CompTIA Security+ SY0-701 · Free study guide

Objective 4.5 — Strengthen enterprise security capabilities

Enterprise controls should be modified from a stated risk and verified flow. Adding products without a clear enforcement point can increase complexity while leaving the path open.

Firewall rules and access lists should identify source, destination, service, direction, owner, purpose, and expiry where appropriate. Restrict ports and protocols to actual requirements. Screened subnets separate public services from internal networks. Review broad, shadowed, duplicate, and unused rules.

IDS detects and reports; IPS can block inline. Signature detections match known patterns, while trend or behavior detections look for deviations. Web filters may use endpoint agents or centralized proxies, URL analysis, content categories, explicit blocks, and reputation. DNS filtering blocks or redirects resolution for known-risk domains but cannot inspect every direct connection.

Host, protocol, and messaging controls

Group Policy and SELinux can enforce operating-system security at scale. Secure protocol implementation requires selecting the protected protocol, correct port, and transport—not simply appending an “S” to a name.

SPF authorizes sending infrastructure for a domain. DKIM signs message content and selected headers. DMARC tells receivers how to handle messages that fail aligned SPF or DKIM checks and provides reporting. These controls reduce domain spoofing but do not make every authenticated message trustworthy. Email gateways add content and attachment inspection.

File-integrity monitoring reports unexpected changes to important files. DLP helps detect or prevent sensitive-data movement. NAC evaluates devices or identities before granting network access. EDR provides endpoint detection and response; XDR correlates across multiple security layers. User behavior analytics highlights deviations that may indicate compromise or misuse.

Choose capabilities that complement each other. For business email compromise, combine verified payment procedures, strong identity controls, DMARC policy, mailbox monitoring, and user reporting. A mail gateway alone cannot stop a valid but compromised supplier account.

Decision rule: place a narrowly scoped control on the demonstrated path, preserve required traffic, record ownership, and test both allowed and denied behavior after the change.