SY0-701 — CompTIA Security+ Cheat Sheet

Last revised: September 16, 2026

Compact SY0-701 Cheat sheet for CompTIA Security+ candidates: controls, threats, architecture, operations, IAM, risk, and exam traps.

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

Scope and study context

Fast Scenario Reading Method

Step	Ask	Exam-useful shortcut
1. Identify the asset	What is being protected? Data, host, user, app, network, facility?	The asset often determines the control type.
2. Identify the objective	Confidentiality, integrity, availability, safety, privacy, non-repudiation?	“Best” answer usually aligns to the stated objective.
3. Identify the constraint	Cost, usability, downtime, compliance, cloud, remote users, legacy system?	Constraints eliminate technically valid but impractical answers.
4. Map to control type	Preventive, detective, corrective, deterrent, compensating, physical, technical, managerial?	Know what a control does, not just its name.
5. Choose least disruptive fix	Contain, preserve evidence, reduce risk, restore service.	Do not jump to rebuild, disclose, or wipe unless warranted.

The goal is not to replace full study. The goal is to help you quickly reconnect major concepts, spot common traps, and practice choosing the best answer when multiple options sound plausible.

This page is IT Mastery exam-prep support and is not affiliated with CompTIA.

Scan the decision tables first. They help with “best,” “first,” and “most likely” questions.
Mark weak areas. If a row feels vague, turn it into a topic drill.
Practice by objective style, not just by definition. Security+ questions often ask what to do next, what control is most appropriate, or what risk is being reduced.
Review every explanation. For missed questions, the explanation is where you learn why the tempting answer was not best.

Core Security Principles

Security Goals and Concepts

Concept	Meaning	Exam clue	Common trap
Confidentiality	Prevent unauthorized disclosure	Encryption, access control, data classification	Hashing is not confidentiality.
Integrity	Prevent unauthorized modification	Hashes, digital signatures, file integrity monitoring	Encryption alone does not prove integrity.
Availability	Keep systems/data usable	Redundancy, backups, clustering, DDoS mitigation	Confidentiality controls can hurt availability if overapplied.
Non-repudiation	Prevent denial of action	Digital signatures, audit logs, timestamps	Shared accounts weaken non-repudiation.
Authentication	Prove identity	Password, biometric, certificate, token	Username alone is identification, not authentication.
Authorization	Grant permissions	RBAC, ABAC, ACLs, scopes	Happens after authentication.
Accounting/Auditing	Track activity	Logs, SIEM, audit trails	Logs must be protected from tampering.
Least privilege	Minimum access needed	Just-in-time, role-based access, scoped tokens	“Admin for convenience” violates it.
Separation of duties	Split critical tasks	Dual control, change approval	Reduces fraud and single-person error.
Defense in depth	Multiple layered controls	Firewall + EDR + MFA + logging	Not the same as relying on one strong control.
Zero trust	Never trust implicitly	Continuous verification, device posture, least privilege	Not a product; it is an architecture model.

Notes and examples

Control Categories

Category	Purpose	Examples
Managerial/Administrative	Policies, oversight, risk decisions	Policies, standards, awareness, vendor reviews, risk register
Technical/Logical	Enforced by systems	MFA, ACLs, encryption, EDR, DLP, IDS/IPS
Operational	Day-to-day security processes	Change management, incident response, vulnerability management
Physical	Protect facilities and hardware	Locks, guards, cameras, mantraps, bollards
Legal/Regulatory/Contractual	External or contractual obligations	Data processing agreements, audits, retention requirements

Control Function Types

Function	What it does	Examples
Preventive	Stops event before it occurs	MFA, firewall rule, access control, secure configuration
Detective	Identifies event after/during occurrence	IDS, SIEM alert, audit log, CCTV
Corrective	Restores after event	Backups, patching, reimaging
Deterrent	Discourages attacker	Warning banner, guards, visible cameras
Compensating	Alternative control when primary is not feasible	Extra monitoring when legacy system cannot support MFA
Directive	Instructs expected behavior	Policy, standard, procedure, signage

CIA, AAA, and non-repudiation

Concept	What it protects	Common examples	Common trap
Confidentiality	Prevents unauthorized disclosure	Encryption, access control, data masking	Encryption does not prove integrity by itself
Integrity	Prevents unauthorized alteration	Hashing, digital signatures, checksums	Hashing is not encryption
Availability	Keeps systems usable	Redundancy, clustering, backups, DDoS protection	A backup alone does not guarantee rapid recovery
Authentication	Proves identity	Passwords, certificates, biometrics, tokens	Authentication is not authorization
Authorization	Grants permissions	RBAC, ABAC, ACLs, policy engines	“Logged in” does not mean “allowed”
Accounting/Auditing	Records activity	Logs, SIEM, audit trails	Logs are useful only if collected, protected, and reviewed
Non-repudiation	Prevents credible denial of action	Digital signatures, signed logs	Hashes alone do not identify who performed an action

Security control categories

Security+ often tests whether you can classify a control by purpose and implementation type.

Control type	Purpose	Examples
Preventive	Stops an event before it occurs	MFA, firewall rules, least privilege, secure coding
Detective	Finds events that occurred or are occurring	IDS, SIEM alerts, audit logs, file integrity monitoring
Corrective	Restores after an event	Patch, restore from backup, reimage endpoint
Deterrent	Discourages behavior	Warning banners, guards, visible cameras
Compensating	Alternative when primary control is not feasible	Extra monitoring when legacy systems cannot be patched
Directive	Tells people what to do	Policies, standards, procedures, signs
Physical	Protects facilities/devices	Locks, mantraps, cameras, fencing
Technical	Uses technology	Encryption, EDR, NAC, WAF
Administrative	Uses process/governance	Training, policies, vendor reviews, risk assessments

Trap: A camera is usually detective if it records evidence, but it can also be deterrent if the question emphasizes discouraging intruders.

Threats, Attacks, and Vulnerabilities

Threat Actor Matrix

Actor	Motivation	Capability	Typical indicators
Script kiddie	Curiosity, disruption	Low; uses tools	Commodity malware, noisy scans
Hacktivist	Ideology	Variable	Defacement, DDoS, data leaks
Organized crime	Financial gain	Moderate to high	Ransomware, fraud, credential theft
Nation-state/APT	Espionage, sabotage	High; persistent	Stealthy C2, zero-days, long dwell time
Insider	Revenge, money, negligence	Authorized access	Unusual data access, policy bypass, privilege misuse
Competitor	Business advantage	Variable	IP theft, social engineering
Shadow IT user	Convenience	Authorized but unmanaged	Unsanctioned SaaS, unapproved storage

Notes and examples

Malware and Attack Types

Type	High-yield definition	Key defense
Virus	Attaches to host file; needs execution	EDR, user training, application control
Worm	Self-propagates across networks	Patching, segmentation, firewalling
Trojan	Malicious software disguised as legitimate	Application allowlisting, user training
Ransomware	Encrypts or exfiltrates data for extortion	Offline/immutable backups, EDR, least privilege
Rootkit	Hides privileged malicious activity	Secure boot, integrity checks, reimage if compromised
Spyware	Collects user/system information	Anti-malware, least privilege
Logic bomb	Triggers on condition/time	Code review, separation of duties
Fileless malware	Uses memory and trusted tools	EDR behavior analytics, PowerShell logging
Botnet	Compromised devices controlled centrally	Egress filtering, DNS monitoring, takedown support
Cryptojacking	Unauthorized crypto mining	Resource monitoring, EDR, patching
Keylogger	Captures keystrokes	MFA, EDR, secure input methods

Attack	Distinction	Best mitigation
Phishing	Broad fraudulent messaging	Awareness, email filtering, reporting
Spear phishing	Targeted phishing	Awareness plus identity verification
Whaling	Targets executives	Executive training, payment verification
Vishing	Voice phishing	Call-back procedures, help desk scripts
Smishing	SMS phishing	Mobile awareness, link caution
Pretexting	Fabricated scenario	Verification procedures
Business email compromise	Impersonates trusted business party	Out-of-band payment confirmation
Impersonation	Pretending to be someone	Badges, callback, challenge process
Tailgating	Follows authorized person into facility	Mantraps, badge enforcement
Shoulder surfing	Observes screen/keyboard	Privacy screens, awareness
Dumpster diving	Retrieves discarded information	Shredding, media disposal
Watering hole	Compromises site used by target group	Web filtering, browser isolation, patching
Brand impersonation	Fake trusted brand/domain	DMARC, user training, domain monitoring
Typosquatting	Lookalike domain typo	Domain monitoring, DNS filtering

