Cram Sheet · Concept Review

Security+ (SY0-701) Study Guide

Concept review compiled from study session topics. Exam date: July 31, 2026 · Category-based concept review.

This guide covers the concepts, comparisons, and exam-style distinctions worked through in session, organized by topic area rather than the order they came up. Use it as a quick-reference pass after you've already learned the material in depth — it's built to jog memory, not teach from scratch.

A note on sources: a few practice-exam terms encountered this session did not match official CompTIA terminology (e.g. certain DNS attack names from a third-party, non-CompTIA-affiliated simulator). Those are flagged where relevant — trust the concepts in this guide and your official CompTIA Study Guide / Professor Messer material over any single practice source if they ever conflict.

1. Network Security Architecture

SD-WAN (Software-Defined Wide Area Network): Manages connections between an organization's sites using software instead of fixed hardware circuits. Intelligently routes traffic over broadband, LTE, or MPLS in real time based on performance/cost, and is centrally managed. This is the networking half of SASE.
SWG (Secure Web Gateway): Sits between users and the internet, inspecting outbound web traffic: URL filtering, malware scanning, acceptable-use enforcement.
CASB (Cloud Access Security Broker): Sits between users and cloud apps (Salesforce, Google Workspace, etc.). Gives visibility into cloud service usage and enforces data policy there (e.g. blocking uploads to unapproved storage apps).
ZTNA (Zero Trust Network Access): Replaces “VPN = access to the whole network.” Every request for a specific app is verified (identity, device health, context) before granting access to just that app — “never trust, always verify.”
FWaaS (Firewall as a Service): Cloud-delivered firewall functionality — no physical hardware per site, centrally managed, consistent policy across all locations and remote users.
SASE (Secure Access Service Edge): The umbrella framework: SD-WAN (smart routing) + SWG + CASB + ZTNA + FWaaS (security), delivered as one cloud platform. Built for the reality that traffic no longer flows through a central office firewall.

Exam cue: SASE = SD-WAN (networking) + SWG/CASB/ZTNA/FWaaS (security), bundled into one cloud service.

2. Access Control Models

The fastest way to tell these apart: ask “who decides?”

Model	Who decides	Memory hook
DAC	The resource owner	“Do it yourself” — you own the file, you set permissions (e.g. sharing a Google Doc)
MAC	The system/policy, via labels	“Military Mandates” — classification levels (Top Secret/Secret), centrally set, users can't override
RBAC	Your job role	“Role = Responsibility” — job title determines access, period
ABAC	Multiple attributes combined	“All conditions Add up” — role AND time AND location AND device evaluated together

Rigid→flexible spectrum: MAC (most rigid) → RBAC (fixed by title) → DAC (owner discretion) → ABAC (most granular/context-aware). ABAC is the model behind ZTNA-style verification.

Exam cue: “Access based on classification level, set by an administrator, that a user cannot change” is MAC, not DAC — the giveaway is who has the authority to set it, not who is described as “granting” it.

3. Wireless Attacks

WPS PIN Vulnerability

WPS lets devices connect via an 8-digit PIN instead of a full WPA2 passphrase. The 8th digit is just a checksum, and the router validates the PIN in two separate halves (first 4 digits, then last 3), telling the attacker whether each half was correct.

First half: 10,000 possibilities (4 digits)
Second half: 1,000 possibilities (3 digits)
Total: ~11,000 guesses instead of 10,000,000 — brute-forceable in hours (tools: Reaver, Bully)

Once the PIN is cracked, the attacker recovers the actual WPA/WPA2 passphrase, regardless of its strength. Mitigation: disable WPS entirely.

Exam cue: The flaw is in WPS's split-validation design, not in WPA2 encryption itself.

4. Hardening & System Design

Least Functionality

A system should only run the services, protocols, applications, and ports it actually needs — everything else gets disabled or removed. Fewer running things = smaller attack surface.

Disable unused ports/services
Uninstall unnecessary software
Remove unneeded default accounts/services
Restrict a device to a single primary function where possible

Exam cue: Least Functionality (system services/ports) vs. Least Privilege (user/account permissions) are frequently tested against each other — don't mix them up.

