Exam Profile: CompTIA's New Security+ SY0-401 Exam

Date: Aug 4, 2014

This article describes the new CompTIA Security+ SY0-401 exam, including the objectives, preparation hints, and study resources.

The CompTIA Security+ certification is an entry-level certification focused on IT security. A security professional with the Security+ certification is expected to have at least two years of experience in IT administration with a focus on security. However, this two-year requirement is not as strict as it with some other security certifications, and it is not enforced. In other words, as long as you can pass the exam, you earn the certification.

Security+ has gained a lot of recognition in the past few years and is a required certification by many organizations. For example, the U.S. Department of Defense (DoD) published DoD directive 8570, requiring many administrators to have at least a Security+ certification. This includes active duty personnel, civilians, and contractors. Many IT contracts specifically state that hired contractors must have at least the Security+ certification to work on the contract, so having this on your resume often opens many more doors of opportunity.

Security+ started with the SY0-101 version, was revised in 2008 to the SY0-201 version, and revised in 2011 to the SY0-301 version. It has been revised again as SY0-401, and the SY0-401 version became available in May 2014. However, the current SY0-301 version will be available until Dec. 31, 2014.

A common question I’ve been asked is “Does it matter which exam I take?” The short answer is no. You earn the same certification with both exams, and the certification must be renewed within three years or it will expire. At this moment, there is much more training material out on the SY0-301 exam, so if you want to earn the Security+ certification go for the current SY0-301 exam. Publishers and training companies are working behind the scenes to get updated materials out for the SY0-401 exam (such as the CompTIA Security+ SY0-401 Authorized Cert Guide), and as we get closer to December 2014, there will be a lot more material available.

Certifications Must Be Renewed

Anyone that took and passed the Security+ certification on or before December 31, 2010, is certified for life. However, anyone certified after December 31, 2010, is only certified for three years from the date they first became certified. This renewal also applies for anyone with the CompTIA A+ and Network+ certifications, but not any other CompTIA certifications. This policy is in line with other certifications such as (ISC)2’s SSCP and CISSP, and Cisco’s CCNA. It became a requirement after the A+, Network+ and Security+ certifications became accredited under ANSI/ISO/IEC 17024. You can read more on the certification renewal policy here.

There are two basic requirements to renew the Security+ certification:

Earn at least 50 continuing education units (CEUs)
Pay an annual fee of $49 (for a total of $147)

There are multiple ways you can earn CEUs. For example, you can take non-degree courses or training sessions relevant to Security and earn 1 CEU for each hour of training up to a maximum of 40 CEUs. If you took a 40-hour SSCP training course, you’d earn 40 CEUs. Similarly, you can earn as many as 20 CEUs for creating and presenting IT Security related material. You’ll earn 2 CEUs for each hour spent on creating the material, and 1 CEU for each hour you spend presenting the material. Different activities have different submission requirements. For example, when attending a class, you need to be able to provide a description of the training, the content covered, dates, hours, and proof of completion.

You can also earn a full 50 CEUs if you complete a qualified higher level certification. There are many higher level certifications that fall into this category, A few are: SANS GSE, SCP SCNP, ISACA CISA, (ISC)2 SSCP or CISSP, Microsoft MCSA or MCSE, and Cisco CCNA Security. While Microsoft’s MCITP certifications aren’t currently listed, some of them probably will be at some point in the future.

You can view a full listing of all qualifying activities to earn CEUs, and all approved higher level certifications here.

It’s expected that you’ll earn the 50 CEUs over the course of a three-year period. For example, you may earn 10 credits the first year and 20 credits in years 2 and 3, for a total of 50 credits. However, you have to earn the 50 CEUs at some point within the three year cycle, and submit the CEUs to CompTIA or your certification will expire. When you submit the CEUs for evaluation, you’ll be required to pay the annual fee, and you can pay for all three years at once. If you don’t submit CEUs in years 1 and 2, and want to submit 50 CEUs in year 3, you’ll still be required to pay a total of $147. After you submit the CEUs, they’ll be evaluated to ensure they meet the requirements and you’ll be certified for another three years.

SY0-401 Exam Details:

Number of questions: 90

Some questions may be beta questions put in for research purposes and they aren’t graded. However, you’ll never know which ones are beta questions and which ones are graded, so you must answer each question as though it’s a valid question.

