SY0-801 — CompTIA Security+ V8 Cheat Sheet

Last revised: September 16, 2026

Cheat sheet for CompTIA Security+ V8 (SY0-801): controls, threats, IAM, crypto, architecture, operations, and governance.

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

Scope and study context

Security+ questions often test whether you can choose the best control, next step, root cause, or most likely attack in a short scenario. Memorization helps, but the exam rewards practical judgment: protect confidentiality, integrity, and availability; reduce risk; preserve evidence; and select controls that fit the business and technical context.

Security Foundations

CIA, AAA, and Non-Repudiation

Concept	Meaning	Exam cue	Common control examples
Confidentiality	Prevent unauthorized disclosure	“Protect sensitive data from being viewed”	Encryption, access control, data masking
Integrity	Prevent unauthorized modification	“Detect tampering” or “ensure data is unchanged”	Hashing, digital signatures, file integrity monitoring
Availability	Ensure systems/data are usable when needed	“Minimize downtime”	Redundancy, backups, clustering, DDoS protection
Identification	Claiming an identity	Username, account ID, certificate subject	User ID, device ID
Authentication	Proving identity	“Verify who the user is”	Password, MFA, certificate, Kerberos
Authorization	Granting permissions	“What can the user access?”	RBAC, ABAC, ACLs
Accounting	Tracking actions	“Who did what and when?”	Logs, audit trails, SIEM
Non-repudiation	Prevent denying an action	“Prove sender/action later”	Digital signatures, timestamping, signed logs

Notes and examples

Control Categories and Functions

Dimension	Options	How to recognize
Control category	Managerial, operational, technical, physical	Managerial = policy/risk; operational = people/process; technical = systems; physical = facilities
Control function	Preventive, detective, corrective, deterrent, compensating, directive	Prevent = stop; detect = alert; correct = restore; deter = discourage; compensate = alternative; direct = require behavior
Security model	Zero trust, defense in depth, least privilege, separation of duties	Zero trust = verify continuously; defense in depth = layered controls; least privilege = only required access; SoD = split critical tasks

High-Yield Security Principles

Principle	Practical meaning	Trap
Least privilege	Grant only needed permissions	“Admin by default” violates it
Need to know	Access based on business need	Different from clearance alone
Defense in depth	Multiple overlapping controls	Not one “perfect” control
Secure by design	Build security into architecture	Not added only after deployment
Fail secure	Failure leaves system protected	Not the same as fail open
Default deny	Block unless explicitly allowed	Stronger baseline than allow by default
Implicit deny	Unmatched traffic/access is denied	Common in firewalls and ACLs
Separation of duties	Split sensitive responsibilities	Reduces fraud and single-person abuse
Job rotation	Rotate roles to detect abuse and reduce dependency	Not primarily an access-control model
Dual control	Two people required for one action	Stronger than review after the fact

Control Categories

Category	What it is	Examples
Administrative	Policies, procedures, governance	Security policy, training, background checks
Technical	Technology-enforced controls	Firewall, MFA, EDR, encryption
Physical	Protect facilities and hardware	Locks, guards, cameras, mantraps

Control Functions

Function	Purpose	Example
Preventive	Stop an event before it happens	ACL, firewall rule, least privilege
Detective	Identify that something happened	IDS, SIEM alert, audit log
Corrective	Restore after an event	Patch, restore from backup
Deterrent	Discourage behavior	Warning banner, camera
Compensating	Alternative control when primary is not feasible	Extra monitoring for legacy system
Directive	Tell people what to do	Policy, standard, procedure

Quick trap: A control can belong to more than one idea depending on context. A camera may be detective if used to review footage, deterrent if visible, and physical because of the control category.

Risk, Governance, and Compliance

Risk Terms

Term	Meaning	Exam cue
Asset	Something valuable	Data, system, facility, reputation
Threat	Potential cause of harm	Attacker, storm, insider, malware
Vulnerability	Weakness that can be exploited	Unpatched service, weak password
Risk	Likelihood and impact of threat exploiting vulnerability	“What could happen?”
Inherent risk	Risk before controls	Baseline exposure
Residual risk	Risk remaining after controls	Must be accepted, transferred, avoided, or mitigated
Risk appetite	Amount of risk organization is willing to accept	Strategic tolerance
Risk tolerance	Acceptable variation around appetite	Operational threshold
Control	Safeguard that reduces risk	Preventive, detective, corrective, etc.
Compensating control	Alternative control when preferred control is not feasible	Used to meet intent, not identical method

Notes and examples

Risk Response Decisions

Response	Choose when	Example
Mitigate	Reduce likelihood or impact	Patch, segment, encrypt
Avoid	Stop the risky activity	Decommission vulnerable public service
Transfer	Shift financial/operational impact	Cyber insurance, outsourced service with contractual responsibility
Accept	Residual risk is within tolerance	Documented risk acceptance
Escalate	Risk exceeds local authority	Send to risk owner or executive committee

Risk Formulas

Use these for exam math-style scenarios. Values are usually provided in the question.

\[ \text{SLE} = \text{Asset Value} \times \text{Exposure Factor} \]\[ \text{ALE} = \text{SLE} \times \text{Annualized Rate of Occurrence} \]\[ \text{Risk} = \text{Likelihood} \times \text{Impact} \]

Formula item	Meaning
AV	Asset value
EF	Percent loss from one event
SLE	Single loss expectancy
ARO	Expected frequency per year
ALE	Annualized loss expectancy
RTO	Maximum acceptable time to restore service
RPO	Maximum acceptable data loss measured in time
MTD / MAO	Maximum tolerable downtime/outage
MTTR	Mean time to repair/recover
MTBF	Mean time between failures

Policy and Governance Artifacts

Artifact	Purpose	Trap
Policy	High-level mandatory rule	Says what/why, not every step
Standard	Specific mandatory requirement	Example: encryption algorithm standard
Procedure	Step-by-step instructions	Operational “how to”
Guideline	Recommended practice	Usually not mandatory
Baseline	Minimum secure configuration	Used for consistent hardening
SLA	Service performance commitment	Availability/support expectations
MOU/MOA	Agreement between parties	Often less formal than contract
BPA	Blanket purchase agreement	Procurement arrangement
NDA	Confidentiality agreement	Protects shared sensitive information
AUP	Acceptable use policy	Defines permitted/prohibited use
BIA	Business impact analysis	Determines criticality, RTO/RPO
Risk register	Tracks risks, owners, status	Living governance document

Policy and Documentation

Document	Purpose
Policy	High-level management intent
Standard	Mandatory specific requirement
Procedure	Step-by-step instructions
Guideline	Recommended practice
Baseline	Minimum secure configuration
AUP	Acceptable use of systems
NDA	Confidentiality agreement
SLA	Service performance expectations
MOU/MOA	Agreement between parties
BPA	Business partnership agreement

Third-Party and Supply Chain Risk

Review area	What to check
Vendor due diligence	Security posture before onboarding
Contract terms	Security requirements, audit rights, breach notification
Data access	Minimum necessary access
Fourth-party risk	Vendor’s vendors
Software supply chain	Dependencies, signing, SBOM, repository security
Ongoing monitoring	Reassess risk over time
Offboarding	Remove access and return/destroy data

Personnel Security

Control	Purpose
Background checks	Reduce hiring risk where appropriate
Onboarding	Assign correct access and training
Offboarding	Remove access promptly
User training	Reduce human risk
Role changes	Update access when duties change
Insider threat program	Detect and manage misuse risk

Threats and Attacks

Attack	Key indicator	Best defense
Phishing	Broad fraudulent email/message	Awareness, filtering, reporting, MFA
Spear phishing	Targeted phishing	User training, email security, verification
Whaling	Targets executives	Executive awareness, payment verification
Vishing	Voice phishing	Call-back procedures
Smishing	SMS phishing	Mobile awareness, link protection
Pretexting	Fabricated scenario	Identity verification
Baiting	Enticing item/link/media	Removable media controls
Tailgating	Following authorized person	Mantraps, badges, awareness
Shoulder surfing	Observing screens/keystrokes	Privacy filters, clean desk
Impersonation	Pretending to be trusted party	Challenge-response, verification
Invoice scam	Fraudulent payment request	Dual approval, vendor validation

