CompTIA Security+ (SY0-701) Cheat Sheet

Exam at a glance

PBQs are the point-heavy, time-heavy items. A common tactic: flag them, clear the multiple-choice first, then return with your remaining time.

Domains and weightings

Security Operations (28%) is the largest domain — weight your study accordingly. Threats and Program Management together are nearly half the exam.

1.0 General Security Concepts

The CIA triad — the three goals every control serves:

• Confidentiality — information is seen only by those authorized to see it; enforced with encryption, access controls, and least privilege.
• Integrity — data stays accurate and unaltered; hashing and digital signatures detect tampering.
• Availability — systems and data are there when needed; redundancy, backups, and DDoS protection defend it.
• Non-repudiation — a party cannot credibly deny an action they took; digital signatures and logging provide the proof.

AAA — the access framework:

• Authentication — proving you are who you claim to be (password, token, biometric).
• Authorization — what an authenticated identity is actually allowed to do.
• Accounting — recording what was done, for audit and forensics.

Security controls — categorized two ways:

• By type: technical (enforced by technology), managerial (policies and process), operational (run by people day to day), physical (locks, guards, cameras).
• By function: preventive (stop it), deterrent (discourage it), detective (spot it), corrective (fix it afterward), compensating (an alternative when the primary control isn't possible), directive (instruct people what to do).

Zero Trust — "never trust, always verify":

• Assume no user or device is trusted by default, even inside the network, and verify every request.
• Control plane vs data plane — the control plane decides who gets access (policy engine and policy administrator); the data plane is where the enforcement point actually allows or blocks the traffic.

Cryptography building blocks:

• Symmetric encryption — one shared key both encrypts and decrypts; fast, ideal for bulk data (AES).
• Asymmetric encryption — a public/private key pair; slower, used to exchange keys and to sign (RSA, ECC).
• Hashing — a one-way fingerprint of data; any change to the input changes the hash, which is how it proves integrity (SHA-256).
• Digital signatures — sign with your private key so anyone can verify authenticity and integrity with your public key; also provides non-repudiation.
• PKI — the system of certificate authorities, certificates, and keys that binds a public key to a verified identity.
• Salting — adding random data to a password before hashing so identical passwords hash differently, defeating precomputed (rainbow-table) attacks.

2.0 Threats, Vulnerabilities, and Mitigations

Threat actors — who attacks, and why:

• Nation-state — government-backed, well-funded, and patient; espionage or sabotage (often "advanced persistent threats").
• Organized crime — profit-driven groups behind most ransomware and financial fraud.
• Hacktivist — ideologically motivated; defacement or leaks to make a point.
• Insider threat — an employee or contractor misusing legitimate access, whether malicious or careless.
• Unskilled attacker ("script kiddie") — uses others' tools without deep knowledge; opportunistic.
• Shadow IT — not an attacker but a risk: staff using unsanctioned tools and services outside IT's control.

Social engineering — attacking the person, not the system:

• Phishing — fraudulent email impersonating a trusted source to steal credentials or deliver malware.
• Spear phishing — phishing tailored to a specific person or role, using personal detail to seem legitimate.
• Vishing / smishing — the same con run by voice call / SMS text.
• Pretexting — inventing a believable scenario ("I'm from IT") to extract information or access.
• Business email compromise (BEC) — impersonating an executive or vendor to trigger fraudulent payments. (More in our phishing tutorial.)

Malware — the main families:

• Virus — malicious code that attaches to a file and spreads when that file is run.
• Worm — self-replicating malware that spreads across networks with no user action.
• Trojan — malware disguised as legitimate software the user installs willingly.
• Ransomware — encrypts the victim's data and demands payment for the key.
• Rootkit — hides deep in the system to keep stealthy, privileged access.
• Keylogger — records keystrokes to capture passwords and other secrets.
• Logic bomb — malicious code that triggers on a condition, such as a date or event.
• Spyware — covertly gathers information about the user and their activity.

