Podcast · Learning

Certified: The CompTIA Security+ V8 / SY0-801 Audio Course

by Jason Edwards · English · Learning

Start from episode 1WhatsApp

New episodes: Several times a day
Typical length: 14 min
Latest: 27 Apr 2026
Language: English

Latest episode

27 Apr 2026 · 1 min

Welcome to the CompTIA Security+ Audio Course!

Certified: The CompTIA Security+ V8 / SY0-801 Audio Course is built for learners who want a clear, practical path into modern cybersecurity fundamentals without being tied to a desk. It is designed for entry-level security professionals, IT support staff, help desk technicians, junior system administrators, career changers, and anyone preparing for the Security+ exam. The course assumes you may already understand basic networking and computer systems, but it does not assume deep security experience. Each lesson explains the ideas behind the exam objectives in plain language, then connects…

Play episodeWhatsApp Download

Earlier episodes 29 most recent

E118 · 27 Apr 2026 · 14 min
Episode 118 — Final Objectives Update: What Changed When CompTIA Finalized SY0-801 (Update)
This episode is reserved for final updates after CompTIA finalizes the SY0-801 exam objectives. Its purpose is to identify what changed from the draft objectives, including added topics, removed topics, renamed terms, reorganized objectives, weight changes, or clarified wording that affects study priorities. Students should use this episode as a fast alignment check so earlier preparation remains current and exam-focused. For real study planning, the key is to compare the finalized objectives against the course structure, revisit any changed areas, and avoid overstudying draft-only material…
E117 · 27 Apr 2026 · 17 min
Episode 117 — Full-Course Review: The SY0-801 Memory Map (Review)
This episode provides a guided review of the major relationships students should remember across the SY0-801 course. The five-domain structure can be understood as a connected security model: threats and vulnerabilities create risk, risk drives control selection, controls support secure architecture, operations generate evidence, and governance guides repeatable decisions. Students should review core models such as CIA, AAA, defense in depth, Zero Trust, risk treatment, identity lifecycle, incident response, data protection, resilience, and third-party oversight. For the exam, the goal is to…
E116 · 27 Apr 2026 · 15 min
Episode 116 — PBQ Strategy: Turning Objectives into Scenario Decisions (Review)
This episode teaches students how to approach performance-based questions by turning exam objectives into practical scenario decisions. A strong PBQ approach starts by identifying the task, the environment, the security goal, and the evidence provided. Students should look for clues such as system type, data sensitivity, user role, log entries, network placement, access requirement, or incident stage before choosing controls or actions. Examples may involve IAM decisions, incident response ordering, firewall rule selection, cloud misconfiguration, log interpretation, data protection, or…
E115 · 27 Apr 2026 · 15 min
Episode 115 — Awareness Delivery and Effectiveness: LMS, Self-Service, Metrics, Behavior Risk Scoring, BEC, BYOD, and Remote Work (5.6)
This episode covers how security awareness is delivered, measured, and improved over time. Students should understand learning management systems, self-service training, one-to-one instruction, and one-to-many instruction as different ways to reach users based on scale, role, and need. Effectiveness metrics may include completion rates, phishing simulation results, reporting rates, repeat failures, policy acknowledgements, and behavior risk scoring. Training topics may include social engineering, business email compromise, removable media, bring your own device rules, remote work, and…
E114 · 27 Apr 2026 · 13 min
Episode 114 — Security Awareness Training: Onboarding, Ongoing, Targeted, and Corrective Training (5.6)
This episode explains security awareness as an ongoing program rather than a one-time compliance activity. Students should understand onboarding training as the first introduction to organizational expectations, acceptable use, data handling, reporting procedures, and common threats. Ongoing training reinforces important behaviors over time, while targeted training focuses on specific roles, risks, departments, or emerging threats. Corrective training is used when behavior shows a gap, such as repeated phishing failures, improper data handling, unsafe remote work habits, or policy…
E113 · 27 Apr 2026 · 15 min
