CompTIA Security+ (2008 Edition) Certification Examination Objectives - Introduction - Systems Security - Network Infrastructure - Access Control

Sep 20, 2026

Vendor-neutral CompTIA Security+ (2008 Edition) Certification Examination Objectives define the foundation-level security skills and knowledge validated through an industry Job Task Analysis and a global Q4 2007 survey. The objectives describe an exam for IT security professionals with at least two years of security-focused network administration experience and everyday information security exposure. Domains are quantified by examination weight, covering systems security, network infrastructure, access control, assessments & audits, cryptography, and organizational security, with detailed example tasks and technologies per objective.

LanguageEnglish

CategoryExam

FormatPDF

Pages11

Reading Time28 min

AccessFree to download

Introduction

Exam Purpose and Target Candidate

Domain Areas and Weightings

1.0 Systems Security

1.1 Systems Security Threats

1.2 Hardware and Peripheral Risks

1.3 OS Hardening Practices

1.4 Application Security Procedures

1.5 Security Applications

1.6 Virtualization Technology

2.0 Network Infrastructure

2.1 Ports, Protocols, Threats and Mitigation

2.2 Network Design Elements and Components

2.3 Network Security Tools

2.4 Applying Network Tools

2.5 Network Device Vulnerabilities and Mitigations

2.6 Transmission Media Vulnerabilities

2.7 Wireless Networking Vulnerabilities and Mitigations

3.0 Access Control

3.1 Access Control Best Practices

3.2 Access Control Models

3.3 Security Groups, Roles, Rights and Privileges

3.4 File and Print Resource Controls

3.5 Logical Access Control Methods

CompTIA Security+ (2008 Edition) Certification Examination Objectives INTRODUCTION The CompTIA Security+ (2008 Edition) Certification is a vendor neutral credential. The Security+ exam isan internationally recognized validation of foundation-level security skills and knowledge, and is used by organizations and security professionals around the globe. The skills and knowledge measured by this examination are derived from an industry-wide Job Task Analysis (JTA) and were validated through a global survey in Q4, 2007. The results of this survey were used to validate the content of the domains and objectives and the overall domain weightings, ensuring the relative importance of the content. The CompTIA Security+ (2008 Edition) Certification is aimed at an IT security professional who has: 􀀁 A minimum of 2 years experience in network administration with a focus on security 􀀁 Day to day technical information security experience 􀀁 Broad knowledge of security concerns and implementation including the topics in the domain list below The table below lists the domain areas measured by this examination and the approximate extent to which they are represented in the examination: | Domain | % of Examination | | --- | --- | | 1.0 Systems Security | 21% | | 2.0 Network Infrastructure | 20% | | 3.0 Access Control | 17% | | 4.0 Assessments & Audits | 15% | | 5.0 Cryptography | 15% | | 6.0 Organizational Security | 12% | | Total | 100% | **Note: The lists of examples provided in bulleted format below each objective are not exhaustive lists. Other examples of technologies, processes or tasks pertaining to each objective may also be included on the exam although not listed or covered in this objectives document. (A list of acronyms used in these Objectives appears at the end of this document.) CompTIA Security+ (2008 Edition) Exam Objectives 1 of 11 Copyright 􀀁2008 by the Computing Technology Industry Association. All rights reserved. The CompTIA Security+ (2008 Edition) Exam Objectives are subject to change without notice. Objectives in italics are those objectives that contain content that has changed since the last version of the Security+ exam (2002 Objectives). 1.0 Systems Security 1.1 Differentiate among various systems security threats. • Privilege escalation • Virus • Worm • Trojan • Spyware • Spam • Adware • Rootkits • Botnets • Logic bomb 1.2 Explain the security risks pertaining to system hardware and peripherals. • BIOS • USB devices • Cell phones • Removable storage • Network attached storage 1.3 Implement OS hardening practices and procedures to achieve workstation and server security. • Hotfixes • Service packs • Patches • Patch management • Group policies • Security templates • Configuration baselines 1.4 Carry out the appropriate procedures to establish application security. • ActiveX • Java • Scripting • Browser • Buffer overflows • Cookies • SMTP open relays • Instant messaging • P2P • Input validation • Cross-site scripting (XSS) 1.5 Implement security applications. • HIDS • Personal software firewalls • Antivirus • Anti-spam CompTIA Security+ (2008 Edition) Exam Objectives 2 of 11 Copyright 􀀁2008 by the Computing Technology Industry Association. All rights reserved. The CompTIA Security+ (2008 Edition) Exam Objectives are subject to change without notice. • Popup blockers 1.6 Explain the purpose and application of virtualization technology. 2.0 Network Infrastructure 2.1 Differentiate between the different ports & protocols, their respective threatsand mitigation techniques. • Antiquated protocols • TCP/IP hijacking • Null sessions • Spoofing • Man-in-the-middle • Replay • DOS • DDOS • Domain Name Kiting • DNS poisoning • ARP poisoning 2.2 Distinguish between network design elements and components. • DMZ • VLAN • NAT • Network interconnections • NAC • Subnetting • T

FAQs

What is the purpose of the CompTIA Security+ (2008 Edition) exam objectives?

They specify the foundation-level security skills and knowledge measured by the certification, derived from a Job Task Analysis and validated through a global survey, and mapped to the exam’s domain areas and objectives.

What domains are assessed, and how are they weighted?

The exam covers Systems Security (21%), Network Infrastructure (20%), Access Control (17%), Assessments & Audits (15%), Cryptography (15%), and Organizational Security (12%), totaling 100% of the examination.

Who is the intended candidate for the Security+ (2008 Edition) certification?

It is aimed at an IT security professional with at least two years of experience in network administration focused on security, plus day-to-day technical information security experience and broad security knowledge covering the listed domains.

Sep 20, 2026

Uploaded by Evangeline