Tuesday, January 31, 2012

Kindle Version of Security+ Study Guide Now Available

The Kindle version of the Security+ Study Guide is now avaialble. This is the same content as the CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide with more than 450 Security+ practice test questions, but as a Kindle edition, portable enough to store with as many as 50,000 more of your favorite books. Many people that used the SY0-201 Study Guide told me that they purchased both the paperback version for times when they wanted to read it from a book, and the Kindle version to have it available on the go. With this in mind, I set the price for the Kindle version at $9.99.

Free Kindle Apps Available

One of the great things about the Kindle ebooks is that you don't need a Kindle reader to read the books. If you don't have a Kindle, you can download free applications from Amazon for must about any platform from here. The have applications for the following platforms:
  • iPhone
  • Windows PC
  • MAC
  • BlackBerry
  • iPad
  • Android
  • Windows Phone 7
Additionally, they recently released the Kindle Cloud Reader. The Kindle Cloud Reader lets you read ebooks from a web browser without requiring a Kindle device.

Security+ Practice Test Questions on the Kindle

If you've already been studying for the Security+ exam and don't want to get the full study guide, check out the CompTIA Security+ SY0-301 Practice Test Questions. It includes 280 realistic practice test questions and dozens of flash cards all formatted specifically for the Kindle. The goal is for this to be more like a Kindle application rather than a Kindle ebook.

The book is organized in six chapters matched to the six Security+ domains so readers can easily focus on specific domains. Each chapter includes three sections:
  1. Practice test questions without answers. Created for readers that want to go through all the questions without seeing the correct answers or explanations.
  2. Practice test questions including answers formatted for the Kindle. One Kindle screen shows the question. When you decide what you think is the correct answer, go to the next Kindle screen to see the correct answer. Each question includes an in-depth explanation so you'll know why the correct answers are correct, and why the incorrect answers are incorrect.
  3. Flash cards formatted specifically for the Kindle to help reinforce important concepts. One Kindle screen shows a flash card type question and the next Kindle screen shows the answer.
These questions are a subset of the questions in the full Security+ SY0-301 Study Guide. However, readers have told me they've enjoyed these as a supplement to the study guide to focus on reinforcing the content.

Security+ Practice Test Questions on Mobile Apps

A recent blog also talked about the availability of Security+ Practice Test Questions for Your Mobile Phone. The benefit of these is that they are presented in actual test engine formats and also include flash cards. The content is a subset of the content in the CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide but readers have told me they've enjoyed using them as a supplement on their mobile phones as an additional study source. These apps are currently available for:

Wednesday, January 25, 2012

Security+ SY0-301 Practice Test Questions

If you're preparing for the Security+ SY0-301 exam, you may be looking for some practice test questions. Recent blog articles were on authentication topics and the following two questions are samples of what you may see on the exam related to these topics. The two related blog articles are: Identification, Authentication, and Authorization, and Three Factors of Authentication.

Security+ SY0-301 Practice Test Questions

Q. What is completed when a user’s password has been verified?

A. Identification

B. Authentication

C. Authorization

D. Access verification

Answer below.


Looking for a full book on Security Practice Test Questions?
Check this out.
CompTIA Security+: Get Certified Get Ahead- SY0-301 Practice Test Questions




Q. Which of the following is an example of multifactor authentication?

A. Smart card and token

B. Smart card and PIN

C. Thumbprint and voice recognition

D. Password and PIN

Answer below.






SY0-301 Answers

Q. What is completed when a user’s password has been verified?

A. Identification

B. Authentication

C. Authorization

D. Access verification

Answer: B. A user is authenticated when the password is verified. The user claims an identity with a username. After users are authenticated, they are authorized to access resources based on their proven identity, and auditing can verify what resources a user has accessed.


Pass the first time you take the exam.
Get the full Security+ SY0-301 Study Guide.




Q. Which of the following is an example of multifactor authentication?

A. Smart card and token

B. Smart card and PIN

C. Thumbprint and voice recognition

D. Password and PIN

Answer. B. A smart card and PIN is an example of multifactor authentication since it uses methods from the something you have factor and something you know factor. A smart card and token are both in the something you have factor. Thumbprint and voice recognition are both in the something you are factor. A password and PIN are both in the something you know factor.

Sunday, January 22, 2012

Three Factors of Authentication and Multifactor Authentication

If you're studying for one of the security certifications like CISSP, SSCP, or Security+ it's important to understand the different factors of authentication, and how they can be intertwined as multifactor authentication. These are commonly known as something you know (such as a password), something you have (such as a smart card), and something you are (using biometrics. A basic understanding of these topics can help you correctly answer many different questions on authentication on any of these certification exams.
A previous post covered identification, authentication, and authorization. As a reminder, identification occurs when a user (or any subject) claims an identity. Authentication occurs when the user provides proof of the identity, such as with a password. Authorization grants access to resources based on the user's proven identity.