Web and Application Attack Reference

Attack	What happens	Exam indicator	Mitigation
SQL injection	Input alters database query	`' OR '1'='1`	Parameterized queries, input validation
XSS	Script runs in victim browser	Stored/reflected script	Output encoding, CSP, validation
CSRF	Authenticated user tricked into action	Hidden request from another site	Anti-CSRF token, SameSite cookies
SSRF	Server makes attacker-controlled request	Cloud metadata access	Allowlist destinations, block metadata endpoints
Directory traversal	Access outside intended path	`../` in URL	Normalize paths, restrict file access
Command injection	Input executes OS command	`; cat /etc/passwd`	Avoid shell calls, validate input
Insecure deserialization	Malicious object processed	Object payload causes code execution	Safe formats, signing, validation
Race condition	Timing flaw changes outcome	TOCTOU	Locking, atomic operations
API abuse	Excessive or unauthorized calls	Missing auth, no rate limits	API gateway, auth, throttling
Session hijacking	Attacker uses session token	Stolen cookie/token	TLS, secure cookies, token rotation
Privilege escalation	Gains higher permissions	Local exploit or misconfig	Patching, least privilege, hardening

Wireless and Network Attacks

Attack	Description	Mitigation
Evil twin	Rogue AP mimics legitimate SSID	WPA3/WPA2-Enterprise, certificate validation
Rogue AP	Unauthorized AP connected to network	Wireless scans, NAC, switch port security
Deauthentication attack	Forces clients off Wi-Fi	Protected management frames where supported
On-path/MITM	Intercepts/modifies traffic	TLS, VPN, certificate validation
ARP poisoning	Spoofs MAC-to-IP mapping	Dynamic ARP inspection, static ARP for critical systems
DNS poisoning	Corrupts name resolution	DNSSEC validation, secure DNS, monitoring
MAC flooding	Overloads switch CAM table	Port security, storm control
VLAN hopping	Escapes VLAN isolation	Disable trunking on access ports, native VLAN hygiene
DDoS	Overwhelms service	CDN/scrubbing, rate limits, autoscaling, WAF
Replay attack	Reuses captured valid data	Nonces, timestamps, mutual authentication

Attack	Clue
Phishing	Broad fraudulent email/message
Spear phishing	Targeted phishing against a person/group
Whaling	Targets executives or senior leaders
Vishing	Voice-based phishing
Smishing	SMS/text phishing
Pretexting	Fabricated scenario to gain trust
Business email compromise	Fraudulent payment or invoice request
Tailgating	Following someone into a secure area
Shoulder surfing	Observing sensitive information
Dumpster diving	Searching discarded materials
Watering hole	Compromising a site used by target group

Best mitigation choices: user training helps, but technical controls such as MFA, email filtering, DMARC/SPF/DKIM, least privilege, and payment verification procedures are often stronger depending on the question.

Malware and endpoint threats

Threat	Key behavior
Virus	Attaches to host file/program
Worm	Self-replicates across networks
Trojan	Disguised as legitimate software
Ransomware	Encrypts or exfiltrates data for extortion
Spyware	Collects user/system data
Rootkit	Hides privileged compromise
Logic bomb	Triggers on condition/date
Botnet	Remotely controlled infected hosts
Fileless malware	Uses memory/native tools to avoid disk artifacts
Cryptojacking	Abuses resources to mine cryptocurrency

Trap: If the malware spreads without user action, a worm is more likely than a virus.

Application and web attacks

Attack	What happens	High-value mitigation
SQL injection	Input alters database query	Parameterized queries, input validation
XSS	Malicious script runs in user browser	Output encoding, input validation, CSP
CSRF	User’s authenticated session performs unwanted action	Anti-CSRF tokens, SameSite cookies
SSRF	Server is tricked into making internal/external requests	Egress filtering, metadata protections
Path traversal	Attacker accesses unintended files	Normalize paths, restrict file access
Command injection	Input executes OS commands	Avoid shell calls, validate input
Insecure deserialization	Object data triggers code/logic abuse	Validate/sign serialized data
Buffer overflow	Memory overwritten	Bounds checking, memory-safe practices
Race condition	Timing flaw changes outcome	Locking, atomic operations
API abuse	Broken auth, excessive data exposure, weak rate limits	Strong auth, schema validation, throttling

Password and credential attacks

Attack	Key clue	Mitigation
Brute force	Tries many combinations	Lockout, MFA, rate limiting
Password spraying	Few common passwords across many accounts	MFA, monitoring, password policy
Credential stuffing	Reuses breached credentials	MFA, breached-password detection
Pass-the-hash	Uses password hash without knowing password	Credential protection, patching, least privilege
Golden ticket	Kerberos ticket abuse	Protect domain controllers, rotate KRBTGT after compromise
Rainbow table	Precomputed hash lookup	Salting and strong hashing

Cryptography and PKI

Crypto Selection Matrix

Need	Use	Why
Protect data confidentiality at rest	Symmetric encryption	Fast for large data volumes
Protect data in transit	TLS	Authenticates server and encrypts session
Prove data integrity	Hash	Detects change
Prove sender and integrity	Digital signature	Hash encrypted with sender private key
Exchange keys over untrusted network	Asymmetric crypto / key exchange	Solves secure key establishment
Store passwords	Salted adaptive hash	Resists precomputed and brute-force attacks
Protect full storage device	Full-disk encryption	Protects lost/stolen device data
Protect individual fields	Field-level encryption/tokenization	Limits exposure of sensitive values
Verify software origin	Code signing	Validates publisher and integrity

Notes and examples

Hashing, Encryption, Encoding, Obfuscation

Concept	Reversible?	Key used?	Primary purpose	Example clue
Hashing	No	No, except HMAC uses key	Integrity, password storage	Same input produces fixed digest
Symmetric encryption	Yes	Same/shared key	Confidentiality	AES-style scenario
Asymmetric encryption	Yes	Public/private pair	Key exchange, signatures, identity	Certificates, PKI
Encoding	Yes	No	Format conversion	Base64 is not security
Obfuscation	Usually	Sometimes	Make analysis harder	Minified code, masking
Tokenization	Mapping reversible by token vault	Vault-controlled	Replace sensitive value	Payment token scenario
Data masking	May be irreversible or partial	No	Hide data from users	Shows last four digits only

PKI Terms

Term	Exam meaning
Certificate Authority (CA)	Trusted entity that issues certificates
Root CA	Trust anchor; should be highly protected/offline when possible
Intermediate CA	Issues certs on behalf of root; limits root exposure
Certificate	Binds public key to identity
CSR	Certificate signing request containing public key and subject info
Private key	Must be protected; compromise breaks trust
Public key	Shared openly; used to verify signatures or encrypt to owner
CRL	Certificate revocation list
OCSP	Online certificate status checking
Key escrow	Third party stores keys for recovery/access
Certificate pinning	App trusts specific certificate/public key
Mutual TLS	Client and server authenticate with certificates

Certificate Format Clues

Format/Extension	Typical use
PEM	Base64 text certificate/key, often `.pem`, `.crt`, `.cer`
DER	Binary certificate format
PFX/P12	Certificate plus private key, often password protected
CER/CRT	Certificate file; may be PEM or DER
P7B/P7C	Certificate chain, usually no private key

Crypto Traps

Scenario wording	Best interpretation
“Need to verify file was not changed”	Hash or digital signature, not encryption alone
“Need to prove who sent it”	Digital signature, not just hash
“Need fastest encryption for large data”	Symmetric encryption
“Need secure password storage”	Salted adaptive hashing, not reversible encryption
“Need protect data if laptop is stolen”	Full-disk encryption
“Need protect web sessions”	TLS with valid certificates
“Need prevent use of stolen password”	MFA, conditional access, account monitoring

Know the function, not just the term

Mechanism	Primary purpose	Key exam distinction
Symmetric encryption	Fast confidentiality	Same key encrypts and decrypts
Asymmetric encryption	Key exchange, signatures, confidentiality	Public/private key pair
Hashing	Integrity verification	One-way; no decryption
Digital signature	Integrity, authentication, non-repudiation	Hash encrypted/signed with private key
Certificate	Binds public key to identity	Issued/validated through PKI
HMAC	Integrity plus shared secret authentication	Uses hash plus secret key
Salting	Defends stored password hashes	Adds unique random value before hashing
Key stretching	Slows brute force attacks	PBKDF2, bcrypt, scrypt, Argon2-style concept
Perfect forward secrecy	Protects past sessions if long-term key is compromised	Uses ephemeral session keys

PKI quick path

Component	Role
CA	Issues certificates
Root CA	Top trust anchor
Intermediate CA	Issues certificates while protecting root CA
CSR	Request containing public key and identity details
CRL/OCSP	Certificate revocation checking
HSM	Hardware protection for cryptographic keys
TPM	Hardware root of trust on endpoint
Secure enclave	Isolated hardware-backed key/secret processing

Common trap: Encoding, hashing, and encryption are different.

