CompTIA Security+ : visual study guide

Public Key Infrastructure (PKI)

How certificate authorities, root stores, and the chain of trust enable browsers to automatically trust millions of websites without prior contact.

HTTPS & TLS Handshake

How HTTPS encrypts your connection: certificates, key exchange, and why the padlock appears.

TLS 1.3: The Modern Handshake

How TLS 1.3 reduces connection latency to 1-RTT (vs 2-RTT in TLS 1.2) — eliminating cipher negotiation, mandating forward secrecy, and enabling 0-RTT resumption for returning clients.

🏅

TLS Certificates & PKI

How X.509 certificates work, what a Certificate Authority chain looks like, and how browsers verify a certificate is legitimate.

🏛️

TLS Certificate Chains

How the chain of trust works: Root CA → Intermediate CA → Leaf certificate, and why browsers trust it.

📜

Certificate Transparency (CT Logs)

How Certificate Transparency logs create a public, auditable record of every TLS certificate issued — and how browsers use SCTs to detect misissued certificates.

📜

HTTPS Certificate Lifecycle: Issue, Renew & Revoke

The full lifecycle of an HTTPS certificate — ACME protocol for automated issuance (Let's Encrypt), DV vs OV vs EV validation levels, OCSP stapling for revocation without privacy leaks, and what happens when a certificate expires or is revoked.

🤝

Mutual TLS (mTLS)

How mTLS extends TLS to authenticate both client and server with certificates — used in zero-trust networks, service meshes, and API security.

📌

TLS Certificate Pinning

How mobile apps and security-critical clients use certificate pinning to prevent MITM attacks even when a CA is compromised — including HPKP, TOFU, and how corporate proxies break pinning.

🔏

DNSSEC — Signed DNS

How DNSSEC uses cryptographic signatures to prevent cache poisoning and authenticate DNS responses from root to leaf.

Identity and access management

MFA — Time-Based One-Time Passwords

How TOTP generates 6-digit codes from a shared secret and current time, making stolen passwords alone useless.

FIDO2 & Passkeys: Passwordless Authentication

How FIDO2/WebAuthn works — credential creation with a hardware key or biometric, the challenge-response authentication flow, resident credentials (passkeys) stored on the authenticator, and why FIDO2 is phishing-proof.

🐕

Kerberos Authentication

How Kerberos uses a trusted third-party KDC to authenticate users to services using tickets, without sending passwords over the network.

🎫

SAML 2.0 — Single Sign-On

How SAML federates identity across organizations: SP-initiated login, IdP assertions, and how SSO eliminates per-app passwords.

🔑

OAuth 2.0 Authorization

How OAuth 2.0 lets users grant third-party apps access to their data without sharing passwords.

🔑

OAuth 2.0 PKCE Flow

How PKCE (Proof Key for Code Exchange) makes OAuth 2.0 safe for public clients like mobile apps and SPAs — preventing authorization code interception attacks without a client secret.

🪪

OpenID Connect: Identity on Top of OAuth 2.0

How OIDC adds authentication to OAuth 2.0 — the discovery endpoint, authorization code flow with ID token, userinfo endpoint, ID token JWT structure (sub/iss/aud/exp/nonce), and OIDC vs OAuth2 scope differences.

🎫

Medium

JWT — JSON Web Tokens

How JSON Web Tokens encode claims, get signed by the server, and verify identity without database lookups.

🏢

LDAP & Active Directory: Enterprise Identity

How Active Directory uses LDAP for directory queries, Kerberos for authentication, and LDAPS/SASL for security — the flow from user login to domain controller lookup to group membership resolution.

🎫

RADIUS & TACACS+: Network Authentication

How RADIUS and TACACS+ centralize authentication for network devices and VPN users — AAA (Authentication, Authorization, Accounting), and why enterprises use RADIUS for WiFi/VPN and TACACS+ for device management.

🪪

802.1X / EAP — Port-Based Auth

How enterprise Wi-Fi and wired networks authenticate every device before granting network access using RADIUS and EAP.

Network attacks

☠️

Simple

ARP Spoofing Attack

How an attacker poisons ARP caches to intercept all traffic on a local network (Man-in-the-Middle).