Notes and examples

Malware and Host-Based Threats

Threat	What it does	High-yield distinction
Virus	Attaches to files; requires execution	Needs host file or user action
Worm	Self-replicates over networks	Does not need file attachment
Trojan	Appears legitimate but malicious	Often installs backdoor
Ransomware	Encrypts/exfiltrates data for extortion	Backups and segmentation are critical
Spyware	Collects information covertly	Privacy/data theft focus
Keylogger	Captures keystrokes	Credential theft
Rootkit	Hides privileged compromise	Hard to detect; may require rebuild
Logic bomb	Triggers on condition/date	Insider threat cue
Botnet	Compromised hosts controlled centrally	DDoS/spam/credential attacks
Fileless malware	Uses memory/native tools	EDR, script controls, logging
PUP/PUA	Potentially unwanted program/app	May be grayware, not always overt malware

Password and Credential Attacks

Attack	Description	Better defense
Brute force	Tries many combinations	MFA, lockout/rate limiting, strong passwords
Dictionary	Uses wordlists	Block common passwords, password managers
Password spraying	Tries few common passwords across many users	MFA, detection by distributed failures
Credential stuffing	Reuses breached credentials	MFA, breached-password checks
Pass-the-hash	Uses captured hash without cracking	Credential Guard-like controls, limit admin reuse
Kerberoasting	Targets Kerberos service tickets	Strong service account passwords, gMSA-like practices
Rainbow table	Precomputed hash lookup	Salting, modern hashing
Offline cracking	Attacker has password database/hash	Strong hashing/KDF, salting, peppering

Network Attacks

Attack	Symptom	Mitigation
DoS/DDoS	Service unavailable from traffic flood	DDoS protection, rate limiting, CDN, filtering
On-path/MITM	Intercepted or altered traffic	TLS, certificate validation, VPN, secure Wi-Fi
ARP poisoning	Local network traffic redirection	Dynamic ARP inspection, segmentation
DNS poisoning	Wrong DNS responses	DNSSEC, secure resolvers, monitoring
DHCP starvation	Exhausts leases	DHCP snooping, port security
Rogue DHCP	Malicious IP configuration	DHCP snooping
VLAN hopping	Access to unauthorized VLAN	Disable unused ports, avoid native VLAN exposure
Evil twin	Fake Wi-Fi AP	WPA3/WPA2-Enterprise, certificate validation
Deauthentication	Wi-Fi disconnection attack	Protected management frames where supported
Replay	Captured valid data resent	Nonces, timestamps, session tokens
Session hijacking	Attacker takes active session	Secure cookies, TLS, token rotation

Web and Application Attacks

Attack	What to look for	Primary mitigation
SQL injection	User input changes database query	Parameterized queries, input validation
Command injection	Input executes OS command	Avoid shell calls, sanitize input, least privilege
XSS	Script runs in user browser	Output encoding, CSP, input validation
CSRF	User’s browser submits unwanted action	CSRF tokens, SameSite cookies
SSRF	Server fetches attacker-chosen internal URL	Egress filtering, metadata protection, allowlists
Path traversal	`../` accesses unauthorized files	Canonicalization, allowlists, permissions
Directory listing	Exposes files	Disable listing, proper web config
Insecure deserialization	Malicious object triggers code/logic	Safe formats, validation, signing
Race condition	Timing changes outcome	Locking, atomic operations
API abuse	Excessive/unauthorized API calls	AuthZ, rate limits, schema validation
IDOR	Access by changing object ID	Object-level authorization
Buffer overflow	Memory overwrite	Memory-safe languages, bounds checking, ASLR/DEP

Threat Actor Types

Actor	Motivation	Typical capability
Script kiddie	Curiosity/status	Uses existing tools
Hacktivist	Ideology	Defacement, leaks, DDoS
Insider	Revenge, money, negligence	Trusted access
Organized crime	Financial gain	Phishing, ransomware, fraud
Nation-state/APT	Espionage/disruption	Persistent, well-resourced
Competitor	Business advantage	IP theft, intelligence
Shadow IT user	Convenience	Unapproved systems/services

Attack	Key clues	Best defenses
Phishing	Broad fraudulent email	Awareness, filtering, reporting, MFA
Spear phishing	Targeted phishing	Training, verification process, anti-spoofing controls
Whaling	Targets executives	Executive training, payment verification
Vishing	Voice-based deception	Call-back procedures, help desk scripts
Smishing	SMS-based deception	User awareness, mobile security
Pretexting	Fabricated scenario	Verification and least disclosure
Baiting	Enticing user with reward/media	Device control, training
Tailgating	Following authorized person	Badges, mantraps, challenge culture

Malware and Host-Based Threats

Threat	What to recognize
Virus	Attaches to files and needs user/system action
Worm	Self-propagates across networks
Trojan	Disguises malicious function as legitimate software
Ransomware	Encrypts or exfiltrates data for extortion
Rootkit	Hides privileged compromise
Keylogger	Captures keystrokes
Spyware	Monitors user activity
Logic bomb	Triggers on condition/date
Fileless malware	Uses memory and legitimate tools
Botnet	Compromised systems controlled by attacker

Network Attacks

Attack	Symptom or clue	Defensive focus
DDoS	Service exhaustion from many sources	DDoS protection, rate limiting, CDN
DNS poisoning	Users redirected to wrong IP	DNSSEC, secure DNS configuration
ARP spoofing	LAN traffic redirected through attacker	Dynamic ARP inspection, segmentation
Evil twin	Fake Wi-Fi access point	WPA3/WPA2-Enterprise, certificate validation
Rogue AP	Unauthorized access point	Wireless scans, NAC
On-path attack	Attacker intercepts traffic	TLS, VPN, certificate validation
Replay attack	Captured valid traffic reused	Nonces, timestamps, session protection
VLAN hopping	Unauthorized VLAN access	Disable trunking, native VLAN controls
MAC flooding	Switch CAM table exhaustion	Port security
Credential stuffing	Reused credentials tried at scale	MFA, rate limiting, password monitoring
Password spraying	Few common passwords across many accounts	Lockout strategy, MFA, monitoring

Application and Web Attacks

Attack	Core issue	Prevention
SQL injection	Untrusted input alters database query	Parameterized queries, input validation
Command injection	Input executes OS commands	Input validation, safe APIs, least privilege
XSS	Malicious script runs in user browser	Output encoding, CSP, input validation
CSRF	User is tricked into submitting authenticated request	Anti-CSRF tokens, SameSite cookies
SSRF	Server is tricked into requesting internal resource	Allow lists, metadata protection
Directory traversal	Input accesses unauthorized paths	Canonicalization, input validation
Insecure deserialization	Serialized data triggers code/object abuse	Avoid unsafe deserialization, integrity checks
Buffer overflow	Memory overwritten	Bounds checking, memory protections
Race condition	Timing flaw changes outcome	Locking, atomic operations
API abuse	Weak auth, rate limits, validation	API gateway, auth, throttling, schema validation

Injection decision rule: If user-controlled input changes the meaning of a command, query, or interpreter instruction, think injection.

Vulnerability Management and Testing

Assessment Types

Activity	Goal	Permission level	Output
Vulnerability scan	Find known weaknesses	Authorized	Findings list
Vulnerability assessment	Validate and prioritize weaknesses	Authorized	Risk-ranked remediation plan
Penetration test	Exploit to prove impact	Authorized, scoped	Exploit evidence and recommendations
Red team	Test detection/response against realistic adversary	Authorized, often stealthy	Operational security gaps
Blue team	Defend and respond	Internal defensive role	Improved detection/response
Purple team	Collaborative red + blue improvement	Joint	Tuned controls and lessons
Bug bounty	External researchers report flaws	Program-defined	Validated reports

Notes and examples

Scan and Test Distinctions

Option	Choose when	Tradeoff
Credentialed scan	Need deeper, more accurate host findings	Requires safe credential handling
Non-credentialed scan	External attacker perspective	More false negatives
Agent-based scan	Roaming or intermittently connected endpoints	Agent management overhead
Agentless scan	Network-visible assets	May miss offline/segmented systems
Passive scan	Avoid disrupting sensitive networks	Less complete
Active scan	Need direct validation	Can disrupt fragile systems
Static testing	Analyze code without running it	Earlier in SDLC
Dynamic testing	Test running application	Finds runtime behavior
Fuzzing	Send unexpected inputs	Good for crash/input handling defects

Vulnerability Remediation Prioritization

Prioritize using more than severity alone:

Internet exposure.
Known exploitation in the wild.
Business criticality.
Data sensitivity.
Privilege level affected.
Ease of exploitation.
Compensating controls.
Patch availability and operational risk.