Encoding changes format and is reversible without a secret.
Hashing is one-way and supports integrity verification.
Encryption is reversible only with the correct key.

Identity and Access Management

Identity Concepts

Concept	Meaning	Example
Identification	Claiming identity	Username
Authentication	Proving identity	Password + token
Authorization	Granting rights	Role assignment
Federation	Trusting another identity provider	SSO with external IdP
Provisioning	Creating accounts/access	New hire workflow
Deprovisioning	Removing accounts/access	Termination workflow
Attestation/recertification	Periodic access review	Manager confirms access
JIT access	Temporary privilege	Admin role for 1 hour
PAM	Controls privileged accounts	Vaulting, session recording
SSO	One login for many apps	SAML/OIDC portal

Notes and examples

Authentication Factor Matrix

Factor	Description	Examples	Trap
Something you know	Secret knowledge	Password, PIN	Security questions are weak knowledge factors.
Something you have	Possession	Smart card, hardware token, phone app	SMS is weaker than app/hardware token.
Something you are	Biometric	Fingerprint, face, iris	Biometrics cannot be changed like passwords.
Somewhere you are	Location	Geo-IP, trusted network	Usually context, not standalone factor.
Something you do	Behavior	Typing pattern, gesture	Often continuous/risk-based signal.

Access Control Models

Model	Decision basis	Best for	Trap
DAC	Owner controls access	Flexible file sharing	Can lead to inconsistent permissions
MAC	System labels/classifications	High-security classified environments	Users cannot override labels
RBAC	Job roles	Enterprise access management	Role explosion if poorly designed
ABAC	Attributes and conditions	Dynamic cloud/SaaS access	More complex policy design
Rule-based	Explicit rules	Firewalls, routers, ACLs	Not the same as RBAC
Risk-based	Contextual risk score	Adaptive authentication	May step up authentication

IAM Protocols and Standards

Protocol/Standard	Primary use	High-yield distinction
LDAP	Directory queries	Used to access directory information
Kerberos	Network authentication	Ticket-based; common in Windows domains
RADIUS	Centralized AAA	Common for VPN, Wi-Fi, network devices
TACACS+	Device administration AAA	Separates authentication, authorization, accounting
SAML	Federated SSO for web apps	XML-based assertions
OAuth 2.0	Delegated authorization	Grants app access without sharing password
OpenID Connect	Authentication on top of OAuth 2.0	Provides identity tokens
FIDO2/WebAuthn	Phishing-resistant authentication	Public key-based login
802.1X	Port-based network access control	Wired/wireless NAC with supplicant/authenticator/server

Password and Account Policy Traps

Requirement	Better approach
Reduce password reuse risk	Password manager, breached-password checks, MFA
Stop brute force	Lockout/throttling, MFA, monitoring
Reduce help desk resets	Self-service reset with strong verification
Secure service accounts	Managed service accounts, vaulting, rotation, least privilege
Prevent orphaned accounts	Automated deprovisioning tied to HR process
Reduce shared admin risk	Individual privileged accounts with PAM

Authentication factors

Factor	Meaning	Examples
Something you know	Knowledge	Password, PIN
Something you have	Possession	Smart card, hardware token, authenticator app
Something you are	Inherence	Fingerprint, face, iris
Somewhere you are	Location	Geofencing, source network
Something you do	Behavior	Typing cadence, gesture pattern

MFA trap: Two passwords are not MFA. MFA requires different factor types.

Access control models

Model	Best clue in a question	Typical use
RBAC	Access based on job role	Employees grouped by function
ABAC	Access based on attributes	User, device, time, location, data sensitivity
DAC	Resource owner grants access	File owner shares a file
MAC	Central authority and labels	Highly controlled environments
Rule-based	If/then rules	Firewall ACLs, conditional access policies
Least privilege	Minimum access needed	Reducing blast radius
Just-in-time access	Temporary privilege elevation	Admin access only during approved window
Privileged access management	Controls/administers privileged accounts	Vaulting, session recording, approval workflows

Federation and identity protocols

Technology	What to remember
SAML	Common for browser-based enterprise SSO using assertions
OAuth	Authorization framework; often used for delegated access
OpenID Connect	Authentication layer built on OAuth 2.0
Kerberos	Ticket-based authentication in many enterprise environments
RADIUS	Centralized AAA, often for VPN/Wi-Fi/network access
TACACS+	Device administration AAA; separates authn/authz/accounting
LDAP/LDAPS	Directory access; LDAPS protects LDAP with TLS
SSO	One authentication grants access to multiple services
FIM	Federated identity management across organizations or domains

Decision rule: If the question involves delegated access to an API, think OAuth. If it involves enterprise web SSO assertions, think SAML. If it involves identity claims plus login, think OpenID Connect.

Network Security Reference

Common Ports and Protocols

Port	Protocol	Secure?	Use
20/21	FTP	No	File transfer control/data
22	SSH/SFTP/SCP	Yes	Secure remote shell/file transfer
23	Telnet	No	Legacy remote shell
25	SMTP	Usually no by itself	Mail transfer
53	DNS	Usually no by itself	Name resolution
67/68	DHCP	No	IP assignment
80	HTTP	No	Web
88	Kerberos	Yes by design	Ticket authentication
110	POP3	No	Mail retrieval
123	NTP	No by itself	Time sync
135/139/445	RPC/NetBIOS/SMB	Depends	Windows file/admin services
143	IMAP	No	Mail retrieval
161/162	SNMP	v3 preferred	Monitoring/traps
389	LDAP	No by itself	Directory
443	HTTPS	Yes with TLS	Secure web/API
445	SMB	Depends	Windows file sharing
465/587	SMTPS/Submission	TLS capable	Secure mail submission
514	Syslog	No by default	Logging
636	LDAPS	Yes	LDAP over TLS
993	IMAPS	Yes	Secure IMAP
995	POP3S	Yes	Secure POP3
1433	MS SQL Server	Depends	Database
1521	Oracle DB	Depends	Database
3306	MySQL/MariaDB	Depends	Database
3389	RDP	Encrypted but high-risk	Remote desktop
5060/5061	SIP/SIPS	5061 uses TLS	VoIP signaling

Notes and examples

Network Device Selection

Need	Choose	Why
Filter traffic by IP/port/protocol	Firewall	Enforces network access policy
Filter web app attacks	WAF	Understands HTTP/app-layer patterns
Detect suspicious traffic	IDS	Alerts without blocking
Block suspicious traffic inline	IPS	Prevents/interrupts detected attacks
Isolate public-facing services	DMZ	Limits exposure of internal network
Segment internal users/systems	VLANs/subnets/firewalls	Limits lateral movement
Secure remote access	VPN or ZTNA	Encrypted and authenticated access
Authenticate network port access	NAC/802.1X	Checks user/device before network access
Hide internal IP addresses	NAT	Address translation, not a full security control
Improve availability/performance	Load balancer	Distributes traffic
Resist DDoS	Scrubbing/CDN/rate limiting	Absorbs or filters attack traffic
Secure DNS resolution	DNS filtering/DNSSEC validation	Blocks malicious domains or validates records

Segmentation Patterns

Pattern	Use case	Notes
DMZ	Public web, mail relay, reverse proxy	Do not place sensitive databases directly in DMZ.
Microsegmentation	Fine-grained workload isolation	Common in virtualized/cloud environments.
VLAN segmentation	Separate broadcast domains	Needs routing/firewall policy to enforce security.
Air gap	Maximum isolation	Operationally difficult; removable media remains a risk.
Jump host/bastion	Controlled admin entry point	Log and restrict access heavily.
Screened subnet	Layered perimeter design	Internet-facing systems isolated from internal network.