🕵️

Man-in-the-Middle Attack

How an attacker intercepts and reads traffic between two parties using ARP spoofing, and how TLS prevents it.

🪤

SSL Stripping Attack

How attackers downgrade HTTPS connections to plaintext HTTP, and how HSTS and preloading prevent it.

🍪

Session Hijacking

How attackers steal session cookies to impersonate logged-in users, and how HttpOnly, Secure, and SameSite flags protect them.

🕳️

DNS Tunneling

How attackers exfiltrate data and establish covert C2 channels by encoding payloads in DNS queries that firewalls rarely block.

🔄

DNS Rebinding Attack

How attackers bypass the Same-Origin Policy by manipulating DNS TTLs — the browser thinks it's talking to the attacker's site but is actually sending requests to internal network services.

☠️

DNS Attack Patterns: Cache Poisoning & Amplification

How DNS is exploited — Kaminsky cache poisoning via predictable transaction IDs, DNS amplification for DDoS using ANY queries, DNS over HTTPS/TLS to prevent snooping, and DNSSEC validation to prevent poisoning.

☠️

BGP Hijacking Attack

How rogue ASes announce more-specific prefixes to intercept or black-hole internet traffic, and real-world incidents like the 2008 Pakistan Telecom attack.

💥

DDoS Attacks & Defense

How Distributed Denial of Service attacks work: SYN floods, amplification attacks, botnets, and how scrubbing centers defend against them.

🌊

TCP SYN Flood & SYN Cookies

How a SYN flood attack exhausts server connection tables, and how SYN cookies allow servers to handle millions of SYNs without allocating memory.

🔨

ICMP Flood & Smurf Attack

How ICMP flood and Smurf attacks overwhelm targets using ping packets — the amplification mechanics of Smurf using broadcast addresses, and why RFC 2644 fixed it.

👿

Evil Twin AP Attack

How attackers create a rogue access point with the same SSID to intercept traffic, and why HTTPS and VPNs protect against it.

⚡

WiFi Deauth Attack

How attackers send forged 802.11 deauthentication frames to disconnect clients, capture WPA handshakes, and how Management Frame Protection (PMF) stops it.

📌

WPS PIN Attack

How the WiFi Protected Setup PIN flaw allows cracking an 8-digit PIN in ~11,000 attempts instead of 100 million, and why WPS should be disabled.

🔍

Port Scanning

How attackers and security teams discover open services using TCP SYN scanning, and how firewalls respond.

🔭

Passive Reconnaissance: OSINT Network Mapping

How attackers and penetration testers gather network intelligence without sending a single packet — DNS enumeration, BGP route data, certificate transparency, WHOIS, and Shodan searches.

Application attacks and defences

💉

SQL Injection via HTTP

How SQL injection attacks travel over HTTP from attacker to web server to database, what a WAF sees in the request, and how prepared statements stop it.

🕷️

XSS & CSRF: Browser-Based Network Attacks

How XSS and CSRF exploit the browser's trust model — stored XSS exfiltrating cookies via network requests, CSRF exploiting implicit credential sending, SameSite cookies as defense, and the Same-Origin Policy that contains the damage.

🎭

SSRF: Server-Side Request Forgery

How SSRF attacks exploit server-side HTTP fetching — forcing servers to make requests to internal services, cloud metadata endpoints, and internal APIs that are normally unreachable from the internet.

🔓

API Security: OWASP API Top 10

The most critical API security vulnerabilities — broken object-level authorization (BOLA/IDOR), mass assignment, lack of resource limiting, security misconfiguration, and how API gateways and proper design prevent them.

HTTP Security Headers

How response headers like HSTS, CSP, X-Frame-Options, and CORS headers harden web apps against clickjacking, XSS, and protocol downgrade attacks.

XSS, CSRF & Browser Security Model

How browsers enforce the Same-Origin Policy, how XSS bypasses it, how CSRF exploits cross-site state changes, and how modern defenses (CSP, SameSite, CORS) work together.

🌐

Medium

CORS — Cross-Origin Requests

Why browsers block cross-origin requests by default, how CORS preflight works, and how servers grant access.

