CompTIA Security+

COMPTIA · Security+ (SY0-701)

QH Verified

By Mr Sparkles

Cheat Sheet

CompTIA Security+ Exam Mastery

SY0-701

Please use my guide to finalize your training for the CompTIA Security+ exam. Reproduction of this is not allowed.

Created by:Mr. Sparkles

The Golden Rules

  • Read the objective first. The "best" control is the one that matches CIA, safety, or recovery - not the flashiest acronym.
  • Security Operations is nearly a third of the exam. If you only drilled malware names, you are underprepared.
  • Contain before you eradicate. Wiping a box mid-spread destroys evidence and often fails the scenario.
  • Hashing ≠ encryption. Hash = integrity. Encryption = confidentiality. Signature = who + integrity.
  • Base64 is encoding, not security. If the stem says "protect," encoding is almost never the answer.
  • PBQs eat time. Flag them, finish the multiple choice, then return with a clear head.
1

Blueprint Weights ≤90 Q / 90 min / 750+

Domain Weight
General Security Concepts 12%
Threats, Vulnerabilities & Mitigations 22%
Security Architecture 18%
Security Operations 28%
Security Program Management & Oversight 20%
Reality check: Domains 4 + 5 are nearly half the exam. Confirm live objectives on CompTIA before you book - weights and fees shift.
2

Control picker Concepts 12%

Category Examples
Managerial Policies, risk register, awareness, vendor review
Technical MFA, ACL, EDR, encryption, DLP, IDS/IPS
Operational Change mgmt, IR drills, vuln management, backups
Physical Locks, guards, cameras, mantraps, bollards
Control types (function)
Type Job Example
Preventive Stop it Firewall, MFA, allow list
Detective Find it SIEM, IDS, CCTV, audit logs
Corrective Fix it Restore backup, patch, reimage
Deterrent Discourage Warning banner, visible cameras
Compensating Workaround Extra monitoring when MFA is impossible
Directive Instruct Policy, SOP, signage
Exam angle: A guard can be physical + preventive (blocks entry) or physical + detective (watches cameras). Classify by what the stem emphasizes.
3

CIA, AAA & Zero Trust

Goal Meaning Typical control
Confidentiality No unauthorized disclosure Encryption, ACL, classification
Integrity No unauthorized change Hash, signature, FIM
Availability Usable when needed Redundancy, backups, DDoS mitigation
Non-repudiation Cannot deny the act Digital signature, audit trail
Identify → Authenticate → Authorize → Account Least privilege Separation of duties Defense in depth
Trap: Zero Trust is an architecture model (never trust, always verify) - not a product you buy. Shared accounts kill non-repudiation.
4

Crypto picker

Need Use
Confidentiality at rest (lots of data) Symmetric (AES-256)
Key exchange / identity over untrusted net Asymmetric (RSA, ECC, DH)
Prove file was not changed Hash (SHA-256)
Prove who sent it + integrity Digital signature
Store passwords Salted adaptive hash (not reversible crypto)
Protect stolen laptop Full-disk encryption (+ TPM when available)
Protect web sessions TLS with valid certificates
Hardware-backed keys TPM (device) / HSM (enterprise)

Hash / encrypt / encode

  • Hash: one-way, integrity
  • Encrypt: reversible with key
  • Encode: Base64 - format only
  • Tokenize / mask: limit exposure

PKI quick hits

  • CA issues; root is trust anchor
  • CSR = public key + identity request
  • CRL / OCSP = revocation check
  • PFX/P12 = cert + private key
Trap: Encryption alone does not prove integrity. Hash alone does not prove who sent it.
5

Threat actors Threats 22%

Actor Motivation Clue
Nation-state / APT Espionage, sabotage Stealth, zero-days, long dwell
Organized crime Money Ransomware, fraud, BEC
Hacktivist Ideology Defacement, leak, DDoS
Insider Revenge, money, negligence Authorized access abuse
Script kiddie Curiosity / status Noisy, commodity tools
Shadow IT Convenience Unapproved SaaS / devices
Malware one-liners
Virus = needs host file Worm = self-spreads Trojan = fake legit Ransomware = encrypt / extort Rootkit = hides Fileless = memory / LOLBins Logic bomb = timed trigger
6