Finding	Likely first action
Critical internet-facing RCE with known exploitation	Emergency patch or isolate
Unsupported OS on isolated lab system	Plan replacement, segment, document risk
Weak cipher on internal admin interface	Update configuration, verify compatibility
Missing patch on fragile OT device	Test patch, apply maintenance window, use segmentation if patch delayed
False positive	Document evidence and suppress/tune appropriately

Standard Workflow

    flowchart LR
	    A[Inventory assets] --> B[Scan and collect findings]
	    B --> C[Validate findings]
	    C --> D[Prioritize by risk]
	    D --> E[Remediate or mitigate]
	    E --> F[Verify fix]
	    F --> G[Report and improve]

Scanning and Testing

Method	Purpose	Trap
Non-credentialed scan	External view with limited insight	May miss local misconfigurations
Credentialed scan	Authenticated view of system state	Requires secure credential handling
Agent-based scan	Local continuous visibility	Agent deployment and coverage matter
Passive scan	Observes traffic without probing	May miss inactive systems
Penetration test	Demonstrates exploitability and impact	Not the same as a routine vulnerability scan
Red team	Tests detection and response against realistic attacker behavior	Broader than finding CVEs
Bug bounty	External researchers report issues	Requires scope and triage process

Prioritization Factors

Prioritize using more than a severity label. Consider:

Exploitability in the current environment
Asset criticality
Internet exposure
Data sensitivity
Known active exploitation
Compensating controls
Business impact of remediation
Availability of patches or mitigations

Common trap: The highest numeric vulnerability score is not always the first patch if a lower-scored issue is actively exploited on a public-facing critical system.

Identity and Access Management

Authentication Factors

Factor	Examples	Trap
Something you know	Password, PIN	Security questions are also knowledge
Something you have	Token, smart card, phone app	SMS is weaker than app/hardware token
Something you are	Fingerprint, face, iris	Biometric cannot be “changed” like password
Somewhere you are	Geolocation, network location	Usually contextual, not standalone strong factor
Something you do	Typing pattern, behavior	Behavioral biometrics

Notes and examples

MFA means using factors from different categories. Two passwords are not MFA.

Access Control Models

Model	Who controls access?	Best fit	Trap
DAC	Data owner	Flexible file sharing	Owner can grant access
MAC	Central authority/classification	Military/high-security labels	Users cannot override labels
RBAC	Role/job function	Enterprise access at scale	Role explosion if poorly designed
ABAC	Attributes and policies	Dynamic/cloud/zero trust	More complex policy design
Rule-based	System rules	Firewalls, time-based access	Often confused with RBAC
PBAC	Policy-based decisions	Centralized fine-grained control	Often implemented with attributes

IAM Technologies

Technology	Primary purpose	Exam distinction
LDAP	Directory access protocol	Queries directory services
Kerberos	Ticket-based authentication	Uses KDC/TGT/service tickets
RADIUS	AAA for network access	Common for VPN/Wi-Fi; UDP-based
TACACS+	Device administration AAA	Separates authN/authZ/accounting; TCP-based
SAML	Federated SSO using XML assertions	Common enterprise browser SSO
OAuth 2.0	Delegated authorization	“Allow app to access resource”
OpenID Connect	Identity layer on OAuth 2.0	Authentication/identity tokens
SCIM	Identity provisioning/deprovisioning	Automates user lifecycle
FIDO2/WebAuthn	Phishing-resistant authentication	Public-key based, passwordless-capable
PAM	Controls privileged accounts	Vaulting, session recording, JIT access

Privileged Access Controls

Control	What it solves
Just-in-time access	Reduces standing privilege
Just-enough access	Grants only specific admin capability
Privileged session management	Records/monitors admin sessions
Password vaulting	Protects shared/admin secrets
Break-glass account	Emergency access with monitoring
Separate admin accounts	Reduces risk from daily-use compromise
Service account governance	Prevents unmanaged persistent privilege

Authentication Factors

Factor	Description	Examples
Something you know	Secret knowledge	Password, PIN
Something you have	Physical or digital possession	Smart card, hardware token, authenticator app
Something you are	Biometric trait	Fingerprint, face, iris
Somewhere you are	Location context	Geolocation, network zone
Something you do	Behavioral pattern	Typing cadence, gesture pattern

MFA requires different factor types. A password plus a PIN is not strong MFA because both are “something you know.”

Access Control Models

Model	Key idea	Best fit
DAC	Owner controls access	Small environments, file ownership
MAC	System-enforced labels	High-security classified environments
RBAC	Access based on role	Enterprise job functions
ABAC	Access based on attributes and context	Dynamic access decisions
Rule-based	Access follows configured rules	Firewall rules, time-based access

Account and Privilege Controls

Control	Why it matters
Least privilege	Users and services get only required access
Just-in-time access	Privilege granted temporarily when needed
Privileged access management	Controls and monitors admin accounts
Separation of duties	Prevents one person from completing sensitive actions alone
Job rotation	Helps detect fraud and reduces dependency
Mandatory vacation	Can expose hidden fraud or misuse
Account recertification	Confirms access is still appropriate
Deprovisioning	Removes access when users leave or change roles

Federation and SSO

Term	Review meaning
SSO	One authentication event grants access to multiple services
Federation	Trust relationship between identity provider and service provider
SAML	Common XML-based enterprise federation protocol
OAuth	Authorization framework for delegated access
OIDC	Authentication layer built on OAuth 2.0
Kerberos	Ticket-based authentication in many enterprise networks
RADIUS	Centralized authentication often used for VPN, Wi-Fi, network access
TACACS+	Device administration authentication, authorization, and accounting

Common trap: OAuth is commonly about delegated authorization. If the question is about proving user identity to an application, OIDC is usually the closer answer.

Network Security

Network Zones and Segmentation

Zone/pattern	Purpose	Common controls
DMZ	Hosts public-facing services	Firewalls, reverse proxy, WAF
Internal LAN	User and business systems	NAC, segmentation, EDR
Management network	Admin interfaces	MFA, bastion host, allowlists
Guest network	Untrusted visitor access	Internet-only, client isolation
OT/ICS network	Industrial/control systems	Strict segmentation, monitoring, change control
Extranet	Partner access	VPN/ZTNA, least privilege
Cloud VPC/VNet	Cloud network boundary	Security groups, route tables, NACLs
Microsegmentation	Workload-level isolation	Identity-aware policies, east-west filtering

Notes and examples

Security Device Selection

Control	Best for	Not best for
Stateless firewall	Simple packet filtering	App-aware decisions
Stateful firewall	Connection-aware filtering	Deep application attacks
NGFW	App/user-aware filtering	Replacing secure coding
WAF	HTTP/HTTPS application attacks	Non-web protocols
IDS	Detect and alert	Blocking by itself
IPS	Inline blocking	Passive-only monitoring
NDR	Network detection and response	Endpoint-only visibility
EDR	Endpoint detection/response	Network-only unmanaged devices
XDR	Correlated detection across tools	Substitute for good telemetry
Proxy	Intermediary control and filtering	Full endpoint control
Reverse proxy	Protect/publish backend services	User endpoint inspection
Load balancer	Distribute traffic, improve availability	Security control by default unless configured
VPN	Encrypted tunnel	Fine-grained app-only access by itself
ZTNA	App-specific identity-aware access	Legacy full-network access needs
NAC	Control device network admission	Application-layer authorization
CASB	Cloud app visibility/control	On-prem-only traffic
DLP	Detect/prevent data leakage	Asset inventory by itself

