domain), the EDR (isolate the host if the user clicked), and the IdP (reset credentials if the user typed them). A systems administrator pushes a Group Policy change for a new audit requirement and the change shows up in the SIEM the same hour. A network engineer adds a firewall rule for a new SaaS app, and the WAF rule that filters its API traffic gets reviewed in the same change ticket. Capability modification is the daily vocabulary of enterprise security work.

Sources

  • NIST SP 800-41 Rev. 1 Guidelines on Firewalls and Firewall Policy
  • NIST SP 800-94 Rev. 1 (draft) Guide to Intrusion Detection and Prevention Systems
  • NIST SP 800-83 Rev. 1 Guide to Malware Incident Prevention and Handling
  • NIST SP 800-177 Rev. 1 Trustworthy Email
  • MITRE ATT&CK Enterprise Matrix
  • CIS Controls v8
  • CISA Binding Operational Directive 18-01 (DMARC mandate for federal executive branch)
  • CompTIA Security+ SY0-701 Exam Objectives 7.0