Secure network architecture

Zero Trust Networking

How Zero Trust replaces the perimeter model: identity-aware proxy, mTLS, policy engine, and why 'never trust, always verify' prevents lateral movement.

Zero Trust Architecture: Never Trust, Always Verify

How Zero Trust replaces VPN perimeter security — identity-based access (not network location), continuous verification for every request, micro-segmentation preventing lateral movement, and device posture checks before granting access.

ZTNA — Zero Trust Network Access

How ZTNA replaces VPN: verify every device and identity on every request with posture checks, MFA, and per-app micro-segmentation.

🧱

Network Segmentation

How VLANs, DMZs, and firewall zones limit blast radius: why a compromised printer can't reach your database server.

Firewall Rules

How firewalls inspect traffic and block or allow connections based on rules.

Network ACLs vs Security Groups

How AWS Network ACLs (stateless) and Security Groups (stateful) differ, when to use each, and how they interact to create layered cloud network security.

VPN Tunnel

How a VPN encrypts your traffic and hides your real IP address from websites and ISPs.

WireGuard: Modern VPN Protocol

How WireGuard establishes encrypted tunnels with a minimal codebase — Curve25519 key exchange, ChaCha20 encryption, no handshake state machine, and why it outperforms OpenVPN and IPsec.

MACsec: Layer 2 Encryption

How MACsec (IEEE 802.1AE) encrypts Ethernet frames at the MAC layer — providing hop-by-hop authentication and encryption between switches, routers, and servers on the same LAN segment.

Network Access Control: 802.1X & NAC Policies

How enterprise networks authenticate endpoints before granting access — 802.1X EAP authentication via RADIUS, posture assessment (is the device compliant?), VLAN assignment based on identity and posture, quarantine VLANs for non-compliant devices, and MAC Authentication Bypass (MAB) for non-802.1X devices.

Kubernetes NetworkPolicy: Pod-Level Firewall

How Kubernetes NetworkPolicy objects define ingress and egress rules between pods, how CNI plugins (Cilium, Calico) enforce them at the kernel level, the default-deny posture, namespace isolation, and why NetworkPolicy alone isn't enough for zero-trust clusters.

Service Mesh mTLS: Automatic Mutual TLS Between Services

How service meshes like Istio and Linkerd implement automatic mTLS — sidecar proxies intercepting all traffic, SPIFFE/SVID workload identity certificates, mTLS authentication without application changes, and the performance overhead of the data plane.

Security operations and email security

🚨

Network IDS/IPS: Snort, Suricata & Detection

How network intrusion detection systems identify attacks — signature-based vs anomaly detection, Snort/Suricata rule syntax, inline IPS blocking vs passive IDS, and evading detection with fragmentation.

🔬

Network Forensics with Wireshark

How to use Wireshark capture filters, display filters, and protocol dissectors to investigate network incidents — reconstructing TCP streams, identifying anomalies, and following attack paths.

🔬

Packet Capture & Analysis

How tcpdump and Wireshark capture network traffic, what promiscuous mode does, and how to read packet headers for debugging.

📊

NetFlow Traffic Analysis

How Cisco NetFlow (and IPFIX) samples network traffic into flow records, enabling bandwidth analysis, anomaly detection, and capacity planning.

🔍

DHCP Snooping & Dynamic ARP Inspection

How DHCP snooping prevents rogue DHCP servers from hijacking client IP assignments, and how Dynamic ARP Inspection (DAI) uses the snooping table to block ARP spoofing attacks.

ARP Spoofing Defense

How Dynamic ARP Inspection (DAI) and static ARP entries protect against ARP poisoning attacks that enable man-in-the-middle on LAN.

📧

Email Authentication: SPF, DKIM & DMARC Together

How SPF, DKIM, and DMARC work as a layered system to prove email legitimacy — what each verifies, what each misses, and how DMARC's alignment policy ties them together to stop phishing.

📧

SPF & DKIM Email Authentication

How SPF and DKIM prevent email spoofing by publishing authorized senders in DNS and signing messages cryptographically.

📧

DMARC — Email Authentication

How DMARC combines SPF and DKIM to stop email spoofing and domain impersonation, and how policies escalate from monitor to reject.

🔏