Common Ports and Protocols

Protocol/service	Port(s)	Security note
FTP	20/21	Avoid for sensitive data; use secure alternatives
SSH/SFTP/SCP	22	Secure remote admin/file transfer
Telnet	23	Insecure; avoid
SMTP	25	Mail transfer
DNS	53	UDP/TCP; protect against poisoning/tunneling
DHCP	67/68	Use snooping/segmentation
HTTP	80	Unencrypted web
Kerberos	88	Ticket-based auth
POP3	110 / 995	995 uses TLS
NTP	123	Important for logs/auth; secure time sources
IMAP	143 / 993	993 uses TLS
SNMP	161/162	Prefer SNMPv3
LDAP	389	Directory protocol
HTTPS	443	HTTP over TLS
SMB	445	File sharing; high-value lateral movement target
LDAPS	636	LDAP over TLS
Syslog	514 / 6514	6514 commonly TLS-protected
RADIUS	1812/1813	AAA
TACACS+	49	Device admin AAA
RDP	3389	Protect with VPN/ZTNA/MFA; avoid public exposure

Wireless Security

Standard/control	Meaning	Exam cue
WPA2-Personal	Pre-shared key	Home/small office
WPA2/WPA3-Enterprise	802.1X authentication	Enterprise Wi-Fi with RADIUS
SAE	WPA3 password-authenticated key exchange	Better than WPA2-PSK handshake
Captive portal	Web-based acceptance/login	Not strong encryption by itself
MAC filtering	Allows listed MACs	Weak; MACs can be spoofed
WPS	Easy setup PIN/button	Disable where possible
Site survey	Identify signal/interference/rogue APs	Wireless planning/security

Common Ports and Protocols

Protocol	Port(s)	Review use
FTP	20/21	Insecure file transfer
SSH / SFTP	22	Secure remote administration / file transfer
Telnet	23	Insecure remote terminal
SMTP	25	Mail transfer
DNS	53	Name resolution
DHCP	67/68	Dynamic addressing
HTTP	80	Web traffic, not encrypted
Kerberos	88	Ticket-based authentication
POP3	110	Mail retrieval
NTP	123	Time synchronization
IMAP	143	Mail access
SNMP	161/162	Network management and traps
LDAP	389	Directory services
HTTPS	443	HTTP over TLS
SMB	445	Windows file sharing
SMTPS / submission	465/587	Secure mail submission contexts
LDAPS	636	LDAP over TLS
Syslog	514 / 6514	Logging; 6514 commonly TLS-protected
RADIUS	1812/1813	Authentication/accounting
RDP	3389	Remote desktop

Network Security Devices and Services

Technology	Primary role
Firewall	Permit or deny traffic based on rules
NGFW	Adds application awareness, identity, threat features
WAF	Protects web applications from HTTP-layer attacks
IDS	Detects suspicious activity
IPS	Blocks or prevents suspicious activity
Proxy	Intermediates client requests
Reverse proxy	Fronts servers and can add security/performance controls
VPN	Encrypted tunnel over untrusted network
NAC	Enforces device/user posture before network access
DLP	Detects or prevents sensitive data movement
SIEM	Aggregates and correlates logs
SOAR	Automates response workflows
EDR	Endpoint detection and response
XDR	Correlates detection across multiple telemetry sources

Segmentation Concepts

Concept	Purpose
VLAN	Logical network segmentation
Subnet	IP-level segmentation
DMZ	Exposes public services while limiting internal access
Microsegmentation	Fine-grained workload-to-workload control
Jump server	Controlled administrative access path
Bastion host	Hardened exposed host for a specific purpose
Air gap	Physical/logical isolation from networks
Zero trust	Never trust solely based on network location; verify continuously

Segmentation decision rule: Place public-facing services in a DMZ, restrict management interfaces, limit east-west movement, and allow only required traffic.

Wireless Security

Topic	Review point
WPA2/WPA3-Personal	Uses pre-shared key; suitable for smaller/simple environments
WPA2/WPA3-Enterprise	Uses 802.1X authentication; better for organizations
WPS	Convenience feature; often disabled for security
Captive portal	Web-based network access flow; not equivalent to strong encryption
Site survey	Identifies coverage, interference, and rogue devices
Guest Wi-Fi	Should be segmented from internal networks

Mobile Device Management

Control	Use
MDM	Enforce device policies, wipe, inventory
MAM	Manage specific applications and data
Containerization	Separate corporate and personal data
Remote wipe	Remove data from lost/stolen devices
Full-device encryption	Protect data at rest
Geofencing	Apply controls based on location
Sideloading restrictions	Reduce untrusted app installation

Common trap: BYOD requires policy and technical enforcement. Encryption alone does not solve app risk, data leakage, or account deprovisioning.

Cryptography and PKI

Crypto Building Blocks

Concept	Purpose	Example use
Symmetric encryption	Fast encryption with same key	Bulk data encryption
Asymmetric encryption	Public/private key pair	Key exchange, digital signatures
Hashing	One-way integrity digest	File integrity, password storage input to KDF
HMAC	Keyed hash for integrity/authenticity	API/message integrity
Digital signature	Integrity, authenticity, non-repudiation	Signed software, certificates
Key exchange	Establish shared secret	TLS session setup
KDF	Derives strong key from password/secret	Password hashing, key derivation
Salt	Unique random value added before hashing	Defeats rainbow tables
Pepper	Secret value added server-side	Extra protection if DB leaks
Nonce	Number used once	Prevents replay
IV	Initialization vector	Adds uniqueness to encryption mode
AEAD	Authenticated encryption with associated data	Confidentiality plus integrity

Notes and examples

Algorithm Recognition

Type	Examples	Notes
Symmetric	AES, ChaCha20	Fast; key distribution is challenge
Asymmetric	RSA, ECC	Slower; supports public-key operations
Hash	SHA-256, SHA-3	Integrity only, not encryption
Legacy/weak	MD5, SHA-1, DES, RC4, WEP	Avoid for modern security
Password hashing/KDF	bcrypt, scrypt, Argon2, PBKDF2	Designed to resist brute force
Transport security	TLS	Protects data in transit
Disk/data encryption	AES-based FDE, database encryption	Protects data at rest

PKI and Certificate Terms

Term	Meaning	Trap
CA	Issues/signs certificates	Trust anchor if root CA
RA	Validates identity before issuance	Does not usually sign certs
CSR	Certificate signing request	Contains public key and subject info
Root CA	Top of trust chain	Must be highly protected
Intermediate CA	Issues certificates under root	Limits root exposure
Certificate chain	Path from leaf cert to trusted root	Chain errors break trust
CRL	Revocation list	Can become large/stale
OCSP	Online revocation status	More real-time than CRL
OCSP stapling	Server provides OCSP proof	Reduces client lookup burden
SAN	Subject alternative name	Modern hostname validation uses SAN
Wildcard cert	Covers subdomains at one level	Does not cover every possible name
Code signing cert	Verifies software publisher/integrity	Does not prove software is vulnerability-free
Certificate pinning	Restricts accepted cert/key	Can cause outages if rotation mishandled

Cryptographic Building Blocks

Concept	Purpose	Examples / notes
Symmetric encryption	Fast encryption with same key	Used for bulk data encryption
Asymmetric encryption	Public/private key pair	Key exchange, digital signatures, certificates
Hashing	One-way integrity check	Same input should produce same digest
Salting	Adds randomness to password hashing	Defends against rainbow tables
HMAC	Integrity and authenticity with shared secret	Hash plus secret key
Digital signature	Integrity, authenticity, non-repudiation	Created with private key, verified with public key
Key exchange	Establish shared secret	Used in secure session setup
Perfect forward secrecy	Past sessions stay protected if long-term key is compromised	Uses ephemeral session keys

PKI Terms

Term	Meaning
CA	Certificate authority that issues certificates
RA	Registration authority that verifies identity information
CSR	Certificate signing request
CRL	Certificate revocation list
OCSP	Online certificate status checking
SAN	Subject alternative name; common for DNS names in certificates
Wildcard certificate	Covers multiple subdomains at a level
Self-signed certificate	Not trusted by default unless explicitly trusted
Certificate pinning	Application expects a specific certificate or public key

Certificate Troubleshooting Clues

Symptom	Likely issue
Browser says name mismatch	CN/SAN does not match requested hostname
Certificate expired	Validity period ended
Untrusted issuer	CA not trusted or missing chain
Revoked certificate	CRL/OCSP indicates invalid certificate
Users warned after TLS inspection	Endpoint does not trust inspection CA
Works by IP but not hostname	Name validation or DNS issue

Quick trap: Hashing is not encryption. If the data must be recovered, use encryption. If the goal is integrity verification, use hashing or signatures.