Pass the Security+ exam the first time you take it.
CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide




Something You Know

The something you know factor includes passwords and personal identification numbers (PINs). This is considered the weakest form of authentication because users often use weak passwords, give them out, or write their passwords down.

A strong password is complex and includes at least eight characters. Complex means that the password uses a mixture of upper case, lower case, numbers, and special characters. Some documentation indicates using three of the four character types is enough, while other documentation states that a complex password has four character types. The key is that more character types results in a more complex password that is harder to crack. However, the bigger point is that many users create passwords with only a single character type.

Troy Hunt did a great analysis of passwords that were stolen from Sony's web sites and published on the Internet. He found that half used only a single character type and only 1 percent used any non-alphanumeric characters. Some of the top passwords were very simple: seinfeld, password, winner, 123456, purple, sweeps, contest, princess, maggie, and abc123. More than 64 percent of the passwords were found in common password-cracking dictionaries. Additionally, when users had accounts on two separate Sony sites, over 92 percent of them used the same password.

Password policies are often used to ensure that users create strong passwords and change them often. Some common password policy settings are:
  • Maximum password age. Requires users to change their password.
  • Minimum length. Ensures passwords have a minimum number of characters.
  • History. Remembers specific number of past passwords (such as last 5, or last 24 passwords). Prevents users from reusing the same passwords.
  • Minimum password page. Prevents users from changing their password right away. Used with the password history to prevent users from changing their password multiple times to circumvent the password history.


Looking for quality Practice Test Questions for the SY0-301 Security+ exam?
CompTIA Security+: Get Certified Get Ahead- SY0-301 Practice Test Questions




Something You Have

Smart cards and token, or fobs are common examples within the something you have factor of authentication. A smart card is a credit card sized card that holds key information about the user. Smart cards have certificates embedded in them using TLS and provide very strong authentication. This blog covers the differences between smart cards, a common access card (CAC), and a personal identity verification (PIV) card.

A fob (sometimes called a token) has an LED display that shows a number that changes regularly, such as every 60 seconds. This number is synchronized with a server. When users log into a website, they enter the number shown on the display to verify they have the token. This factor is often combined with another factor to provide multifactor authentication.


Studying SSCP?
This book covers the new objectives effective Feb 1, 2012.
SSCP Systems Security Certified Practitioner All-in-One Exam Guide




Something You Are

The something you are factor uses biometrics to prove a user's identity. Fingerprints are very commonly used for authentication, but there are many other examples. Biometrics are often divided into two categories: physical biometrics and behavioral biometrics.
  • Physical biometrics are based on physical traits of an individual. It includes fingerprints, thumbprints, handprints, palms retina scanners, and iris scanners.
  • Behavioral biometrics is based on behavioral traits of an individual. It includes voice recognition, signature geometry, and key strokes on a keyboard.
Biometrics systems are susceptible to false readings. These are commonly known as:
  • Type 1 error. False Reject Rate (FRR). This occurs when a biometric system incorrectly rejects an authorized user.
  • Type 2 error. False Accept Rate (FAR). This occurs when a biometric system incorrectly identifies an unauthorized user as an authorized user.
Most biometric systems allow you to adjust the sensitivity of the system. For example, you can adjust it to minimize false rejections (FRR errors) but this will result in an increase in the false acceptances (FAR errors). The overall accuracy of a biometric system is identified with the crossover error rate (CER), where the FAR and FRR are equal. A biometric system with a lower CER is more accurate than one with a higher CER.


Looking for practice test questions to test your readiness for Security+?
CompTIA Security+: Get Certified Get Ahead- SY0-301 Practice Test Questions




Multifactor Authentication

Multifactor authentication combines two or three of the factors. Two common examples are:
  • A user has a smart card and also uses a personal identification number (PIN)
  • A user has a token and also enters a username and password
It's important to realize that multiple authentication and multifactor authentication are not the same thing. For example, if a user enters a pin (in the something you know factor), and a password (also in the something you know factor), this is not multifactor authentication.


Sunday, January 15, 2012

Network+ N10-004 and N10-005 Differences

If you're studying for the CompTIA Network+ exam, you probably know there are currently two versions of the exam. The N10-004 exam came out in 2009 and is available until August 31, 2012. The new version (N10-005) has been available since December 2011. A common question whenever a new exam comes out, is what are the differences so I've tried to address some of the differences here.