Episode 113 — Penetration Testing, Reconnaissance, Frameworks, Functional Testing, and Behavioral Testing (5.5)
This episode explains penetration testing and related assessment methods at a Security+ level. Students should understand the difference between known, unknown, and partially known environments, where testers may have full information, no internal knowledge, or limited details before testing begins. Reconnaissance may be active, involving direct interaction with targets, or passive, relying on publicly available information and indirect observation. Physical, offensive, defensive, and integrated testing can evaluate different parts of the organization’s security posture. Frameworks and…
E112 · 27 Apr 2026 · 15 min
Episode 112 — Audit Scope and Engagements: Charters, Gap Analysis, Internal Reviews, External Reviews, and Benchmarking (5.5)
This episode covers audit scope and engagement planning, including charters, frequency, boundaries, gap analysis, internal reviews, external reviews, regulatory assessments, and benchmarking. Students should understand that an audit charter defines authority, purpose, responsibilities, and scope so the review is properly controlled and understood. Gap analysis compares the current state to a required or desired state, such as a standard, policy, framework, or regulatory expectation. Internal reviews may support self-improvement, while external reviews and regulatory assessments provide…
E111 · 27 Apr 2026 · 13 min
Episode 111 — Audit Data Gathering: Sampling, Questionnaires, Interviews, Assertions, and Reference Sources (5.5)
This episode explains how audits and assessments gather evidence to determine whether controls, processes, and security requirements are working as expected. Students should understand sampling as reviewing a representative portion of records or systems rather than every item, while questionnaires and interviews help collect information from control owners, administrators, users, and stakeholders. Assertions are claims about control design, operation, or compliance that must be supported by evidence. Reference sources such as MITRE ATT&CK, the Cyber Kill Chain, and the Diamond Model help…
E110 · 27 Apr 2026 · 16 min
Episode 110 — Non-Compliance, Privacy Rights, Legal Holds, Legal Orders, and Retention (5.4)
This episode covers the consequences of non-compliance and the legal and privacy concepts that shape data handling decisions. Students should understand that non-compliance can lead to reputational damage, financial penalties, legal action, contract violations, license loss, operational disruption, and loss of customer trust. Privacy rights may include opt-in and opt-out choices, access to personal data, correction of inaccurate data, processing restrictions, and deletion requests where applicable. Controller and processor roles affect who determines the purpose of processing and who acts on…
E109 · 27 Apr 2026 · 14 min
Episode 109 — Compliance Training and Monitoring: Data Handling, AML/CTF, Anti-Bribery, and Attestations (5.4)
This episode explains compliance as the need to meet laws, regulations, contracts, internal policies, and industry standards. Students should understand that compliance training helps employees know what is required for data handling, privacy, reporting, acceptable behavior, and regulated business activity. Anti-money laundering and counter-terrorist financing controls focus on detecting and preventing misuse of financial systems, while anti-bribery requirements address improper payments, gifts, influence, and conflicts. Monitoring helps verify that required controls are followed, and…
E108 · 27 Apr 2026 · 14 min
Episode 108 — Vendor Constraints and Rules of Engagement: Jurisdiction, ROI, Lock-In, and Assurance Mechanisms (5.3)
This episode explains vendor constraints and assurance mechanisms that affect third-party risk decisions. Students should understand that staffing, resources, geography, jurisdiction, return on investment, and vendor lock-in can influence whether a third-party relationship is practical, secure, and sustainable. Jurisdiction matters because laws, privacy requirements, and legal remedies may differ across locations. Vendor lock-in can make it difficult or expensive to leave a provider, especially when data, integrations, or proprietary services are involved. Assurance mechanisms such as vendor…
E107 · 27 Apr 2026 · 15 min
Episode 107 — Agreements and Monitoring: SLA, SLO, MOU, MOA, NDA, MSA, SOW, and Right to Audit (5.3)