Secure Architecture and Hardening

Hardening Checklist

Area	Key actions
Operating system	Patch, remove unnecessary services, enforce secure baseline
Accounts	Disable defaults, remove stale users, enforce MFA/admin separation
Services	Stop unused daemons, restrict binding interfaces
Network	Host firewall, least-required ports, segmentation
Logging	Enable security logs, centralize, protect integrity
Time	Synchronize trusted time source
Files	Least privilege, integrity monitoring, encryption where needed
Configuration	Version control, change control, drift detection
Secrets	Vault, rotate, avoid hardcoding
Firmware	Update, secure boot, trusted platform protections
Disposal	Sanitize media, document chain of custody when needed

Notes and examples

Endpoint and Mobile Controls

Control	Purpose
EDR/anti-malware	Detect and respond to endpoint threats
Host firewall	Limit inbound/outbound host traffic
Application allowlisting	Run only approved software
MDM/UEM	Enforce mobile configuration
Remote wipe	Protect lost/stolen devices
Full-disk encryption	Protect data at rest
Screen lock	Prevent casual physical access
Containerization	Separate work/personal data
Jailbreak/root detection	Identify compromised mobile OS controls
USB/removable media control	Reduce malware and data exfiltration risk

Cloud and Virtualization Security

Topic	Security focus	Common exam distinction
Shared responsibility	Provider and customer each secure different layers	Customer usually still owns identity, data, configuration
IaaS	Customer manages OS and above	Most control, more responsibility
PaaS	Provider manages runtime/platform	Customer focuses on app/data/config
SaaS	Provider manages application stack	Customer focuses on users, data, settings
Public cloud	Shared provider infrastructure	Strong logical isolation needed
Private cloud	Dedicated to one organization	More control, not automatically more secure
Hybrid cloud	Mix of on-prem and cloud	Connectivity and identity integration matter
Multi-cloud	Multiple providers	Governance/visibility complexity
Security group	Instance/resource-level filtering	Often stateful
Network ACL	Subnet/network-level filtering	Often stateless depending on platform
IAM policy	Identity/resource permission	Misconfiguration is common cloud risk
CSPM	Cloud security posture management	Finds misconfigurations
CWPP	Cloud workload protection platform	Protects workloads such as VMs/containers
CASB	Cloud access security broker	SaaS visibility/control
KMS	Key management service	Central key lifecycle and access control

Containers and Kubernetes-Style Concepts

Control	Why it matters
Minimal base images	Reduces attack surface
Image scanning	Finds vulnerable packages/secrets
Signed images	Verifies provenance
Read-only filesystem	Limits runtime tampering
Non-root containers	Reduces privilege impact
Secrets management	Avoids secrets in images/env files
Network policies	Controls east-west traffic
Admission control	Blocks noncompliant deployments
Runtime monitoring	Detects unexpected behavior
Resource limits	Reduces DoS/blast radius

Data Protection

Technique	Protects against	High-yield distinction
Encryption	Unauthorized reading	Reversible with key
Hashing	Tamper detection	Not reversible
Tokenization	Replaces sensitive value with token	Original stored in token vault
Masking	Hides part of data	Often for display/non-prod use
Anonymization	Removes identifying links	Hard to reverse if done well
Pseudonymization	Replaces identifiers but can be re-linked	Re-identification possible
DLP	Detect/prevent sensitive data movement	Needs classification and tuning
DRM/IRM	Controls document usage	Protects after distribution
Data minimization	Collect only needed data	Privacy-by-design principle
Retention policy	Keep data for defined period	Must include disposal
Secure deletion	Prevent recovery	Method depends on media type

Secure Software and DevSecOps

SDLC Security Activities

Phase	Security activity
Requirements	Security/privacy requirements, abuse cases
Design	Threat modeling, architecture review
Development	Secure coding, peer review, secrets scanning
Build	Dependency scanning, signed artifacts
Test	SAST, DAST, IAST, fuzzing, penetration testing
Deploy	IaC scanning, change approval, secure configuration
Operate	Monitoring, patching, incident feedback
Retire	Data migration, sanitization, decommissioning

Notes and examples

Testing Tool Selection

Tool/type	Best for	Limitation
SAST	Source code flaws before runtime	May miss runtime/config issues
DAST	Running web app behavior	May not identify exact code line
IAST	Runtime app testing with instrumentation	Requires integration
SCA	Third-party dependency risk	Does not replace code review
Fuzzing	Unexpected input handling	Needs triage
Secrets scanning	Hardcoded credentials/tokens	Needs false-positive handling
IaC scanning	Cloud/config misconfigurations	Must align with deployment context

Secure Coding Traps

Bad pattern	Risk	Better pattern
String-built SQL	SQL injection	Parameterized queries
Direct object IDs without checks	IDOR	Object-level authorization
Storing plaintext passwords	Credential compromise	Salted password KDF
Hardcoded API keys	Secret leakage	Secrets manager
Verbose errors to users	Information disclosure	Generic user errors, detailed logs
Missing rate limits	Brute force/API abuse	Throttling, lockout, risk-based controls
Trusting client validation	Bypass	Server-side validation
Unvalidated redirects	Phishing/token theft	Allowlisted redirects

Secure SDLC

Phase	Security activity
Requirements	Define security and privacy requirements
Design	Threat modeling, architecture review
Development	Secure coding, code review, dependency management
Testing	SAST, DAST, IAST, fuzzing, penetration testing
Deployment	Harden configuration, sign releases, protect secrets
Operations	Monitor, patch, log, improve

Testing Types

Test	What it examines
SAST	Source code or binaries without running the app
DAST	Running application from outside
IAST	Runtime testing with instrumentation
Fuzzing	Unexpected, malformed, or random input
Dependency scan	Vulnerable third-party libraries
SCA	Software composition analysis
SBOM	Inventory of software components
Regression testing	Confirms changes did not break expected behavior

Secure Coding Rules

Validate input on the server side.
Encode output for the correct context.
Use parameterized queries.
Avoid hardcoded secrets.
Enforce authentication and authorization on every sensitive function.
Fail securely.
Log security events without exposing secrets.
Use secure defaults.
Keep dependencies updated.
Protect CI/CD pipelines and signing keys.