Networking is a challenging topic. If you're looking for a good book to introduce networking topics and lay a solid foundation, check out this book: Microsoft Windows Networking Essentials. It's a good read with plenty of full-color graphics. Many people buy it with one of Todd Lammle's Network+ books: CompTIA Network+ Study Guide: Exam N10-004 or CompTIA Network+ Study Guide: Exam N10-005.
Realistic practice test questions for the Network+ exam
CompTIA Network+ N10-005 Practice Test Questions (Get Certified Get Ahead)

Domain Differences

The following table shows a comparison of the domains in the two exams. The first thing that stands out is that N10-005 has one less domain. The Network Tools domain was rolled into the Network Management domain. What's not apparent from the table is that many of the objectives have been moved around. For example, the OSI model was in the Network Management domain previously, but it is in the Network Concepts domain now.
N10-004 Domain N10-005 Domain
1.0 Network Technologies (20%) 1.0 Network Concepts (21%)
2.0 Network Media and Topologies (20%) 2.0 Network Installation and Configuration (23%)
3.0 Network Devices (17%) 3.0 Network Media and Topologies (17%)
4.0 Network Management (20%) 4.0 Network Management (20%)
5.0 Network Tools (12%) 5.0 Network Security (19%)
6.0 Network Security (11%)






1.0 Network Concepts

The first domain of the N10-005 exam is Network Concepts. A primary focus here is with the seven layer OSI model. While the OSI model was in the N10-004 exam, there are a couple of differences. First, it adds in the TCP/IP model. Also, it includes the following objective: Classify how applications, devices, and protocols relate to the OSI model layers. You'll need to be able to look at an application, device, or protocol and identify which layer it operates on.

Many of the protocols and ports are similar. However, the new exam digs into Domain Name System (DNS) a little more. You'll need to know the different types of records and what dynamic DNS is. Troubleshooting methodologies are added but these are largely the same as they were in Domain 4 in the previous exam.

A completely new topic 1.9 Identify virtual network components. Virtualization is widely used and important to understand. Interestingly, they indirectly added a reference to cloud computing with Network as a Service (NaaS).

2.0 Network Installation and Configuration

This topic includes many of the objectives from the Network Devices domain in the previous domain. However, it does expand on some topics such as Dynamic Host Configuration Protocol (DHCP). Many people commonly remember that DHCP provides IP addresses, but it does much more and the objectives identify topics such as reservations, scopes, leases, and options.

This topic also adds in troubleshooting topics for wireless networks and common router and switch problems. Most of these topics were in the Network Management domain previously.

3.0 Network Media and Topologies

This domain includes many of the same topics as the Network Media and Topologies domain in the previous exam. However, there is an important difference. In the previous exam, the objective often included the word identify or categorize. However, in the new exam, these words have sometimes been replaced with describe, or compare and contrast. These imply additional depth for the topics.

For example, instead of just being able to identify common physical network topologies such as Star or Ring, you're expected to be able to describe them. If you're asked to point to a square peg or a round hole, that requires one level of knowledge. However, it is a little more difficult to describe a square peg or a round hold.

4.0 Network Management

While the previous exam had a domain labeled as Network Management, many of the objectives are not the same. That's not to say that all of the objectives in the N10-005 Network Management domain are new. They aren't. Instead, objectives have just been moved around. As mentioned earlier, the Network Tools domain was rolled into this domain. Additionally, some of the specialized network devices topics from the Network Devices domain were put into here. Some of the other objectives have been reworded with a different emphasis, but the core objectives are the same.


Pass the Security+ exam the first time you take it




5.0 Network Security

The first thing to notice here is that security has become much more important. It was only 11 percent of the previous exam, but is 19 percent in current exam. Security is an important part of any network administrator's job and this reflects the growing importance of security.

Wireless security topics have been added and placed right at the beginning, and again in objective 5.4. This makes a lot of sense since wireless networks are so common and people often implement them with weak security.

The objective related to firewalls has different wording. Instead of just expecting you to explain common features of a firewall, the new objectives expect you to be able to install and configure a basic firewall. You'll still be expected to explain the common features, but you should have deeper knowledge of firewalls.

Summary

In summary, there are quite a few differences between the N10-004 and N10-005 exams. If you're studying for Network+, ensure you are studying the relevant materials for the exam you plan on taking. Also, if you're studying for the N10-004 exam, ensure you take it before the exam retires on August 31, 2012.

Good luck.

Best of luck in your studies,

Darril
Get a solid foundation in networking.
Microsoft Windows Networking Essentials

Monday, January 2, 2012

Security+ Study Guide Sale

The CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide is now available for a limited time for only $19.99 (plus $4.99 shipping and handling to addresses within the United States). Book includes over 450 practice test questions. The retail price of this book is $36.99!

Buy your copy from the author today. If you want a signed copy, just ask. I'll be happy to sign your copy before sending it out.

SY0-301 Study Guide

The CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide is an update to the top-selling SY0-201 Security+ study guide, which helped thousands of readers pass the Security+ exam the first time they took it. Here are a few highlights about the book:

  • 100 percent coverage of SY0-301 objectives
  • Over 450 realistic practice test questions
  • 100 question pre-test
  • 100 question post-test
  • Practice questions in each of the eleven chapters
  • Comprehensive acronym list
All practice test questions have in-depth explanations. You’ll know why the correct answers are correct, and why the incorrect answers are incorrect. Additionally, the chapter content explains the topics in full detail. No matter how CompTIA words the questions, you’ll have the knowledge to correctly answer them.

I only have a limited number of these books available at this price. If you want one, buy your copy today.