Social engineering distinctions

Attack Channel / twist Best mitigator
Phishing Broad email Filter + awareness + report
Spear / Whaling Targeted / exec Verify out-of-band; pay controls
Vishing / Smishing Voice / SMS Callback procedures
BEC Fake trusted business email Out-of-band payment confirm
Pretexting Invented scenario Identity verification scripts
Tailgating Physical follow-in Mantrap / badge enforcement
Watering hole Compromise a site the target uses Web filter, patch, isolation
Typosquatting Lookalike domain DNS filter, DMARC, monitoring
Principles that make it work: authority, urgency, scarcity, familiarity, intimidation, consensus.
7

App & network attack picker

Attack Clue Mitigation
SQL injection ' OR 1=1 Parameterized queries, validation
XSS Script in page / cookie theft Output encoding, CSP
CSRF Forged request while logged in Anti-CSRF token, SameSite
SSRF Server hits cloud metadata Allowlist destinations
Directory traversal ../ in path Normalize paths, jail files
On-path / MITM Intercept / alter traffic TLS, cert validation, VPN
Evil twin / rogue AP Fake SSID / unauthorized AP WPA3-Ent, NAC, wireless survey
ARP / DNS poison Wrong MAC or wrong name DAI, DNSSEC, monitoring
Password spray One password, many accounts MFA, lockout, monitoring
Privilege escalation User → admin Patch, harden, least privilege
8

Ports & secure replacements

Insecure → Secure
Telnet 23 SSH 22
FTP 20/21 SFTP 22 (or FTPS)
HTTP 80 HTTPS 443
LDAP 389 LDAPS 636
POP3 110 / IMAP 143 POP3S 995 / IMAPS 993
SNMPv1/v2 SNMPv3 (same ports, better auth/crypto)
Also memorize cold
Port Protocol
53 DNS
67/68 DHCP
88 Kerberos
123 NTP
161/162 SNMP
445 SMB
3389 RDP
1433 MSSQL
3306 MySQL
Exam angle: Replace cleartext protocols. RDP is encrypted but still high-risk - restrict, MFA, jump hosts.
9

Architecture picker Architecture 18%

Need Prefer
Filter by IP / port / protocol Firewall / NGFW
Stop web app attacks (SQLi, XSS) WAF
Alert only on bad traffic IDS
Block bad traffic inline IPS
Public services, protect internal net DMZ
Authenticate before network access NAC / 802.1X
Remote users, full network path VPN (IPsec or TLS)
App-specific remote access ZTNA
Admin entry choke point Jump / bastion host
Govern SaaS / shadow IT CASB
Find cloud misconfigs CSPM
Trap: NAT hides addresses; it is not a full security control. VLANs alone do not secure - you still need routing / firewall policy.
10

Cloud, data & recovery

Model Customer still owns
IaaS OS, apps, data, identity configs
PaaS Apps, data, access
SaaS Identities, data, configuration

Data states

  • At rest → encrypt, ACL, backup
  • In transit → TLS / VPN
  • In use → access control, enclaves

Recovery terms

  • RTO = max downtime
  • RPO = max data loss
  • Hot > warm > cold site
  • Full / differential / incremental
Rule: Shared responsibility never drops customer ownership of data and access. Public bucket → remove public access first.
11

IAM picker

Model / tech When
RBAC Job roles drive access (enterprise default)
ABAC Attributes / context (dept, device, location)
MAC Labels / classifications; users cannot override
DAC Owner decides (flexible, inconsistent)
SAML Federated SSO (XML assertions)
OAuth 2.0 Delegated authorization (not login by itself)
OIDC Identity layer on OAuth
Kerberos Ticket auth in Windows domains
RADIUS VPN / Wi-Fi AAA
TACACS+ Network device admin AAA (separates AAA)
PAM / JIT Privileged vaulting, short-lived admin
Know Have Are Somewhere you are FIDO2 / WebAuthn
Trap: OAuth grants access; OIDC proves identity. Username alone is identification, not authentication.
12