Type of Questions: Multiple choice and performance-based
Passing score: 750 on a scale of 100 to 900

If you show up and don’t answer a single question, you’ll get a score of 100. If you ace the exam, you’ll get a score of 900.

Time limit: 90 minutes
Exam price: $293 in the US.

You can check this link for prices elsewhere in the world. You can buy a voucher for the exam directly from the CompTIA marketplace, or from a testing center when you register.

How to register: Pearson Vue

You can take the exam at any Pearson Vue test center. If you know of one near you, you can call them directly to register, or you can register online. This Pearson Vue site will help you locate a Pearson Vue testing center close to you.

Time to get results: You’ll know as soon as you complete the exam if you passed or not.

Preparation Hints

Objectives for the SY0-401 Security+ exam are identified in six separate domains with varying weight. They are compared with the six SY0-301 domains in the following table. As you can see, the domains don’t match up directly and there are many differences. One thing that stands out is that the first three domains make up almost 60 percent of the exam content.

SY0-401 Domain	SY0-401 Weight	SY0-301 Domain	SY0-301 Weight
1.0 Network Security	20%	1.0 Network Security	21%
2.0 Compliance and Operational Security	18%	2.0 Compliance and Operational Security	18%
3.0 Threats and Vulnerabilities	20%	3.0 Threats and Vulnerabilities	21%
4.0 Application, Data, and Host Security	15%	4.0 Application, Data, and Host Security	16%
5.0 Access Control and Identify Management	15%	5.0 Access Control and Identify Management	13%
6.0 Cryptography	12%	5.0 Cryptography	11%

Recommended Study Resources

At this moment, there are a limited number of resources for the SY0-301 401 exam. However, this is sure to change as we get close to the retirement date of December 31, 2011 2014 for the current SY0-201 301 exam.

Pearson IT Certification is a CompTIA Platinum Partner and a leader in providing flexible learning and exam preparation options. Pearson offers CompTIA Authorized Cert Guides and late-stage cramming tools in the Exam Cram series. Pearson also provides the NEW Premium Edition eBook and Practice Test digital bundle, which includes EPUB/PDF eBooks and practice exams linked to learning tutorials to help you prepare for and pass the exam.

Exam Objectives

You can retrieve a full listing of the all the objectives for the SY0-401 Security+ exam here. The following list provides an overview of the topics that are covered in each of the domains.

Network Security

Implement security configuration parameters on network devices and other technologies
Given a scenario, use secure network administration principles
Explain network design elements and compounds
Given a scenario, implement common protocols and services
Given a scenario, troubleshoot security issues related to wireless networking

Compliance and Operational Security

Explain the importance of risk related concepts
Summarize the security implications of integrating systems and data with third parties
Given a scenario, implement appropriate risk mitigation strategies
Given a scenario, implement basic forensic procedures
Summarize common incident response procedures
Explain the importance of security related awareness and training
Compare and contrast physical security and environmental controls
Summarize risk management best practices
Given a scenario, select the appropriate control to meet the goals of security

Threats and Vulnerabilities

Explain types of malware
Summarize various types of attacks
Summarize social engineering attacks and the associated effectiveness with each attack
Explain types of wireless attacks
Explain types of application attacks
Analyze a scenario and select the appropriate type of mitigation and deterrent techniques
Given a scenario, use appropriate tools and techniques to discover security threats and vulnerabilities
Explain the proper use of penetration testing versus vulnerability scanning

Application, Data and Host Security

Explain the importance of application security controls and techniques
Summarize mobile security concepts and technologies
Given a scenario, select the appropriate procedures to establish host security
Implement the appropriate controls to ensure data security
Compare and contrast alternative methods to mitigate security risks in static environments

Access Control and Identity Management

Compare and contrast the function and purpose of authentication services
Given a scenario, select the appropriate authentication, authorization or access control
Install and configure security controls when performing account management, based on best practices

Cryptography

Given a scenario, utilize general cryptography concepts
Given a scenario, use appropriate cryptographic methods
Given a scenario, use appropriate PKI, certificate management and associated components

Where to Go From Here

Decide if you want to take the SY0-301 or SY0-401 exam. If you can finish your studying within a couple of months, and it’s not November 2014 yet, go for the SY0-301 exam. Locate a good book on Security+ (check Amazon.com) and start studying. Good luck!