This episode covers common third-party agreements and monitoring terms that define expectations between organizations. Service-level agreements establish required service commitments, while service-level objectives define measurable targets that support those commitments. Memorandums of understanding and memorandums of agreement document shared expectations, responsibilities, or cooperation. Nondisclosure agreements protect confidential information, master service agreements define broad legal and business terms, and statements of work describe specific tasks, deliverables, timelines, and…
E106 · 27 Apr 2026 · 13 min
Episode 106 — Third-Party Risk: Vendor Selection, RFP, RFI, RFQ, EOI, Due Diligence, and Conflicts (5.3)
This episode explains third-party risk and why vendors, partners, suppliers, service providers, and contractors can extend an organization’s attack surface and compliance obligations. Students should understand vendor selection as a security-relevant process that evaluates capability, reliability, controls, cost, and fit. Requests for information gather general details, requests for proposal ask vendors to explain how they would meet a need, requests for quote focus on pricing, and expressions of interest help identify potential participants. Due diligence reviews security posture, financial…
E105 · 27 Apr 2026 · 14 min
Episode 105 — Risk Treatment and Business Impact: Transfer, Accept, Avoid, Mitigate, BIA, Appetite, Residual Risk, SLE, ALE, and ARO (5.2)
This episode covers risk treatment and business impact concepts that help organizations decide what to do after a risk is assessed. Students should understand that risk can be transferred through insurance or contracts, accepted when leadership chooses to live with it, avoided by stopping the risky activity, or mitigated by applying controls. A business impact analysis identifies critical processes, dependencies, and consequences of disruption. Risk appetite defines how much risk leadership is willing to tolerate, while residual risk remains after controls are applied. Single loss…
E104 · 27 Apr 2026 · 13 min
Episode 104 — Risk Analysis and Registers: Impact, Likelihood, Owners, Current Mitigations, and Qualitative vs. Quantitative Risk (5.2)
This episode explains risk analysis and the role of the risk register in tracking organizational risk. Students should understand impact as the amount of harm a risk could cause and likelihood as the chance that the risk may occur. Risk owners are responsible for tracking, reporting, and supporting treatment decisions, while current mitigations show what controls already reduce exposure. A risk register records details such as description, category, owner, likelihood, impact, status, treatment plan, and residual risk. Qualitative analysis uses categories such as low, medium, and high, while…
E103 · 27 Apr 2026 · 13 min
Episode 103 — Risk Identification and Assessment: Assets, Stakeholders, Scoring, and Categorization (5.2)
This episode introduces risk identification and assessment as the process of finding what could go wrong, what assets could be affected, and who needs to be involved in the decision. Students should understand that assets may include systems, data, facilities, services, people, vendors, applications, and business processes. Stakeholders help define business value, ownership, acceptable impact, and operational constraints. Risk scoring and categorization help organize risks so leaders can compare them and choose priorities. For Security+ scenarios, students should connect assessment to…
E102 · 27 Apr 2026 · 15 min
Episode 102 — Plans and Policies: BCP, DRP, BYOD, AUP, Clean Desk, Incident Response, Data Retention, Access Control, and Privacy (5.1)
This episode covers major security plans and policies students are expected to recognize for the Security+ exam. Business continuity plans focus on keeping essential functions operating, while disaster recovery plans focus on restoring systems and data after disruption. BYOD policies define rules for personally owned devices, acceptable use policies explain proper technology behavior, and clean desk policies reduce exposure of sensitive information in physical work areas. Incident response, data classification, retention, access control, disposal, vulnerability disclosure, and privacy…
E101 · 27 Apr 2026 · 15 min
Episode 101 — Standards and Procedures: Baselines, Passwords, Physical Security, RFCs, Encryption, SOPs, and Runbooks (5.1)
This episode explains how standards and procedures turn broad security policy into repeatable action. Students should understand that baselines define approved configuration settings, password standards establish expectations for authentication strength, physical security standards guide facility and equipment protection, and encryption standards define approved methods for protecting data. RFCs can document technical protocol behavior, while standard operating procedures explain how tasks should be performed consistently. Runbooks provide step-by-step operational guidance for routine…