VPN and Remote Access

Option	Best for	Watch for
Full-tunnel VPN	Route all client traffic through corporate controls	More bandwidth, stronger central inspection
Split-tunnel VPN	Only corporate traffic uses VPN	Better performance, more endpoint risk
Client-to-site VPN	Remote users	Requires endpoint security posture
Site-to-site VPN	Office/cloud network connection	Protects network-to-network traffic
SSL/TLS VPN	Browser/client remote access	Easier through firewalls
IPsec VPN	Network-layer secure tunnel	Common for site-to-site
ZTNA	App-specific access without broad network access	Aligns with zero trust

Segmentation and traffic control

Control	Best use
VLAN	Logical segmentation
ACL	Permit/deny traffic based on rules
Firewall	Enforces network traffic policy
NGFW	Adds app/user awareness and deeper inspection
WAF	Protects web applications from HTTP-layer attacks
IDS	Detects suspicious activity
IPS	Blocks suspicious activity inline
Proxy	Intermediates requests, can filter and log
NAC	Controls device access to network
VPN	Encrypted tunnel over untrusted network
ZTNA	Application-specific access based on identity/context
Microsegmentation	Fine-grained east-west traffic control

Decision rule: If the attack is against a web application layer, a WAF is often more specific than a traditional firewall.

Secure protocol choices

Insecure/legacy	Prefer	Why
HTTP	HTTPS	TLS encryption and server authentication
Telnet	SSH	Encrypted remote administration
FTP	SFTP or FTPS	Protected file transfer
SNMPv1/v2	SNMPv3	Authentication and encryption support
LDAP	LDAPS	Directory access over TLS
POP3/IMAP without TLS	Secure mail protocols with TLS	Protects credentials and messages in transit
SMBv1	Modern SMB with signing/encryption where supported	Reduces legacy protocol risk
WEP/WPA	WPA2/WPA3	Stronger Wi-Fi security
Unsecured DNS	DNSSEC / protected DNS where applicable	Integrity and privacy improvements depending on solution

Common ports worth recognizing

Service	Common port(s)
FTP	20/21
SSH/SFTP	22
Telnet	23
SMTP	25
DNS	53
DHCP	67/68
HTTP	80
POP3	110
NTP	123
IMAP	143
SNMP	161/162
LDAP	389
HTTPS	443
SMB	445
Syslog	514
LDAPS	636
RDP	3389

Trap: Ports help identify traffic, but modern attacks often use common allowed ports such as 443. Do not choose an answer based only on a port if the scenario gives stronger clues.

Security Architecture and Design

Secure Architecture Concepts

Concept	Practical meaning
Secure by design	Security built into requirements and architecture
Secure by default	Default settings minimize exposure
Fail secure	Failure denies access or preserves safety
Resilience	System continues or recovers under stress
Redundancy	Duplicate components reduce single points of failure
Scalability	Handles growth without redesign
Elasticity	Dynamically adjusts capacity
High availability	Reduces downtime through redundancy/failover
Fault tolerance	Continues despite component failure
Single point of failure	One failure can break service
Attack surface reduction	Remove/disable unnecessary exposure

Notes and examples

Availability and Recovery Terms

Term	Meaning	Exam clue
RTO	Maximum acceptable recovery time	“How long can system be down?”
RPO	Maximum acceptable data loss	“How much data can be lost?”
MTBF	Average time between failures	Reliability measure
MTTR	Average time to repair/recover	Maintainability measure
Hot site	Ready quickly; systems/data near current	Highest readiness, higher cost
Warm site	Partially ready	Middle option
Cold site	Facility only/basic infrastructure	Lower cost, longer recovery
Full backup	All selected data	Slower backup, simpler restore
Incremental backup	Changes since last backup	Fast backup, more restore steps
Differential backup	Changes since last full backup	Middle ground

Cloud and Virtualization

Concept	Security responsibility clue
IaaS	Customer manages OS, apps, data, identity configs
PaaS	Provider manages more platform; customer secures apps/data/access
SaaS	Provider manages app stack; customer manages identities, data, configuration
Public cloud	Shared provider infrastructure
Private cloud	Dedicated to one organization
Hybrid cloud	Mix of cloud and on-premises
Community cloud	Shared by organizations with common requirements
Multicloud	Uses multiple cloud providers
CASB	Visibility/control for SaaS/cloud usage
CSPM	Finds cloud configuration risks
CWPP	Protects cloud workloads
Secrets manager	Stores API keys/passwords securely
Security groups	Instance-level virtual firewall concept
Network ACLs	Subnet-level stateless filtering concept in many cloud designs

Cloud Exam Traps

Scenario	Better answer
“Storage bucket exposed publicly”	Remove public access, use least privilege, monitor policy
“Need encryption but provider manages infrastructure”	Use provider-managed encryption or customer-managed keys as required
“Developers hardcoded cloud keys”	Move secrets to secrets manager/vault; rotate exposed keys
“Need detect misconfigured cloud resources”	CSPM
“Need govern SaaS use and shadow IT”	CASB
“Need isolate workloads in cloud”	Security groups, subnets, microsegmentation
“Need short-lived cloud admin access”	JIT privileged access, federation, MFA

Secure Application and DevSecOps

Practice	Purpose
Threat modeling	Identify design-level threats early
Secure coding standards	Reduce recurring coding flaws
Code review	Find logic/security issues before release
SAST	Analyze source/static code before runtime
DAST	Test running application from outside
IAST	Runtime testing with instrumentation
SCA	Find vulnerable third-party dependencies
Fuzzing	Send malformed/random inputs to find crashes
CI/CD security	Automate tests, signing, approvals
Secrets scanning	Detect credentials in code/repos
IaC scanning	Detect insecure infrastructure templates
Container image scanning	Find vulnerable packages/configs
SBOM	Inventory software components

Container and Virtualization Security

Risk	Control
Vulnerable image	Use trusted base images, scan images
Container escape	Patch host/runtime, least privilege
Excessive container permissions	Drop capabilities, avoid privileged mode
Hardcoded secrets	Secrets manager, environment controls
Lateral movement	Network policies, segmentation
Untrusted registry	Signed images, private registry
Hypervisor compromise	Patch hypervisor, isolate management plane
VM sprawl	Inventory, lifecycle management

Zero Trust

Zero Trust is a security model, not one product.

Principle	Practical meaning
Verify explicitly	Use identity, device health, location, risk, and context
Least privilege	Grant only required access
Assume breach	Segment, monitor, and limit lateral movement
Continuous evaluation	Reassess trust during the session
Strong telemetry	Collect logs and signals for detection

Trap: A VPN alone is not Zero Trust. VPNs often grant broad network access after connection.

Resilience and availability

Concept	Meaning
Redundancy	Duplicate components to avoid single points of failure
Load balancing	Distributes traffic across systems
Clustering	Multiple systems operate together for availability/performance
Failover	Switches to backup system when primary fails
Backup	Copy of data for restoration
Snapshot	Point-in-time state, often fast but not a full backup strategy
Replication	Copies data to another system/location
RTO	Maximum acceptable time to restore service
RPO	Maximum acceptable data loss measured in time
MTTR	Average time to repair/recover
MTBF	Average time between failures

Decision rule: If the question asks how much data loss is acceptable, think RPO. If it asks how long the service can be down, think RTO.

Cloud and shared responsibility

Layer/question	Usually consider
Physical data center security	Cloud provider in public cloud
Customer data classification	Customer
IAM permissions	Customer, configured within provider tools
Guest OS patching in IaaS	Customer
Application security in PaaS	Customer still owns application logic
SaaS user access and data	Customer manages users, roles, and data use
Hypervisor maintenance	Provider in typical public cloud models
Network security configuration	Shared depending on service model

Trap: Moving to cloud does not remove the need for logging, IAM governance, encryption decisions, backups, and incident response planning.