Security Operations and Monitoring

Telemetry Sources

Source	What it shows	Use case
Authentication logs	Logins, failures, MFA events	Credential attacks
Endpoint logs	Process, file, registry, memory events	Malware/lateral movement
Firewall logs	Allowed/denied traffic	Network policy validation
DNS logs	Domain lookups	Malware C2, tunneling
Proxy logs	Web requests	User web activity, exfiltration
VPN/ZTNA logs	Remote access sessions	Impossible travel, unusual access
Cloud audit logs	API calls and config changes	Cloud compromise/misconfiguration
Application logs	Business logic events	Fraud and app attacks
Database logs	Queries, admin actions	Data access monitoring
EDR/XDR alerts	Correlated endpoint activity	Threat investigation
IDS/IPS alerts	Network signatures/anomalies	Intrusion detection
DLP alerts	Sensitive data movement	Exfiltration/handling violations

Notes and examples

SIEM, SOAR, and Detection

Tool	Purpose	Trap
SIEM	Central log collection, correlation, alerting	Needs tuning and good data
SOAR	Automated orchestration and response	Automates playbooks; does not replace judgment
UEBA	Behavior analytics	Detects anomalies; false positives possible
Threat intelligence platform	Manage indicators/context	Indicators expire or become noisy
Honeypot/honeynet	Decoy for detection/research	Must be isolated and monitored
File integrity monitoring	Detect unauthorized changes	Needs baseline and tuning

Alert Triage Quick Path

Alert	First checks	Likely containment
Multiple failed logins	Source, user, pattern, success after failures	Disable account, enforce MFA, block source
Impossible travel	VPN/proxy use, user confirmation, device	Revoke sessions, reset credentials
Malware detection	Host, process tree, hash, spread	Isolate endpoint, preserve evidence
Suspicious PowerShell/script	Parent process, encoded commands, user context	Isolate host, collect script/logs
Data exfiltration	Destination, volume, data type, user	Block channel, suspend token/account
New admin account	Change ticket, creator, source IP	Disable account, review privilege changes
Public cloud storage exposure	Resource, data sensitivity, access logs	Remove public access, rotate exposed secrets
DNS to known malicious domain	Host process, frequency, payload	Isolate host, block domain/IP

Incident Response Lifecycle

Phase	Goal	Key actions
Preparation	Be ready before incident	Playbooks, contacts, logging, tools, training
Identification	Confirm incident	Triage alerts, scope impact, classify severity
Containment	Limit damage	Isolate hosts, disable accounts, block indicators
Eradication	Remove cause	Delete malware, patch, close persistence
Recovery	Restore operations	Rebuild, restore, monitor, validate
Lessons learned	Improve	Root cause, timeline, control updates

Evidence and Forensics

Concept	Meaning
Chain of custody	Document who handled evidence, when, and why
Order of volatility	Collect most volatile evidence first
Legal hold	Preserve relevant data from deletion
Write blocker	Prevent alteration of storage evidence
Hashing evidence	Prove integrity of collected image/file
Timeline analysis	Reconstruct sequence of events
Memory capture	Useful for malware, keys, processes
Disk image	Bit-level copy for analysis
E-discovery	Identify, preserve, collect, review electronic information

Useful Tool Recognition

CompTIA Security+ questions usually test tool purpose more than full syntax.

## DNS investigation
dig example.com
nslookup example.com

## Check listening connections
ss -tulpen
netstat -ano

## Test TLS certificate and handshake
openssl s_client -connect example.com:443 -servername example.com

## Capture limited packets
tcpdump -i eth0 host 10.0.0.5

## Inspect HTTP headers
curl -I https://example.com

Tool	Use
`ping`	Basic reachability; ICMP may be blocked
`traceroute` / `tracert`	Path and routing troubleshooting
`nslookup` / `dig`	DNS queries
`netstat` / `ss`	Connections and listening ports
`nmap`	Port/service discovery
`tcpdump` / Wireshark	Packet capture/analysis
`curl`	HTTP/API testing
`openssl`	Certificate/TLS inspection
`grep` / `find`	Log/file searching
`hashcat` / John the Ripper	Password cracking/testing
`ipconfig` / `ifconfig` / `ip`	Network interface configuration
`arp`	ARP cache inspection

Logging and Monitoring

Log source	What it helps detect
Authentication logs	Brute force, impossible travel, privilege misuse
Endpoint logs	Malware, process execution, persistence
Firewall logs	Blocked/allowed traffic patterns
DNS logs	Malware callbacks, tunneling, suspicious domains
Web server logs	Injection, scanning, unusual requests
Cloud audit logs	IAM changes, public exposure, API activity
EDR telemetry	Suspicious process, registry, memory, network behavior
Application logs	Business logic abuse, errors, suspicious actions

SIEM Tuning Terms

Term	Meaning
True positive	Alert correctly identifies malicious/suspicious activity
False positive	Alert fires on benign activity
True negative	No alert and no issue
False negative	Issue occurs but no alert fires
Correlation rule	Combines events to identify patterns
Baseline	Normal behavior used for comparison
Alert fatigue	Too many low-quality alerts reduce effectiveness

Hardening Checklist

Disable unnecessary services.
Remove default accounts and passwords.
Apply secure configuration baselines.
Enforce least privilege.
Enable host firewall.
Patch operating systems and applications.
Configure logging and time synchronization.
Use secure protocols.
Protect management interfaces.
Validate backups and recovery procedures.

Standard Flow

    flowchart TD
	    A[Preparation] --> B[Identification]
	    B --> C[Containment]
	    C --> D[Eradication]
	    D --> E[Recovery]
	    E --> F[Lessons learned]
	    F --> A

Incident Response Phases

Phase	What to do	Avoid
Preparation	Policies, tools, contacts, playbooks, training	Waiting until an incident to define roles
Identification	Confirm incident, scope impact, collect indicators	Declaring root cause too early
Containment	Limit spread and damage	Destroying evidence unnecessarily
Eradication	Remove malware, close vulnerability, reset credentials	Restoring without fixing cause
Recovery	Return systems safely, monitor closely	Bringing systems online without validation
Lessons learned	Improve controls, documentation, detection	Treating the incident as “over” after recovery

First Action Decision Rules

Scenario clue	Likely best first action
Active safety risk	Protect people and critical operations
Possible legal/evidence issue	Preserve evidence and follow chain of custody
Malware spreading	Contain affected systems
Unconfirmed alert	Validate and scope
Compromised credentials	Disable/reset affected credentials and investigate use
Public data exposure	Follow incident plan, contain exposure, notify internal stakeholders per procedure
Ransomware	Isolate affected systems, preserve evidence, activate response plan

Evidence Principles

Concept	Meaning
Chain of custody	Document who handled evidence, when, where, and why
Integrity	Evidence must not be altered
Hashing	Verifies evidence copy integrity
Legal hold	Preserve relevant data for legal/regulatory reasons
Write blocker	Prevents modification during acquisition
Order of volatility	Collect most temporary data first when appropriate

Volatility Review

Most volatile evidence disappears first. A typical order is:

CPU registers/cache
RAM
Network connections and running processes
Disk data
Logs and remote monitoring data
Backups and archives

Common trap: Pulling the power may preserve disk state but destroy volatile memory. The best action depends on the incident plan, evidence needs, and safety.

Resilience, Backup, and Disaster Recovery

Availability Patterns

Pattern	Purpose	Trap
Redundancy	Extra components	Not useful if same failure affects all
Fault tolerance	Continue despite component failure	Usually more expensive/complex
High availability	Minimize downtime	Does not guarantee no outage
Load balancing	Distribute traffic	Needs health checks
Clustering	Multiple nodes operate together	Can be active-active or active-passive
Geographic diversity	Survive regional events	Data consistency and latency matter
Replication	Copy data/systems	Can replicate corruption/ransomware
Snapshot	Point-in-time copy	Not always independent backup
Immutable backup	Cannot be altered for retention period	Strong ransomware defense
Air-gapped backup	Offline/isolated copy	Slower restore, stronger isolation
Tabletop exercise	Discussion-based DR/IR test	Does not prove technical recovery
Failover test	Validate alternate site/system	Requires planning to avoid disruption

Notes and examples

Backup Types

Type	What it backs up	Restore implication
Full	Everything selected	Simplest restore, more storage/time
Incremental	Changes since last backup	Faster backup, restore needs chain
Differential	Changes since last full	Restore needs full + latest differential
Snapshot	Point-in-time state	Fast rollback, platform-dependent
Continuous replication	Near-real-time copy	Low RPO, can replicate bad changes

Key Metrics

Metric	Meaning	Common confusion
RTO	Maximum acceptable time to restore service	Time, not data loss
RPO	Maximum acceptable data loss measured in time	Data loss window, not restore time
MTD / MAO	Maximum tolerable downtime/outage	Business limit before unacceptable harm
MTTR	Mean time to repair/recover	Operational repair average
MTBF	Mean time between failures	Reliability measure

Backup Types

Backup	Strength	Limitation
Full	Complete copy	More time/storage
Incremental	Changes since last backup	Faster backup, slower restore chain
Differential	Changes since last full backup	Larger over time, simpler restore than incremental
Snapshot	Point-in-time state	Must be protected from compromise
Offline backup	Isolated from network attacks	Slower access
Immutable backup	Cannot be altered for set period	Requires correct retention design

Resilience Concepts

Concept	Purpose
High availability	Reduce downtime
Fault tolerance	Continue operating despite failure
Redundancy	Duplicate components
Load balancing	Distribute traffic
Clustering	Multiple systems work together
Geographic diversity	Reduce regional outage impact
Tabletop exercise	Discussion-based plan validation
Failover test	Confirms alternate systems work

Ransomware trap: Backups only help if they are restorable, protected, recent enough for the RPO, and not encrypted or deleted by the attacker.