5. DNS Attacks & Domain Threats

DNS Poisoning (DNS Spoofing)

Corrupts DNS resolution so a device resolves a domain to the wrong IP. Impact scope depends on where the poisoning happens:

Method	How	Impact
Host file modification	Attacker edits the local hosts file on one device (needs local access)	Single user
On-path interception	Attacker sits mid-conversation, spoofs the reply in real time	Single user/session
DNS server compromise	Attacker modifies records on the DNS server itself	Multiple users / org-wide

DNS Hijacking (Domain Hijacking)

Attacker takes control of a domain's registration (e.g. compromises the registrar account) and repoints the domain itself. Impact is broad — everyone who visits that domain, since the redirection happens at the authoritative source.

Pharming

Redirects users to a fraudulent site without any user action — no bad link, no mistyped URL. The user types the correct address and still lands on the attacker's site, because the DNS resolution itself was corrupted (host file or server-level poisoning used for fraud).

Exam cue: Phishing tricks the user into acting. Pharming corrupts the resolution infrastructure — the user does nothing wrong. If the URL was typed correctly and still leads to a fake site, it's pharming, not phishing or typosquatting.

6. Web Application Attacks

Attack	Primary goal / mechanism
SQL injection	Malicious input manipulates a SQL query to read, modify, or exfiltrate database contents.
Cross-site scripting (XSS)	Attacker-controlled script is embedded in a trusted page and executes in the victim's browser (steals cookies, performs actions).
Directory traversal	Uses sequences like `../` to escape the intended web root and read arbitrary server files.
Clickjacking	Transparent overlay tricks the user into clicking a hidden UI element, capturing the click for the attacker.
SSRF (Server-Side Request Forgery)	Attacker tricks the server into making requests it shouldn't (e.g. to internal-only resources), using the server's own trust/network access.
CSRF (Cross-Site Request Forgery)	Attacker tricks a logged-in user's browser into submitting a request using the user's existing session/cookies.

Exam cue: SQLi vs. XSS: both are injection attacks, but SQLi executes against the database/server while XSS executes in the victim's browser. SSRF vs. CSRF: SSRF fools the server; CSRF fools the user's session.

7. Malware

RAT (Remote Access Trojan)

Malware that gives an attacker unauthorized remote control over a compromised system via a command-and-control (C2) channel. Capabilities scale with the malware's sophistication and the compromised account's privilege level:

Monitor activity (keystrokes, screen, sometimes webcam/mic)
Modify settings
Browse, copy, or exfiltrate files
Pivot to other networked systems

Exam cue: RAT vs. Worm: a RAT's core purpose is remote control/access for the attacker. A worm's core purpose is self-replication — it spreads automatically without an attacker actively driving it. Different jobs, even though both can be malicious and both can spread.

8. Vulnerability Management — CVSS

CVSS Base Score = Exploitability subscore + Impact subscore

Metric	What it measures
Base score	Overall severity — combines exploitability and impact. Too broad to answer “how easy,” specifically.
Exploitability subscore — Attack Vector (AV) — Attack Complexity (AC) — Privileges Required (PR) — User Interaction (UI)	How easily the vulnerability can be exploited overall, built from Attack Vector (how close the attacker needs to be: Network/Adjacent/Local/Physical), Attack Complexity (whether special preconditions must exist), Privileges Required (what access level the attacker needs beforehand), and User Interaction (whether a victim needs to take an action).
Impact subscore	Consequences to Confidentiality, Integrity, and Availability if exploited — not ease of exploitation.
Temporal score	Adjusts severity over time (exploit code maturity, patch/remediation availability).

Exam cue: A general question (“how easily can this be exploited?”) → Exploitability subscore. A narrower question about preconditions specifically → Attack Complexity (one ingredient within the subscore, not the whole answer).

9. Security Tools

Tool	Interface	Notes
Tcpdump	Command-line	Lightweight packet capture/analysis built for Linux/Unix. Fits hardened, no-GUI, minimal-footprint servers (ties to Least Functionality).
Wireshark (formerly “Ethereal”)	GUI	Full-featured packet analyzer; doesn't fit a “no GUI” requirement.
Sniffer / Network General	GUI	Legacy commercial protocol analyzer product/vendor name; also GUI-based.

Exam cue: “Command-line only,” “no GUI,” “minimal footprint,” or “hardened Linux server” in a question → tcpdump over Wireshark.

Compiled from study session concepts · SY0-701 · Exam date: July 31, 2026