IaaS, PaaS, SaaS

Model	Customer manages more of…	Provider manages more of…
IaaS	OS, apps, data, identity config	Physical hardware, virtualization platform
PaaS	App code, data, access	Runtime, middleware, infrastructure
SaaS	Users, data, configuration	Application and underlying infrastructure

Containers and serverless

Area	Review point
Container images	Use trusted base images and scan for vulnerabilities
Secrets	Do not bake secrets into images or code repositories
Runtime	Limit privileges, isolate workloads, monitor behavior
Orchestration	Secure cluster API, RBAC, network policies
Serverless	Secure permissions, input validation, dependencies, logging
CI/CD	Protect pipelines because they can deploy trusted code at scale

Secure SDLC essentials

Phase/activity	Security focus
Requirements	Security and privacy requirements
Design	Threat modeling, architecture review
Development	Secure coding, code review
Build	Dependency scanning, secrets detection
Test	SAST, DAST, fuzzing, abuse cases
Deploy	Secure configuration, IaC scanning
Operate	Monitoring, patching, incident response
Retire	Data retention and secure disposal

Testing types

Test	What it examines
SAST	Source/static code without running app
DAST	Running application from outside
IAST	Runtime analysis with instrumentation
Fuzzing	Unexpected/random inputs
Dependency scan	Vulnerable third-party libraries
Secret scan	Exposed keys, tokens, passwords
Manual code review	Logic flaws and context-specific issues

Trap: SAST may find code-level issues early, but it may miss runtime/configuration issues. DAST can find runtime behavior but usually sees less internal code detail.

Data protection

Technique	Best use
Encryption	Protects confidentiality at rest/in transit
Hashing	Verifies integrity; stores password-derived values
Tokenization	Replaces sensitive value with token
Masking	Hides part of data from users/displays
Anonymization	Removes identifying links where feasible
Pseudonymization	Replaces identifiers but can potentially be re-linked
DLP	Detects/blocks sensitive data movement
Classification	Labels data by sensitivity/handling need
Retention policy	Defines how long data is kept
Secure destruction	Prevents recovery after disposal

Data Security and Privacy

Data States and Controls

Data state	Meaning	Best controls
At rest	Stored on disk/database/object storage	Encryption, access control, backups
In transit	Moving across network	TLS, VPN, secure protocols
In use	Being processed in memory/app	Access controls, secure enclaves where applicable, memory protection
In processing	Actively transformed/analyzed	Least privilege, monitoring, masking
In disposal	End of lifecycle	Sanitization, destruction, retention policy

Notes and examples

Data Classification

Classification	Typical handling
Public	Approved for general release
Internal	For organization use; not public
Confidential	Restricted business/sensitive data
Restricted/Highly confidential	Highest sensitivity; strict access and monitoring
Regulated data	Governed by legal/contractual obligations

Data Protection Techniques

Technique	Use	Trap
Encryption	Protect confidentiality	Key management is critical
Hashing	Integrity verification	Not reversible
Tokenization	Replace sensitive value with token	Requires token vault or mapping system
Masking	Hide part/all of data	Often for display/test use
Anonymization	Remove identifiers	Hard to reverse if done well
Pseudonymization	Replace identifiers but mapping may exist	Re-identification possible
DLP	Detect/prevent data exfiltration	Needs tuning to reduce false positives
DRM/IRM	Control document usage	Can restrict copy/print/forward
Watermarking	Trace ownership/leaks	Does not prevent copying by itself
Geofencing	Restrict by location	Context signal, not sole control
Retention policy	Defines how long to keep data	Over-retention increases risk
Secure disposal	Prevent data recovery	Shred, wipe, degauss, destroy as appropriate

Data Loss Prevention Placement

Placement	Monitors	Best for
Endpoint DLP	User devices	USB, local copy, print, endpoint exfiltration
Network DLP	Network traffic	Email/web uploads, unencrypted outbound traffic
Storage/Discovery DLP	Repositories	Finding sensitive data at rest
Cloud/SaaS DLP	Cloud apps	Sharing controls, SaaS data movement

Vulnerability Management and Hardening

Vulnerability Management Workflow

    flowchart LR
	    A[Inventory assets] --> B[Scan and discover]
	    B --> C[Validate findings]
	    C --> D[Prioritize risk]
	    D --> E[Remediate or mitigate]
	    E --> F[Verify fix]
	    F --> G[Report and improve]

Notes and examples

Scan and Test Types

Type	Purpose	Key distinction
Vulnerability scan	Finds known weaknesses	Can be credentialed or non-credentialed
Credentialed scan	Authenticated local checks	More accurate; sees patch/config state
Non-credentialed scan	External perspective	Shows exposed services
Penetration test	Exploits to prove impact	Authorized, goal-based
Red team	Adversary simulation	Tests detection/response too
Blue team	Defenders	Monitor and respond
Purple team	Collaborative red + blue	Improves controls and detection
Bug bounty	External researchers report flaws	Requires scope and rules
Compliance scan	Checks against baseline/regulation	Passing compliance is not full security
Configuration review	Examines settings	Finds insecure defaults/misconfigs

Remediation Decision Table

Finding	Preferred action
Patch available and low disruption	Patch
Patch unavailable	Mitigate with compensating controls
False positive	Document validation and suppress carefully
Business accepts risk	Record risk acceptance with owner
Legacy system cannot be changed	Segment, monitor, restrict access
Internet-exposed critical vulnerability	Prioritize immediate remediation
Vulnerability on low-value isolated asset	Prioritize based on risk, not score alone

Hardening Checklist

Area	High-yield actions
OS	Patch, disable unused services, remove default accounts, enforce least privilege
Network device	Change defaults, secure management plane, disable insecure protocols, backup configs
Application	Secure headers, input validation, least privilege service accounts, dependency updates
Database	Restrict network access, encrypt sensitive fields, audit queries, least privilege
Endpoint	EDR, host firewall, disk encryption, application control, patching
Mobile	MDM, screen lock, encryption, remote wipe, app control
Cloud	Least privilege IAM, no public storage by default, logging, encryption, guardrails
Wireless	WPA3/WPA2-Enterprise, strong authentication, rogue AP detection
IoT/OT	Segment, change defaults, monitor, patch carefully, account for safety/uptime

Secure Baselines

Item	Purpose
Standard image	Consistent secure build
Configuration baseline	Defines approved settings
Drift detection	Finds unauthorized changes
GPO/MDM policy	Enforces endpoint configuration
CIS-style benchmark concept	Prescriptive hardening guidance
Exception process	Documents approved deviations

Practical workflow

    flowchart LR
	    A[Discover assets] --> B[Scan or assess]
	    B --> C[Validate findings]
	    C --> D[Prioritize risk]
	    D --> E[Remediate or mitigate]
	    E --> F[Rescan and verify]
	    F --> G[Document exceptions]

Prioritization factors

Do not rely only on a severity label. Prioritize using context.

Factor	Why it matters
Exploitability	A critical flaw with active exploitation moves up
Exposure	Internet-facing systems usually carry higher urgency
Asset criticality	Business-critical or sensitive-data systems matter more
Compensating controls	Segmentation or WAF may reduce immediate risk
Patch availability	Fixable issues can move quickly
Business impact	Downtime risk may affect remediation timing
Regulatory/contractual impact	Sensitive data and obligations may change priority

Trap: A vulnerability scan finding is not always proof of exploitability. Validate false positives before disruptive remediation.