E100 · 27 Apr 2026 · 15 min
Episode 100 — GRC Artifacts: Guidelines, Benchmarks, Advisories, Implementation Guides, and Reference Architectures (5.1)
This episode introduces governance, risk, and compliance artifacts that help organizations build consistent security programs. Guidelines provide recommended practices, benchmarks define measurable configuration expectations, advisories warn about risks or required action, implementation guides explain how to apply controls, and reference architectures show approved patterns for secure design. For Security+ scenarios, students should understand that these artifacts translate security goals into repeatable decisions across systems, teams, and environments. They also support audits, risk…
E99 · 27 Apr 2026 · 15 min
Episode 99 — Evidence and Stakeholders: File Integrity, Memory Dumps, Bit Copies, Snapshots, HR, Legal, and Log Parsing (4.8)
This episode explains evidence handling and stakeholder involvement during security investigations. File integrity checks help confirm whether files were changed, while log integrity helps determine whether records can be trusted. Memory dumps may capture volatile evidence such as running processes, active connections, encryption keys, or malware artifacts. Bit-level copies preserve storage for forensic analysis, and snapshots can capture system state for investigation or recovery. Log parsing helps analysts extract useful patterns from large volumes of records. Students should also…
E98 · 27 Apr 2026 · 15 min
Episode 98 — Investigation Sources: Vulnerability Scans, Automated Reports, NetFlow/IPFIX, Surveillance, and Packet Captures (4.8)
This episode covers investigation sources beyond standard logs, including vulnerability scans, automated reports, NetFlow, IPFIX, surveillance footage, dashboards, and packet captures. Vulnerability scans can show known weaknesses that may explain an entry point, while automated reports can summarize recurring issues, compliance status, or tool findings. NetFlow and IPFIX describe traffic patterns and can help identify unusual connections, data movement, or communication with suspicious systems. Surveillance footage may support physical security investigations, and dashboards can provide…
E97 · 27 Apr 2026 · 15 min
Episode 97 — Investigation Data Types: Access, Device, Server, Application, Authentication, Communication, and Audit Logs (4.8)
This episode explains the major log categories used during security investigations and how each source contributes part of the incident story. Access logs show who reached a resource and when, device logs reveal endpoint or network device activity, server logs show operating system or service behavior, and application logs provide details about application events, errors, transactions, or suspicious requests. Authentication logs help identify login attempts, failures, session activity, and identity abuse. Communication logs may show email, messaging, or network communication patterns, while…
E96 · 27 Apr 2026 · 14 min
Episode 96 — Containment Through Post-Incident: Isolation, Negotiation, Recovery, Reporting, Lessons Learned, and RCA (4.7)
This episode covers the incident response path from containment through post-incident activity. Containment limits damage by isolating systems, disabling accounts, blocking traffic, or separating affected environments. Eradication removes the cause of compromise, and recovery restores systems, data, services, and normal operations while monitoring for reoccurrence. Some incidents may involve external reporting, law enforcement coordination, legal review, or negotiation considerations, especially in extortion or ransomware scenarios. Lessons learned and root cause analysis identify what…
E95 · 27 Apr 2026 · 14 min
Episode 95 — Identification and Investigation: Detection, Advisories, Threat Hunting, Forensics, and Chain of Custody (4.7)
This episode explains how teams identify and investigate potential security incidents using alerts, advisories, threat hunting, forensics, and evidence handling. Detection may begin with monitoring tools, user reports, endpoint alerts, network anomalies, or external notifications. Advisories can help teams determine whether a known threat applies to their environment, while threat hunting proactively searches for signs of compromise that automated tools may not have escalated. Forensics focuses on collecting and analyzing evidence without damaging its value. Chain of custody documents who…