Incident response Ops 28%

NIST-style lifecycle
  1. Preparation: plans, tools, training, logging
  2. Identification: triage, scope, severity
  3. Containment: isolate, block IOC, disable account
  4. Eradication: remove malware, patch, reset creds
  5. Recovery: restore, monitor for reinfection
  6. Lessons learned: update playbooks / controls
First move traps: Spreading malware → contain. Compromised account → disable / revoke sessions. Suspected disk evidence → preserve; do not casually wipe.
Forensics must-knows
  • Order of Volatility: CPU/cache → RAM → network → disk → backups
  • Chain of custody, write blocker, hash before & after image
  • Legal hold = stop destroying relevant records
12b

Ops tools & hardening Ops 28%

Tool Job
SIEM Correlate logs → alerts
SOAR Automate playbooks / tickets
EDR / XDR Endpoint (and beyond) detect + respond
UEBA Anomalous user / entity behavior
DLP Stop / detect data exfil
FIM Unauthorized file changes
Vuln management flow
  1. Inventory → scan (prefer credentialed) → validate → prioritize by risk → remediate / mitigate → verify → report

Scan / test distinctions

  • Vuln scan = finds known issues
  • Pen test = authorized exploit to prove impact
  • Red team = adversary simulation
  • Purple team = red + blue improve detection

Email / endpoint controls

  • SPF + DKIM + DMARC
  • Sandbox attachments; URL rewrite
  • MDM: lock, encrypt, remote wipe
  • BYOD vs COPE vs CYOD
13

Risk & governance Program 20%

Document Role
Policy High-level management intent
Standard Mandatory specific requirement
Procedure / SOP Step-by-step how
Guideline Recommended, not mandatory
Baseline Minimum secure config
SLE = Asset Value × EF ALE = SLE × ARO Risk ≈ Threat × Vulnerability × Impact Responses: Avoid | Mitigate | Transfer | Accept
Third-party essentials
  • Due diligence before; due care ongoing
  • SLA, NDA, right to audit, DPA / data return on offboard
  • BIA → BCP (keep business running) vs DRP (restore IT)
NIST ISO 27001 PCI-DSS GDPR HIPAA SOC 2
!

Common traps

Trap Reality
Hash "encrypts" data Hash is one-way integrity
Base64 protects secrets Encoding only - trivially reversed
Eradicate first in a live breach Contain (and preserve evidence) first
IDS blocks attacks IDS detects; IPS prevents
OAuth = login OAuth authorizes; OIDC authenticates
VLAN = secure by itself Needs firewall / ACL enforcement
Passing a compliance scan = secure Compliance ≠ full security
Study only Domain 1-2 buzzwords Ops + GRC are ~48% combined
✓

Last-minute checklist

  1. Control category vs type: answer what the stem actually asks
  2. Crypto: hash / encrypt / sign / encode - pick by need (AES-256, SHA-256)
  3. Social eng + malware + SQLi/XSS/MITM distinctions cold
  4. Secure port replacements + high-risk ports (3389, 445)
  5. IDS vs IPS, WAF vs firewall, SIEM vs SOAR, EDR vs AV
  6. IR order: Prep → ID → Contain → Eradicate → Recover → Lessons
  7. RTO vs RPO; hot/warm/cold; shared responsibility by cloud model
  8. RBAC/ABAC/MAC; SAML vs OAuth vs OIDC; MFA factors
  9. ALE/SLE/ARO; avoid/mitigate/transfer/accept; policy hierarchy
  10. PBQs: skip early if stuck, return after MCQs

Discussion

No comments yet.

Log in to comment.