Common attacks:

• DDoS — floods a service with traffic from many sources to knock it offline.
• On-path (man-in-the-middle) — the attacker secretly relays or reads traffic between two parties.
• Replay — captured legitimate traffic (like a login token) is re-sent to impersonate a user.
• Injection (SQLi, XSS) — untrusted input is executed as code: SQL against a database, or script in a victim's browser.
• Privilege escalation — turning limited access into higher (admin) access.
• Password attacks — brute-force (try everything), spraying (a few common passwords across many accounts), credential stuffing (reused passwords from prior leaks).

Vulnerabilities — the weaknesses attacks exploit:

• Zero-day — a flaw with no patch yet, unknown to the vendor.
• Misconfiguration — insecure defaults, open ports, or excessive permissions.
• Supply chain — a trusted vendor, library, or update is compromised and the risk is inherited.
• Race condition — a timing flaw where the order of operations can be abused; the classic case is TOCTOU (time-of-check to time-of-use), where a resource is swapped in the gap between when a program checks it and when it uses it.
• Buffer overflow — writing past a memory boundary to crash or hijack a program.

Mitigations — reducing the risk:

• Segmentation — divide the network so a breach can't spread freely.
• Patching — apply updates promptly to close known flaws.
• Least privilege — give each user and process only the access it needs.
• Hardening — remove unused services, close ports, apply secure baselines.
• EDR — endpoint detection and response: monitors devices and reacts to threats.
• Allow-listing — permit only approved software to run and deny everything else.

3.0 Security Architecture

Deployment and cloud models:

• On-premises — you own and run the hardware, and carry all the responsibility.
• Cloud (IaaS / PaaS / SaaS) — rent infrastructure, a platform, or finished software; the higher the layer, the more the provider manages for you.
• Hybrid — a deliberate mix of on-prem and cloud.
• Shared responsibility model — the split of security duties between you and the cloud provider; misunderstanding where the line falls is a common cause of breaches.

Network security controls:

• Firewall — filters traffic by rules; a stateful firewall tracks connections, an NGFW adds application awareness, and a WAF specifically protects web apps.
• IDS / IPS — an intrusion detection system alerts on suspicious traffic; an intrusion prevention system also blocks it.
• VPN — an encrypted tunnel that protects traffic across untrusted networks.
• Proxy — an intermediary that forwards requests and can filter or inspect them.
• Segmentation / DMZ — isolate zones; a DMZ (screened subnet) holds public-facing servers away from the internal network.

Secure design principles:

• Defense in depth — layered controls, so one failure isn't fatal.
• Fail-secure — when something breaks, it defaults to denying access rather than granting it.
• Least privilege — minimal access by default.
• Separation of duties — split sensitive tasks across people so no single person can act alone.

Data protection:

• Classification — label data by sensitivity so it's handled appropriately.
• Encryption at rest / in transit / in use — protect stored data, moving data, and (hardest) data actively being processed. (See Encryption and HTTPS in Plain English.)
• DLP — data loss prevention: tools that detect and block sensitive data leaving the organization.
• Tokenization / masking — replace sensitive values with harmless substitutes (tokens), or hide part of them (masking), so the real data isn't exposed.

Resilience and recovery:

• High availability / load balancing — spread load and remove single points of failure so service stays up.
• Backups (3-2-1 rule) — three copies, on two media types, with one off-site.
• RAID — disk redundancy so a single drive failure doesn't lose data.
• Recovery sites — hot (ready instantly), warm (partially set up), cold (space only, slow to bring online).

4.0 Security Operations (largest domain)

Identity and access management:

• MFA — require two or more different factor types (something you know / have / are), so a stolen password alone isn't enough.
• SSO — one login grants access to many systems, improving usability and central control.
• Federation — trust identities from another organization or provider (e.g., signing in through a partner identity provider).
• IAM lifecycle — provision access on hire, adjust it on role change, and promptly deprovision it on exit.
• Privileged access management (PAM) — extra control and monitoring over admin and root accounts.