Assessment types

Assessment	Purpose
Vulnerability scan	Finds known weaknesses or misconfigurations
Credentialed scan	More accurate internal view using valid credentials
Penetration test	Attempts exploitation to demonstrate risk
Red team	Goal-based adversary simulation
Blue team	Defenders monitoring and responding
Purple team	Collaboration to improve detection and response
Bug bounty	External researchers report vulnerabilities
Configuration audit	Compares systems to secure baselines

Security Operations

Incident Response Lifecycle

Phase	Goal	Typical actions
Preparation	Be ready before incident	Plans, contacts, tools, training, logging
Detection/Analysis	Confirm and scope	Triage alerts, collect indicators, classify severity
Containment	Limit damage	Isolate host, disable account, block IOC
Eradication	Remove cause	Delete malware, close vulnerability, reset credentials
Recovery	Restore normal operations	Rebuild, restore backup, monitor
Lessons learned	Improve	Post-incident review, update controls/playbooks

Notes and examples

First Response Decision Points

Scenario	First/best action
Active malware spreading	Contain affected systems
Compromised user account	Disable/reset account, revoke sessions/tokens
Suspected disk evidence	Preserve evidence; avoid unnecessary changes
Production web app exploited	Contain traffic, preserve logs, patch after analysis
Ransomware detected	Isolate systems; do not immediately wipe before evidence/scope
Lost mobile device	Remote lock/wipe if policy allows; revoke tokens
Public data leak	Escalate per incident plan; preserve evidence
False positive alert	Document validation and tune detection

Digital Forensics Essentials

Concept	Meaning
Chain of custody	Document who handled evidence, when, and why
Order of volatility	Collect most volatile evidence first
Legal hold	Preserve relevant data for legal/investigative needs
Forensic image	Bit-level copy for analysis
Hash verification	Proves image/evidence integrity
Write blocker	Prevents modification of storage evidence
Timeline analysis	Reconstructs event sequence
E-discovery	Identification/collection of electronically stored information

Order of Volatility Reference

More volatile	Examples
CPU/register/cache	Extremely transient
RAM	Processes, network connections, keys
Network state	Active sessions, ARP/cache
Running processes	Process tree, handles
Disk	Files, logs, artifacts
Backups/archives	Least volatile

Logging and Monitoring

Source	What it helps detect
Authentication logs	Brute force, impossible travel, account misuse
Endpoint logs	Malware, process execution, persistence
Firewall logs	Blocked/allowed traffic, scans, exfiltration paths
DNS logs	Malware C2, domain generation algorithms
Proxy logs	User web activity, data uploads
Email logs	Phishing, spoofing, malware delivery
Cloud audit logs	IAM changes, resource creation, public exposure
Application logs	Errors, auth events, transaction abuse
Database logs	Unusual queries, privilege abuse
NetFlow/metadata	Traffic patterns without full packet payload
Packet capture	Deep investigation of network traffic
Physical access logs	Badge anomalies, facility access

SIEM, SOAR, and Detection Tools

Tool	Purpose	Best clue
SIEM	Aggregate/correlate logs and alerts	Central visibility and alerting
SOAR	Automate response workflows	Playbooks, enrichment, ticketing
EDR	Endpoint detection and response	Process behavior, isolation
XDR	Correlates across endpoint/network/cloud/email	Broader detection integration
NDR	Network detection and response	Suspicious traffic patterns
UEBA	User/entity behavior analytics	Anomalous user/device activity
IDS	Detects suspicious activity	Alerts only
IPS	Blocks suspicious activity	Inline prevention
FIM	File integrity monitoring	Unauthorized file changes
HIDS/HIPS	Host-based detection/prevention	Runs on endpoint/server
NIDS/NIPS	Network-based detection/prevention	Monitors network segments

Common Command-Line Clues

Use commands conceptually on the exam: know what the output would help determine.

## Network connections and listening ports
ss -tulpen
netstat -ano

## DNS troubleshooting
nslookup example.com
dig example.com

## Path and connectivity
ping 10.0.0.5
traceroute example.com
tracert example.com

## Basic packet capture
tcpdump -i eth0 host 10.0.0.5

## File integrity
sha256sum evidence.img

Security Automation Example

trigger: suspicious_login
conditions:
  - impossible_travel: true
  - mfa_failed_count: ">=3"
actions:
  - revoke_sessions
  - require_password_reset
  - open_incident_ticket
  - notify_security_team

Logging and monitoring

Tool/concept	Function
SIEM	Aggregates/correlates logs and alerts
SOAR	Automates response workflows
EDR	Endpoint detection and response
NDR	Network detection and response
XDR	Correlates across multiple telemetry sources
UEBA	Detects unusual user/entity behavior
Syslog	Common log transport format/protocol
NetFlow	Network flow metadata
Packet capture	Detailed network traffic evidence

High-yield log clues:

Clue	Possible meaning
Many failed logins across many users	Password spraying
One user with many password attempts	Brute force against account
Successful login from unusual geography	Account compromise or impossible travel
PowerShell spawning network connections	Possible fileless malware or living-off-the-land
DNS queries to random domains	DGA malware possibility
Repeated 500 errors after special characters in input	Injection testing or exploitation
New admin account outside change window	Privilege escalation or unauthorized change

Incident response sequence

A common practical flow:

    flowchart LR
	    A[Preparation] --> B[Identification]
	    B --> C[Containment]
	    C --> D[Eradication]
	    D --> E[Recovery]
	    E --> F[Lessons learned]

Phase	What it means
Preparation	Policies, tools, contacts, training, playbooks
Identification	Confirm event, determine scope/severity
Containment	Limit damage and spread
Eradication	Remove root cause, malware, persistence
Recovery	Restore normal operations and monitor
Lessons learned	Improve controls, documentation, training

Trap: Do not jump to wiping systems if the question emphasizes evidence preservation or scope identification. In many scenarios, containment and evidence handling come before full remediation.

Evidence and forensics

Concept	Review point
Chain of custody	Tracks who handled evidence, when, and why
Legal hold	Preserves relevant data from alteration/deletion
Order of volatility	Collect most volatile evidence first when appropriate
Imaging	Create forensic copy rather than working on original
Hashing evidence	Verifies evidence integrity
Time synchronization	Makes event timelines reliable
Write blocker	Prevents modification during acquisition

Common volatility order, from more volatile to less volatile:

CPU registers/cache
RAM
Network connections/processes
Disk data
Backups/archives

Endpoint, Mobile, and Email Security

Endpoint Controls

Control	Use
EDR	Detect and respond to endpoint threats
Antivirus/anti-malware	Signature and behavior-based malware protection
Host firewall	Restrict inbound/outbound host traffic
Application allowlisting	Only approved apps execute
Disk encryption	Protect lost/stolen devices
Secure boot	Prevent boot-level tampering
TPM/HSM	Hardware-backed key protection
Patch management	Reduce known vulnerabilities
MDM/UEM	Manage mobile and endpoints
Remote wipe	Protect lost/stolen device data

Notes and examples

Mobile Security

Risk	Control
Lost device	Lock, encryption, remote wipe
Malicious app	App store control, MDM, app vetting
BYOD data mixing	Containerization, MAM
Jailbreak/root	Compliance check, block access
Untrusted Wi-Fi	VPN, avoid auto-join
SMS phishing	Awareness, filtering
Excessive permissions	App permission review

Email Security Controls

Control	Purpose
SPF	Identifies authorized sending servers
DKIM	Cryptographically signs email
DMARC	Policy/reporting using SPF/DKIM alignment
Secure email gateway	Filters spam, malware, phishing
Sandboxing	Detonates suspicious attachments/links
URL rewriting	Checks links at click time
User reporting button	Speeds phishing response
Banner warning	Labels external/suspicious mail

Endpoint hardening

Control	Why it matters
Secure baseline	Standard hardened configuration
Patch management	Reduces known vulnerability exposure
EDR/XDR	Detects and responds to endpoint activity
Host firewall	Limits inbound/outbound traffic
Disk encryption	Protects data if device is lost
Secure boot	Helps prevent boot-level tampering
Application allowlisting	Blocks unauthorized executables
USB/device control	Reduces removable media risk
Local admin restriction	Limits privilege abuse
Centralized logging	Supports detection and investigation

Mobile deployment models

Model	Meaning	Security implication
BYOD	Bring your own device	Harder privacy/control balance
CYOD	Choose your own device	More standardization than BYOD
COPE	Company-owned, personally enabled	Organization owns device, some personal use
COBO	Company-owned, business-only	Strongest organizational control

Mobile controls

Control	Use
MDM	Device enrollment, policy, remote wipe
MAM	Application-level management
Containerization	Separates work and personal data
Remote wipe	Removes data from lost/stolen device
Geofencing	Location-based policy
Screen lock/biometric	Local access protection
Certificate-based Wi-Fi/VPN	Stronger device/user authentication

IoT and OT reminders

Environment	Security challenge
IoT	Weak defaults, limited patching, many devices
OT/ICS	Availability and safety may outweigh rapid patching
Embedded systems	Long lifecycle, limited resources
Medical/industrial devices	Vendor support and maintenance windows matter

Trap: In OT environments, immediately patching or rebooting may be unsafe. Segmentation, monitoring, compensating controls, and planned maintenance may be better first answers.