E94 · 27 Apr 2026 · 14 min
Episode 94 — Incident Response Preparation: Training, Tabletop Exercises, Playbooks, Simulations, and Roles (4.7)
This episode covers the preparation phase of incident response, where organizations define how they will act before an actual security incident occurs. Students should understand training, tabletop exercises, playbooks, simulations, communication plans, escalation paths, and role assignments as core readiness activities. A playbook gives repeatable guidance for common incident types, while a tabletop exercise lets teams test decisions and communication without causing operational disruption. Simulations can provide more realistic practice and reveal gaps in tools, access, authority, or…
E93 · 27 Apr 2026 · 15 min
Episode 93 — AI in SecOps: Agentic AI, Chatbots, Predictive Analysis, AI-Augmented Baselines, and CI/CD (4.6)
This episode explains how AI can support security operations through assistant-style tools, agentic workflows, predictive analysis, AI-augmented baselines, and integration with continuous integration and continuous delivery pipelines. Students should understand that chatbots may help summarize alerts, answer procedural questions, or guide analysts through response steps, while predictive analysis may identify patterns that suggest higher risk. Agentic AI can take more autonomous actions, which makes access control, approval boundaries, logging, and oversight especially important. For…
E92 · 27 Apr 2026 · 13 min
Episode 92 — Automation Risks and Guardrails: Logic, Complexity, Financial Risk, and Process Risk (4.6)
This episode covers the risks that appear when automation executes bad logic quickly, repeatedly, or at scale. Students should understand that automation can amplify mistakes, such as provisioning excessive permissions, deleting resources, misrouting alerts, triggering expensive cloud actions, or applying a flawed configuration across many systems. Complexity can also make workflows harder to troubleshoot, especially when multiple tools, scripts, approvals, and dependencies interact. For Security+ scenarios, guardrails may include testing, approvals, rollback plans, rate limits, change…
E91 · 27 Apr 2026 · 13 min
Episode 91 — Automation Use Cases: Provisioning, Desired State, Anomaly Detection, and Ticketing (4.6)
This episode explains how automation supports security operations by making common workflows faster, more consistent, and easier to repeat. Students should understand provisioning as the automated creation of users, systems, permissions, or resources based on approved rules. Desired state configuration helps keep systems aligned with a known secure baseline, while anomaly detection can identify activity that differs from expected behavior. Ticketing integrations help route alerts, assign ownership, track status, and preserve evidence of response actions. For Security+ scenarios, automation…
E90 · 27 Apr 2026 · 14 min
Episode 90 — Access Models and Modern Authentication: JIT Access, Passkeys, Passwordless, and Credential Monitoring (4.5)
This episode covers access control models and modern authentication methods that reduce reliance on standing privileges and reusable passwords. Students should understand rule-based, role-based, time-based, mandatory, discretionary, and just-in-time access models, along with how each controls authorization differently. Just-in-time access grants elevated permissions only when needed and often for a limited period. Passkeys and passwordless authentication reduce password exposure, while password managers help users store stronger credentials and compromised credential monitoring identifies…

About Certified: The CompTIA Security+ V8 / SY0-801 Audio Course

Certified: The CompTIA Security+ V8 / SY0-801 Audio Course is a English learning podcast from Jason Edwards. Melo plays each episode straight from the publisher's own feed — no ads added, no account needed — and remembers where you stopped, in this browser only.

Publisher: Jason Edwards
Language: English
Category: Learning
New episodes: Several times a day
Typical length: 14 min
Latest episode: 27 Apr 2026
Feed: RSS — paste into any podcast app
Apple Podcasts: podcasts.apple.com/podcast/id1895575802
Rights: 2026 Bare Metal Cyber

RSS feed Apple Podcasts

More English learning

Take it with you

The Melo app keeps playing with the screen off, works in the car and on your watch, wakes you to your station, and browses the whole catalogue offline. Free, no ads, no account.