System hardening:

• Baselines — a known-good secure configuration to build every system from.
• Patch management — a process for testing and rolling out updates on a schedule.
• Disable unused ports and services — shrink the attack surface.
• Endpoint protection — antivirus/EDR on laptops, servers, and mobile devices.

Monitoring and response tooling:

• SIEM — aggregates logs from across the environment and correlates them to raise alerts.
• Log aggregation — centralizing logs so they can be searched and can't be quietly tampered with locally.
• SOAR — security orchestration, automation, and response: automates repetitive response steps.

Incident response lifecycle (memorize the order):

• Preparation — plans, tooling, and training in place before anything happens.
• Identification — detect and confirm that an incident is real.
• Containment — limit the damage and stop the spread.
• Eradication — remove the cause, such as malware or compromised accounts.
• Recovery — restore systems to normal, verifying they're clean first.
• Lessons learned — review what happened and improve for next time.

Digital forensics:

• Chain of custody — a documented trail of who handled evidence and when, so it holds up legally.
• Order of volatility — collect the most perishable evidence first (memory before disk).
• Legal hold / e-discovery — preserve relevant data when litigation is anticipated, and produce it as required.

Vulnerability management:

• Scanning — automated tools that find known weaknesses.
• CVSS — a 0-10 score rating a vulnerability's severity, used to prioritize.
• CVE — a unique public identifier for a specific known vulnerability.
• Penetration testing — authorized simulated attacks to find what's actually exploitable.
• Remediation and validation — fix the finding, then re-test to confirm it's genuinely closed.

5.0 Security Program Management and Oversight

Governance:

• Policies, standards, procedures, guidelines — policies set the mandate, standards set specific requirements, procedures give step-by-step instructions, and guidelines offer recommended (optional) practice.
• Data roles — the owner is accountable for the data, the custodian maintains and protects it, the controller decides why and how it's processed, and the processor handles it on the controller's behalf.

Risk management:

• Risk identification and assessment — find the risks, then rate them qualitatively (high/medium/low) or quantitatively (with dollar figures).
• Risk math — SLE (single loss expectancy) × ARO (annual rate of occurrence) = ALE (annualized loss expectancy), the expected yearly cost of a risk.
• Risk responses — accept (live with it), avoid (stop the activity), transfer (insure or outsource it), mitigate (reduce it with controls).

Third-party risk:

• Vendor assessments — vetting a supplier's security before and during the relationship.
• SLA — service-level agreement: the uptime and performance the vendor formally commits to.
• MOU / BPA — memorandum of understanding (informal statement of intent) versus business partners agreement (formal partnership terms).
• Right-to-audit clause — contractual permission to inspect a vendor's security controls.

Compliance:

• GDPR / HIPAA / PCI-DSS — regulations covering EU personal data, US health information, and payment-card data, respectively.
• Consequences of non-compliance — fines, legal liability, lost contracts, and reputational damage.

Security awareness:

• Training — teaching staff to recognize threats and follow policy.
• Phishing simulations — safe, fake phishing campaigns to measure and build resistance.
• Reporting culture — making it easy and blame-free to report mistakes quickly, which is what limits the damage.

Ports worth memorizing

Know the secure vs insecure pairs: Telnet(23)→SSH(22), HTTP(80)→HTTPS(443), FTP(21)→SFTP(22)/FTPS, LDAP(389)→LDAPS(636).

Study tips

• Acronym fluency wins. Security+ is dense with acronyms; drill them until expansion is automatic.
• Answer from a risk-management mindset, not a technician's. When two answers seem right, the exam usually wants the one that best reduces business risk.
• Do the PBQs last. They eat time; bank the quick multiple-choice points first.
• Watch for "BEST" and "MOST likely" wording — several options are plausible; you're ranking, not just recognizing.

---

Go deeper: Security+ is the natural companion to our security lane — OWASP Top 10 in Plain English, Encryption and HTTPS, and Phishing and Social Engineering. Stepping up to management-level security? See the CISSP cheat sheet. Exam details verified against CompTIA on 19 August 2026 — confirm the current exam code before you book.