Governance, Risk, and Compliance

Policy Hierarchy

Document	Role
Policy	High-level management intent
Standard	Mandatory specific requirement
Procedure	Step-by-step instructions
Guideline	Recommended practice
Baseline	Minimum secure configuration
Playbook	Repeatable operational response steps
Runbook	Detailed operational task execution

Notes and examples

Risk Terms

Term	Meaning
Asset	Something of value
Threat	Potential cause of harm
Vulnerability	Weakness that can be exploited
Likelihood	Probability/frequency of event
Impact	Business effect if event occurs
Inherent risk	Risk before controls
Residual risk	Risk remaining after controls
Risk appetite	Amount of risk organization is willing to accept
Risk tolerance	Acceptable variation around appetite
Risk register	Documented list of risks, owners, treatment status
Control	Safeguard that reduces risk
Compensating control	Alternative control when preferred control is not feasible

Risk Response Options

Option	Meaning	Example
Avoid	Stop activity causing risk	Retire vulnerable public service
Mitigate	Reduce likelihood/impact	Patch, segment, add MFA
Transfer	Shift financial/operational impact	Cyber insurance, outsourcing with contract
Accept	Acknowledge and monitor	Business owner signs off residual risk
Share	Distribute responsibility	Joint venture or shared control arrangement

Business Impact and Continuity

Term	Purpose
BIA	Identifies critical processes and impact of disruption
BCP	Keeps business operating during disruption
DRP	Restores IT systems after disruption
COOP	Continuity of operations planning
Tabletop exercise	Discussion-based test of plan
Simulation	More realistic process exercise
Failover test	Validates backup system activation
After-action report	Documents lessons and improvements

Third-Party and Supply Chain Security

Area	What to check
Due diligence	Assess vendor before onboarding
Due care	Ongoing responsible oversight
SLA	Availability/support expectations
MSA/SOW	Contractual services and responsibilities
NDA	Confidentiality obligations
Right to audit	Permission to assess vendor controls
Data processing agreement	Data handling responsibilities
Vendor risk assessment	Security posture and residual risk
SBOM	Software component transparency
Attestation/report	Independent assurance evidence
Offboarding	Data return/destruction, access removal

Awareness and Training

Topic	Exam-relevant purpose
Phishing simulations	Measure and improve user reporting
Role-based training	Tailor content to job risk
Executive training	BEC, whaling, crisis decisions
Developer training	Secure coding and dependency risk
Insider threat training	Reporting and behavioral indicators
Acceptable use	Defines allowed technology behavior
Clean desk	Reduces physical information exposure

Policy hierarchy

Document	Purpose
Policy	High-level management intent
Standard	Mandatory specific requirement
Procedure	Step-by-step instructions
Guideline	Recommended practice
Baseline	Minimum secure configuration
Playbook	Repeatable operational response steps
Runbook	Detailed operational procedure

Trap: If the question asks for a mandatory configuration requirement, “standard” is often better than “guideline.”

Risk management

Term	Meaning
Asset	Something valuable
Threat	Potential cause of harm
Vulnerability	Weakness that can be exploited
Likelihood	Chance of occurrence
Impact	Consequence if it occurs
Inherent risk	Risk before controls
Residual risk	Risk remaining after controls
Risk appetite	Amount of risk organization is willing to accept
Risk register	Documented list of risks and status

Risk response options:

Response	Meaning	Example
Avoid	Stop the risky activity	Decommission vulnerable public service
Mitigate	Reduce likelihood or impact	Patch, segment, monitor
Transfer	Shift financial/operational impact	Insurance, outsourcing contract
Accept	Acknowledge and live with risk	Formal exception for low risk

Business impact and continuity

Item	Purpose
BIA	Identifies critical processes and impact of disruption
BCP	Keeps business operating during disruption
DRP	Restores IT systems after disruption
Tabletop exercise	Discussion-based scenario walkthrough
Simulation	More realistic scenario practice
Failover test	Verifies alternate systems work
Backup test	Confirms data can actually be restored

Trap: A backup that has never been restored is an assumption, not proof of recoverability.

Third-party and supply chain risk

Control/activity	Why it matters
Vendor due diligence	Evaluates security before onboarding
Contract requirements	Defines responsibilities and expectations
SLA	Service performance/availability commitments
Right to audit	Allows verification of controls
SOC reports/attestations	Provide independent control reporting context
Data processing terms	Clarify handling of sensitive data
SBOM	Lists software components and dependencies
Vendor offboarding	Removes access and confirms data return/destruction

Trap: Third-party risk is not eliminated by outsourcing. Accountability for data and access decisions often remains with the organization.

Physical and Environmental Security

Physical Controls

Control	Function
Bollards	Stop vehicles
Fences/gates	Perimeter control
Guards	Deterrent and response
Badges	Identify authorized personnel
Mantrap	Prevent tailgating
Locks	Restrict access
Biometrics	Strong physical authentication
CCTV	Detective/deterrent
Motion sensors	Detect movement
Alarms	Alert on intrusion
Faraday cage	Block electromagnetic signals
Cable locks	Deter equipment theft
Safes	Protect high-value items/media

Environmental Controls

Control	Protects against
HVAC	Heat/humidity problems
Hot/cold aisles	Data center cooling efficiency
Fire detection	Early fire warning
Fire suppression	Fire damage reduction
UPS	Short power interruption
Generator	Longer power outage
PDU	Power distribution
EPO	Emergency power off
Water detection	Leaks/flooding
EMI shielding	Electromagnetic interference

High-Yield “Choose the Best Control” Matrix

If the question says…	Think…
“Prevent unauthorized access after password theft”	MFA
“Limit blast radius after compromise”	Segmentation, least privilege
“Detect unusual user behavior”	UEBA/SIEM
“Automate repetitive incident response”	SOAR
“Protect public web app from injection”	WAF plus secure coding
“Protect data on stolen laptop”	Full-disk encryption
“Verify file integrity”	Hash
“Verify sender and integrity”	Digital signature
“Stop use of exposed hardcoded credentials”	Rotate credentials and use secrets manager
“Employees use unsanctioned SaaS”	CASB
“Find cloud misconfigurations”	CSPM
“Enforce device compliance before network access”	NAC/802.1X
“Reduce phishing success”	Training, filtering, MFA, DMARC
“Recover from ransomware”	Tested offline/immutable backups
“Contain infected host”	Isolate network connection
“Need evidence integrity”	Hash and chain of custody
“Legacy system cannot be patched”	Compensating controls, segmentation, monitoring
“Need temporary admin access”	JIT/PAM
“Need central log correlation”	SIEM
“Need block malicious traffic inline”	IPS
“Need detect without blocking”	IDS
“Need govern privileged accounts”	PAM
“Need prove compliance with configuration”	Baseline scan/audit
“Need assess business process criticality”	BIA
“Need keep business operating”	BCP
“Need restore IT systems”	DRP

Common SY0-701 Exam Traps

Trap	Avoid it by remembering
Confusing encryption and hashing	Encryption is reversible; hashing is not.
Choosing a detective control when asked to prevent	IDS detects; IPS/firewall can block.
Treating MFA as authorization	MFA authenticates; permissions still require authorization.
Assuming cloud provider secures everything	Customer still manages identity, data, configuration, and app choices depending on model.
Overlooking business impact	Security+ scenarios often want the practical control aligned to risk.
Ignoring evidence preservation	In incident questions, contain without destroying evidence.
Choosing wipe/rebuild too early	First identify, contain, and preserve what is needed.
Thinking VLAN alone is security	VLANs need routing/firewall policy enforcement.
Selecting “most secure” over “best fit”	Consider cost, downtime, usability, and requirement wording.
Confusing SAML and OAuth	SAML is federated SSO; OAuth is delegated authorization; OIDC adds authentication.
Assuming backups solve ransomware automatically	Backups must be tested, protected, and not encrypted by attacker.
Treating NAT as a firewall	NAT hides addresses but does not replace access control.
Forgetting deprovisioning	Orphaned accounts are a major IAM risk.
Using shared admin accounts	Breaks accountability and non-repudiation.