Physical, Environmental, and Safety Controls

Control	Primary purpose
Badge/access card	Identify and authorize entry
Biometric reader	Stronger identity verification
Mantrap	Prevent tailgating
Security guard	Deterrence and response
CCTV	Detective/deterrent evidence
Motion sensor	Detect unauthorized movement
Door lock	Prevent unauthorized access
Faraday cage	Block electromagnetic signals
Cable lock	Deter device theft
Privacy screen	Reduce shoulder surfing
Fire suppression	Protect people/equipment
HVAC	Maintain safe operating environment
UPS	Short-term power continuity
Generator	Longer-term backup power
Hot/cold aisles	Data center cooling efficiency
Equipment disposal	Prevent data recovery and leakage

Privacy and Data Governance

Data Roles

Role	Responsibility
Data owner	Determines classification, access, and handling requirements
Data steward	Manages data quality and governance processes
Data custodian	Implements storage, backup, and technical controls
Data controller	Determines purposes and means of processing personal data
Data processor	Processes data on behalf of controller
Data subject	Individual the personal data relates to
Privacy officer/DPO-style role	Oversees privacy program where applicable

Notes and examples

Data Classification and Handling

Classification	Typical handling
Public	Approved for public release
Internal	Business use; not public
Confidential	Limited access; protect from disclosure
Restricted/highly sensitive	Strong controls, strict need-to-know
Regulated data	Handle according to applicable contractual/regulatory obligations

Lifecycle phase	Security focus
Create/collect	Minimize, classify, notify if required
Store	Encrypt, control access, backup
Use	Least privilege, monitoring
Share	DLP, agreements, secure transfer
Archive	Retention and access controls
Destroy	Sanitization, certificate/record of destruction if needed

Data States

State	Meaning	Controls
Data at rest	Stored data	Disk/database encryption, access control
Data in transit	Moving across networks	TLS, VPN, secure protocols
Data in use	Being processed	Memory protections, secure enclaves, access control

Data Handling

Concept	Review point
Classification	Labels data by sensitivity
Labeling	Marks data so handling rules can be applied
Tokenization	Replaces sensitive data with non-sensitive token
Masking	Hides part of data from view
Anonymization	Removes identifying information
Pseudonymization	Replaces identifiers but may be reversible with extra data
Retention	Defines how long data is kept
Disposal	Secure deletion, shredding, crypto-erasure
Data minimization	Collect only what is needed
DLP	Detects or prevents sensitive data exposure

Trap: Encryption protects confidentiality, but it does not automatically enforce retention, minimization, consent, or appropriate access.

Common Exam Traps

If the question says…	Prefer…	Avoid assuming…
“Most secure remote admin”	SSH, VPN/ZTNA, MFA, bastion, logging	Telnet or public RDP
“Protect web app from SQLi/XSS”	Secure coding plus WAF as compensating/detective layer	WAF alone fixes bad code
“Prove file was not modified”	Hash or digital signature	Encryption alone
“Prove who signed/sent it”	Digital signature	Hash alone
“Encrypt large data efficiently”	Symmetric encryption	Asymmetric for bulk data
“Exchange keys over insecure channel”	Asymmetric key exchange / TLS	Pre-shared secrets without protection
“Stop data leaving organization”	DLP, classification, egress controls	Firewall alone sees all sensitive content
“Least privilege for dynamic cloud access”	ABAC/PBAC, JIT/JEA	Permanent broad admin roles
“Centralize log analysis”	SIEM	Syslog alone as full analysis
“Automate response workflow”	SOAR	SIEM alone
“Detect endpoint behavior”	EDR/XDR	Antivirus signatures only
“Network admission based on device posture”	NAC	Firewall rule only
“Federated authorization to app data”	OAuth 2.0	OAuth as pure authentication
“Federated login with identity token”	OIDC or SAML	LDAP by itself for web SSO
“Protect passwords in database”	Salted adaptive hash/KDF	Encryption of passwords for login comparison
“Lost laptop with sensitive files”	Full-disk encryption and remote wipe	Password-only protection
“Untrusted removable media”	Disable/control USB, scan, awareness	User caution only
“Legacy OT cannot be patched”	Segment, monitor, compensating controls	Ignore vulnerability
“Ransomware resilience”	Immutable/offline backups, EDR, least privilege, segmentation	Snapshots alone if attacker can delete them

Cheat Sheet Checklist

Before the exam, make sure you can quickly answer:

Which control category and function fits a scenario?
Whether the question asks for confidentiality, integrity, availability, authentication, authorization, or accounting.
Which IAM technology is authentication, authorization, federation, provisioning, or privileged access.
When to choose firewall, WAF, IDS, IPS, EDR, XDR, SIEM, SOAR, DLP, CASB, NAC, VPN, or ZTNA.
Which attack matches the indicators: SQLi, XSS, CSRF, SSRF, replay, on-path, DNS poisoning, credential stuffing, password spraying.
How symmetric encryption, asymmetric encryption, hashing, HMAC, digital signatures, and certificates differ.
How to prioritize vulnerabilities using exploitability, exposure, business impact, and compensating controls.
The incident response phase implied by the action.
The difference between RTO, RPO, MTTR, MTBF, MTD, SLE, ARO, and ALE.
Which data protection method fits: encryption, hashing, tokenization, masking, anonymization, pseudonymization, or DLP.

Notes and examples

Final Quick Checklist Before Practice

Before you start topic drills or mock exams for SY0-801, make sure you can quickly explain:

CIA triad and how controls map to it.
Administrative, technical, and physical controls.
Preventive, detective, corrective, deterrent, directive, and compensating controls.
Authentication vs. authorization vs. accounting.
MFA factor types and common identity protocols.
Common attacks and their indicators.
Injection, XSS, CSRF, SSRF, and directory traversal differences.
Symmetric encryption, asymmetric encryption, hashing, HMAC, and digital signatures.
PKI certificate trust and revocation basics.
Firewall, IDS, IPS, WAF, proxy, VPN, NAC, DLP, EDR, SIEM, and SOAR roles.
Cloud shared responsibility and common cloud misconfigurations.
Vulnerability scan vs. penetration test vs. red team.
Incident response order and evidence preservation.
RTO vs. RPO and backup strategy tradeoffs.
Data classification, retention, masking, tokenization, and disposal.
Secure SDLC testing methods and CI/CD risks.
Governance documents and third-party risk controls.

High-Yield Exam Mindset

If the question asks…	Think first about…	Common trap
“Best” control	The control that directly reduces the stated risk with least unnecessary complexity	Choosing the most advanced tool instead of the most relevant one
“First” step in incident response	Safety, scope, preservation, containment plan, and procedure	Jumping to eradication before identifying or containing
“Most likely attack”	Clues in symptoms, logs, user behavior, and affected layer	Matching on buzzwords only
“Most secure” design	Least privilege, segmentation, strong identity, encryption, monitoring	Ignoring availability or operational fit
“Cost-effective” option	Risk reduction proportional to cost and complexity	Picking enterprise tools where policy or configuration would solve it
“Cloud responsibility”	What the provider secures vs. what the customer configures	Assuming the cloud provider secures customer data, IAM, and app settings
“Compliance” or “governance”	Policy, evidence, accountability, audits, data handling	Treating compliance as the same thing as security

Core Security Objectives

Concept	Meaning	Example controls
Confidentiality	Prevent unauthorized disclosure	Encryption, access control, data classification, DLP
Integrity	Prevent unauthorized modification	Hashing, digital signatures, change control, file integrity monitoring
Availability	Keep systems and data usable	Redundancy, backups, DDoS protection, clustering
Non-repudiation	Prevent denial of an action	Digital signatures, signed logs, timestamps
Authentication	Prove identity	Passwords, MFA, certificates, biometrics
Authorization	Grant appropriate access	RBAC, ABAC, ACLs, policy engines
Accounting / auditing	Record activity	Logs, SIEM, audit trails

Notes and examples

Risk Basics

Security decisions usually balance likelihood, impact, cost, and operational needs.

