Cram Sheet · Deficient Points
Built from a quiz score export — 16 missed of 90 — CompTIA Security+ SY0-701. Built from the full questions, choices, and explanations provided, more precise than a first pass.
Objective 1.1 — Types of Security Controls
Offsite backups and redundancy for business continuity are corrective controls — they repair or mitigate damage after an incident.
| Before the incident | During | After the incident |
|---|---|---|
| Preventive, Deterrent, Directive | Detective | Corrective, Compensating |
Objective 1.3 — Change Management Process and Security Impact
Correct answer: Updating policies and procedures, not “change management.” Change management is the broader umbrella term covering the whole process — approval, testing, documentation. Updating policies and procedures is the specific, narrower act of revising the rules and steps themselves in response to new threats or standards.
Objective 2.1 — Threat Actors and Motivations
An employee secretly manipulating balances and transferring small amounts to a personal account is an insider threat — misuse of legitimate access for personal gain. A cybercriminal operates from outside; a hacktivist is politically motivated; an unskilled attacker lacks the access and sophistication for sustained, discreet manipulation like this.
Objective 2.2 — Threat Vectors and Attack Surfaces
Correct answer: File-based threat, not spear-phishing. CompTIA's threat vector list treats “message-based” and “file-based” as separate categories. Spear-phishing is about a deceptive message tailored to a specific target. This scenario's emphasis is the malware hidden inside the attachment itself — the file is the vector, regardless of who it was addressed to.
Objective 2.4 — Indicators of Malicious Activity
Common passwords tried against many accounts is password spraying. The same passwords tried repeatedly against one account would be a dictionary attack. Account count is the tell.
Objective 3.1 — Security Implications of Architecture Models
Correct answer: physical safety, ahead of confidentiality, efficiency, or bandwidth. A breach or malfunction in an ICS can directly harm equipment, production, or people, not just data.
| Standard IT priority | ICS / OT priority |
|---|---|
| 1. Confidentiality | 1. Safety |
| 2. Integrity | 2. Availability |
| 3. Availability | 3. Integrity |
| — | 4. Confidentiality |
Objective 3.4 — Resilience and Recovery in Security Architecture
Using different hardware/software platforms to reduce risk is platform diversity, distinct from high availability (uptime/failover) and redundancy (backup components).
Objective 4.1 — Security Techniques for Computing Resources
Correct answer: implementing strict access control and encryption. Segmentation is good real-world practice for these devices too, but it wasn't among this question's answer choices — don't let that substitute for the tested concept: who can access the device, and whether its data is encrypted in transit.
Objective 4.2 — Security Implications of Hardware, Software, and Data Asset Management
Correct answer: monitoring and asset tracking. The key word in the question was “consistently” — audits, pen tests, and compliance certification are all valuable, but they're periodic snapshots. Monitoring/tracking is the continuous process that gives ongoing visibility.
Objective 4.2 — Security Implications of Hardware, Software, and Data Asset Management
Two separate misses landed on the same concept. The Assignment/Accounting phase of asset management exists to establish ownership — who is responsible for an asset from acquisition to decommissioning. Not cost management (financial), not legal compliance, not asset classification (categorizing by sensitivity), and not asset accounting/tracking (financial or physical monitoring) — ownership specifically.
Objective 4.3 — Activities Associated with Vulnerability Management
Correct answer: proprietary/third-party threat feeds — curated intelligence tailored to a specific industry or device type. OSINT is valuable but less curated/specific. DAST and SCA are application-security testing techniques, not ongoing threat monitoring — they don't fit a question asking about continuous, device-specific vulnerability awareness.
Objective 4.6 — Identity and Access Management
Correct answer: group-level permissions, not role-based. This is a genuinely subtle distinction worth internalizing: a group is tied to a specific resource or team — members inherit access to that one shared thing. A role is tied to a job function or responsibility, often spanning many systems (e.g., “Database Administrator”). A newly formed project team needing access to one shared database is a resource-specific, team-based need — that's a group. Role-based would be the answer if the question were about assigning broad permissions by job title across multiple systems.
Objective 4.9 — Using Data Sources to Support an Investigation
Detecting unauthorized application installs needs endpoint logs — they show activity on the device itself. Application logs cover performance/errors, not installs. OS-specific security logs are broader system events. IPS/IDS logs focus on network-based attacks, not what's running locally.
Objective 5.2 — Elements of the Risk Management Process
Correct answer: Exposure Factor (EF). The giveaway is the raw percentage in the question, e.g. “40% loss of data center capacity.” EF is defined specifically as the percentage of an asset's value lost when a threat materializes. This connects directly to SLE = Asset Value × EF, then ALE = SLE × ARO. MTBF measures average time between failures, RTO is maximum acceptable downtime, ALE is the final annualized dollar figure — none of those are expressed as a straight percentage of loss the way EF is.
Objective 5.5 — Types and Purposes of Audits and Assessments
The key element of a good self-assessment is developing a checklist covering the relevant regulation's requirements. Hiring an external auditor would defeat the purpose of a self-assessment, and narrowing scope to only external threats or only financial processes misses most of what a regulation like HIPAA actually covers.
Deficient-Points Study Guide · Security+ SY0-701 · Compiled from quiz score export