Final Review Checklist

Before practice sessions, confirm you can quickly:

Match threats to mitigations without overengineering.
Distinguish preventive, detective, corrective, deterrent, directive, and compensating controls.
Choose between IDS, IPS, SIEM, SOAR, EDR, XDR, NDR, WAF, NAC, CASB, CSPM, and DLP.
Explain hashing, encryption, signatures, certificates, tokenization, masking, and salting.
Identify when to use RBAC, ABAC, federation, PAM, JIT, SSO, and MFA.
Read logs and command outputs conceptually.
Follow incident response order: prepare, detect/analyze, contain, eradicate, recover, learn.
Preserve evidence using chain of custody and hashing.
Connect BIA, BCP, DRP, RTO, and RPO.
Apply risk responses: avoid, mitigate, transfer, accept, share.
Prioritize the answer that best satisfies the scenario objective and constraint.

Notes and examples

Fast final review checklist

Before starting topic drills or a mock exam, confirm you can explain:

Difference between authentication, authorization, and accounting
MFA factor types and common identity protocols
Symmetric encryption, asymmetric encryption, hashing, and digital signatures
PKI certificate validation and revocation basics
Common social engineering, malware, password, and web attacks
Vulnerability management workflow and prioritization
Firewalls, WAF, IDS, IPS, proxies, NAC, VPN, and ZTNA
Secure protocol replacements for insecure services
Zero Trust principles and segmentation
Cloud shared responsibility across IaaS, PaaS, and SaaS
Endpoint, mobile, IoT, and OT security constraints
Secure SDLC, SAST/DAST, dependency scanning, and secrets management
SIEM/SOAR/EDR monitoring and incident response phases
Chain of custody and evidence integrity
RTO, RPO, BIA, BCP, and DRP
Risk responses: avoid, mitigate, transfer, accept
Policy, standard, procedure, guideline, and baseline differences
Third-party and supply chain risk controls

High-yield exam mindset

Security+ questions usually reward practical judgment:

If the question emphasizes…	Think first about…
“Best control”	Control objective, placement, and feasibility
“First step”	Identify, preserve, validate, or contain before fixing
“Most likely attack”	Clues in symptoms, logs, user behavior, or network traffic
“Reduce impact”	Resilience, segmentation, backup, least privilege
“Prevent recurrence”	Root cause, patching, hardening, policy, automation
“Cloud responsibility”	Whether the customer or provider controls that layer
“Compliance/privacy”	Data classification, minimization, retention, access control
“Zero Trust”	Verify explicitly, least privilege, assume breach

Common “best answer” decision rules

Scenario wording	Strong answer pattern
Lost laptop with sensitive data	Full-disk encryption, remote wipe, MDM, incident process
User needs temporary admin rights	PAM, JIT access, approval, logging
Legacy system cannot be patched	Segmentation, compensating controls, monitoring
Web app hit by injection attempts	Parameterized queries and input validation; WAF may help
Need proof data was not altered	Hash or digital signature depending on identity need
Need proof who approved/sent it	Digital signature/non-repudiation
Prevent lateral movement	Segmentation, least privilege, EDR, restrict admin creds
Stop data leaving email/cloud	DLP, classification, access controls
Cloud storage exposed publicly	Correct permissions, policy guardrails, monitoring
Detect unusual insider behavior	UEBA/SIEM correlation
Reduce phishing account takeover	MFA, training, email authentication, conditional access
Protect admin access to network devices	TACACS+/RADIUS, MFA, centralized logging
Secure machine-to-machine API access	Strong auth, least privilege tokens, rotation, mTLS where appropriate
Verify software integrity	Code signing, hashes, trusted repositories
Improve repeatable deployment security	IaC scanning, secure templates, CI/CD controls

Common candidate mistakes

Mistake 1: Choosing the most technical answer automatically

Security+ does not always reward the most advanced tool. If the scenario is about governance, user process, or risk acceptance, a policy, procedure, approval, or risk register entry may be the best answer.

Mistake 2: Confusing detection with prevention

An IDS detects. An IPS can block. A SIEM correlates and alerts. A firewall enforces traffic rules. Read whether the question asks to detect, prevent, respond, or document.

Mistake 3: Ignoring business context

Patching is important, but immediate patching may not be the best answer for a critical OT system, high-availability production service, or system requiring change control.

Mistake 4: Treating encryption as a solution for everything

Encryption protects confidentiality. It does not automatically provide availability, authorization, input validation, or user accountability.

Mistake 5: Missing “first” versus “best long-term”

First: identify, contain, preserve, notify proper internal roles, follow procedure.
Best long-term: remediate root cause, improve controls, automate, train, monitor.

Mistake 6: Overlooking least privilege

When two answers both work, the one that grants less access, narrows scope, or reduces blast radius is often better.

Performance-based question review tactics

For interactive or scenario-style questions:

Read the task before the exhibits. Know what you are building, matching, or selecting.
Identify constraints. Look for “least privilege,” “most secure,” “minimum downtime,” or “cost-effective.”
Place controls by layer. Network controls do not fix insecure code; IAM controls do not replace patching.
Use elimination. Remove insecure protocols, overly broad permissions, and answers that solve the wrong problem.
Check for completeness. A partially secure design may miss logging, redundancy, or access control.
Do not overconfigure. If the question asks for one best action, avoid adding assumptions not in the scenario.

Practice focus recommendations

Use this Cheat Sheet to choose your next practice set:

If you struggled with…	Practice next
Definitions blend together	Short topic drills with detailed explanations
Scenario questions feel close	Mixed-domain question bank sets
Timing is a problem	Mock exams with review afterward
You miss “first step” questions	Incident response and governance drills
You miss architecture questions	Network, cloud, and Zero Trust scenarios
You miss attack identification	Threat, log, and vulnerability questions
You miss control selection	Preventive/detective/corrective and risk drills

A practical next step: start with a focused set of original practice questions on your weakest SY0-701 topic, read every detailed explanation, then take a mixed question bank quiz to confirm you can apply the concept outside its original context.

Put the review into practice

Study Plan

SY0-701 — CompTIA Security+ Cheat Sheet

Fast Scenario Reading Method

Core Security Principles

Security Goals and Concepts

Control Categories

Control Function Types

CIA, AAA, and non-repudiation

Security control categories

Threats, Attacks, and Vulnerabilities

Threat Actor Matrix

Malware and Attack Types

Social Engineering Quick Distinctions

Web and Application Attack Reference

Wireless and Network Attacks

Social engineering

Malware and endpoint threats

Application and web attacks

Password and credential attacks

Cryptography and PKI

Crypto Selection Matrix

Hashing, Encryption, Encoding, Obfuscation

PKI Terms

Certificate Format Clues

Crypto Traps

Know the function, not just the term

PKI quick path

Identity and Access Management

Identity Concepts

Authentication Factor Matrix

Access Control Models

IAM Protocols and Standards

Password and Account Policy Traps

Authentication factors

Access control models

Federation and identity protocols

Network Security Reference

Common Ports and Protocols

Network Device Selection

Segmentation Patterns

VPN and Remote Access

Segmentation and traffic control

Secure protocol choices

Common ports worth recognizing

Security Architecture and Design

Secure Architecture Concepts

Availability and Recovery Terms

Cloud and Virtualization

Cloud Exam Traps

Secure Application and DevSecOps

Container and Virtualization Security

Zero Trust

Resilience and availability

Cloud and shared responsibility

IaaS, PaaS, SaaS

Containers and serverless

Secure SDLC essentials

Testing types

Data protection

Data Security and Privacy

Data States and Controls

Data Classification

Data Protection Techniques

Data Loss Prevention Placement

Vulnerability Management and Hardening

Vulnerability Management Workflow

Scan and Test Types

Remediation Decision Table

Hardening Checklist

Secure Baselines

Practical workflow

Prioritization factors

Assessment types

Security Operations

Incident Response Lifecycle

First Response Decision Points

Digital Forensics Essentials

Order of Volatility Reference

Logging and Monitoring

SIEM, SOAR, and Detection Tools

Common Command-Line Clues