Risk term	Review meaning
Asset	Something valuable: data, system, service, people, reputation
Threat	Potential cause of harm
Vulnerability	Weakness that can be exploited
Impact	Damage if the event occurs
Likelihood	Probability or frequency of occurrence
Inherent risk	Risk before controls
Residual risk	Risk remaining after controls
Risk appetite	Amount of risk the organization is willing to accept
Risk tolerance	Acceptable variance around risk appetite

Risk Response Options

Response	Use when…	Example
Mitigate	Reduce likelihood or impact	Patch, segment, enable MFA
Transfer	Shift financial or operational consequence	Cyber insurance, outsourcing
Avoid	Stop the risky activity	Retire exposed legacy service
Accept	Risk is within tolerance	Documented exception for low-risk issue

Cloud, Virtualization, and Modern Architecture

Shared Responsibility

Cloud model	Provider generally handles more of…	Customer generally handles more of…
IaaS	Physical infrastructure, virtualization platform	OS, applications, data, IAM configuration
PaaS	Infrastructure, runtime platform	Application logic, data, access settings
SaaS	Application platform and infrastructure	Users, data, configuration, access governance

Notes and examples

Cloud trap: Misconfigured storage, excessive IAM permissions, exposed secrets, and weak logging are often customer-side risks.

Cloud Security Tools and Patterns

Term	Review use
CASB	Visibility and policy enforcement for cloud service use
CSPM	Finds cloud configuration risks
CWPP	Protects cloud workloads
IaC scanning	Detects risky infrastructure templates before deployment
Secrets management	Stores and rotates credentials securely
KMS / HSM	Key management and hardware-backed key protection
Security groups	Instance or workload-level traffic filtering
VPC/VNet	Isolated cloud network boundary
Private endpoint	Access service without public internet exposure
Immutable infrastructure	Replace rather than manually modify systems

Containers and Orchestration

Topic	Review point
Container image	Should be scanned, signed, and minimal
Registry	Must enforce access control and integrity
Orchestrator	Needs secure API, RBAC, secrets, network policies
Container escape	Breakout from container isolation
Sidecar	Helper container for logging, proxying, security functions
Secrets	Should not be baked into images or committed to repositories

Physical Security

Control	Purpose
Bollards	Stop vehicle impact
Fencing	Perimeter control
Badges	Identify authorized personnel
Biometrics	Strong identity verification
Mantrap	Prevent tailgating
Cameras	Deterrence and investigation
Guards	Human verification and response
Locks	Restrict physical access
Faraday cage	Block electromagnetic signals
Fire suppression	Protect facilities and equipment
HVAC	Maintain safe operating environment
UPS / generator	Maintain power availability

Physical security trap: If an attacker has uncontrolled physical access, many technical controls become easier to bypass.

Common “Best Answer” Patterns

When Two Answers Look Correct

Ask:

Which answer addresses the stated risk most directly?
Which answer fits the phase of the process?
Which answer is preventive vs. detective vs. corrective as requested?
Which answer preserves evidence and follows procedure?
Which answer is least disruptive while still effective?
Which answer is scalable and manageable?
Which answer is appropriate for cloud, mobile, or on-premises context?
Which answer solves root cause rather than symptoms?

Frequent Candidate Mistakes

Confusing encryption with hashing.
Treating authentication and authorization as the same thing.
Selecting a tool before defining the requirement.
Skipping containment in incident response.
Ignoring chain of custody.
Assuming a vulnerability scan proves exploitability.
Assuming compliance means secure.
Picking “deny all” without allowing required business traffic.
Forgetting that availability is part of security.
Overlooking misconfiguration as a major cloud risk.
Confusing RTO and RPO.
Forgetting that MFA must use different factor types.
Selecting public cloud provider responsibility for customer-side IAM or data mistakes.
Choosing eradication before identification and containment.
Choosing a technical control when the scenario asks for policy, governance, or training.

Rapid Review Tables

Attack to Control Matching

If you see…	Think…
Reused passwords abused across services	MFA, password monitoring, user education
Many accounts tried with one common password	Password spraying
One account tried with many passwords	Brute force
Login from impossible locations	Account compromise / impossible travel analytics
Sensitive data leaving by email	DLP
Web app database errors after input	SQL injection
Browser executes injected script	XSS
User tricked into making authenticated request	CSRF
Internal metadata service accessed through app	SSRF
Unknown device on switch port	NAC / port security
Public bucket with sensitive files	Cloud misconfiguration
Admin account used at unusual time	Privileged account monitoring
Malware beaconing to domains	DNS logs, EDR, network detection
Logs across systems need correlation	SIEM
Repetitive response steps	SOAR playbook

Notes and examples

Security Tool Selection

Need	Likely tool/control
Block malicious HTTP requests to web app	WAF
Inspect endpoint behavior	EDR
Correlate logs from many sources	SIEM
Automate alert response	SOAR
Enforce data movement rules	DLP
Authenticate network access	NAC / 802.1X
Manage mobile devices	MDM
Control SaaS usage	CASB
Detect cloud misconfiguration	CSPM
Protect cloud workloads	CWPP
Store and rotate secrets	Secrets manager
Verify file integrity	Hash / file integrity monitoring
Prove software publisher	Code signing
Protect keys strongly	HSM / KMS

Put the review into practice

Study Plan

SY0-801 — CompTIA Security+ V8 Cheat Sheet

Security Foundations

CIA, AAA, and Non-Repudiation

Control Categories and Functions

High-Yield Security Principles

Control Categories

Control Functions

Risk, Governance, and Compliance

Risk Terms

Risk Response Decisions

Risk Formulas

Policy and Governance Artifacts

Policy and Documentation

Third-Party and Supply Chain Risk

Personnel Security

Threats and Attacks

Social Engineering

Malware and Host-Based Threats

Password and Credential Attacks

Network Attacks

Web and Application Attacks

Threat Actor Types

Social Engineering

Malware and Host-Based Threats

Network Attacks

Application and Web Attacks

Vulnerability Management and Testing

Assessment Types

Scan and Test Distinctions

Vulnerability Remediation Prioritization

Standard Workflow

Scanning and Testing

Prioritization Factors

Identity and Access Management

Authentication Factors

Access Control Models

IAM Technologies

Privileged Access Controls

Authentication Factors

Access Control Models

Account and Privilege Controls

Federation and SSO

Network Security

Network Zones and Segmentation

Security Device Selection

Common Ports and Protocols

Wireless Security

Common Ports and Protocols

Network Security Devices and Services

Segmentation Concepts

Wireless Security

Mobile Device Management

Cryptography and PKI

Crypto Building Blocks

Algorithm Recognition

PKI and Certificate Terms

Cryptographic Building Blocks

PKI Terms

Certificate Troubleshooting Clues

Secure Architecture and Hardening

Hardening Checklist

Endpoint and Mobile Controls

Cloud and Virtualization Security

Containers and Kubernetes-Style Concepts

Data Protection

Secure Software and DevSecOps

SDLC Security Activities

Testing Tool Selection

Secure Coding Traps

Secure SDLC

Testing Types

Secure Coding Rules

Security Operations and Monitoring

Telemetry Sources

SIEM, SOAR, and Detection

Alert Triage Quick Path

Incident Response Lifecycle

Evidence and Forensics

Useful Tool Recognition

Logging and Monitoring