Cram Sheet · Exam Eve
Security+ SY0-701: Exam Eve Cram Sheet
Exam Fri, Jul 31, 2026 @ 11:30 AM · every flagged weak spot & missed point, one line each.
Domain 1 — General Security Concepts
- PDP vs PEP: Policy Decision Point (Engine + Administrator) decides; Policy Enforcement Point carries out the decision.
- Stream vs block cipher: stream encrypts bit/byte by byte, fast, real time (RC4); block encrypts fixed size chunks with padding (AES), generally stronger.
- TPM vs HSM vs KMS vs Secure Enclave: TPM secures one system/boot (BitLocker); HSM is a physical device managing keys for many systems; KMS is a centralized key lifecycle service; Secure Enclave is an isolated on-chip processor for sensitive data.
- Backups / redundancy for continuity: corrective control, not preventive.
- Change management vs updating policies/procedures: change management is the broad approve/test/document umbrella; updating policies/procedures is the narrower act of revising the rules themselves.
Domain 2 — Threats, Vulnerabilities, Mitigations
- Espionage motive: nation-state actor. Ideological/political cause: hacktivist.
- APT: advanced, well-funded, persistent = nation-state.
- Rootkit vs spyware: rootkit hides and persists deep in the system; spyware collects and exfiltrates data.
- DNS poisoning vs on-path attack: poisoning corrupts DNS records/cache; on-path is an attacker positioned between two parties intercepting live traffic.
- Password spraying vs dictionary attack: spraying = few common passwords across MANY accounts; dictionary = many passwords against ONE account.
- Vulnerability categorization: sort by root cause (misconfig, missing patch, design flaw), not by symptom.
- Insider threat vs shadow IT: insider threat misuses authorized access, malicious or negligent; shadow IT is unauthorized tech use, usually convenience driven, not malicious.
- File-based vector vs spear-phishing: malware riding inside an attachment is file-based; a targeted deceptive message is spear-phishing, a separate category.
- Privilege escalation: vertical = higher access tier; horizontal = same tier, different account.
Domain 3 — Security Architecture
- IaaS/PaaS/SaaS responsibility: IaaS, you manage OS/apps/data; PaaS, provider also covers OS/runtime, you cover app/data; SaaS, provider covers nearly everything, you cover data/access.
- Edge vs fog computing: edge processes at/near the device; fog processes at the local network layer between edge and cloud.
- SD-WAN vs SASE: SD-WAN is software-defined WAN path selection/routing; SASE is SD-WAN plus a cloud-delivered security stack (SWG, CASB, ZTNA, FWaaS).
- ICS/OT priority order: Safety > Availability > Integrity > Confidentiality, inverted from standard IT's Confidentiality-first CIA triad.
- Platform diversity: different hardware/software platforms to reduce risk, distinct from high availability (uptime/failover) and redundancy (backup components).
- Medical IoT security question: answer is access control + encryption, not segmentation, unless segmentation is actually offered as a choice.
- EAP vs 802.1X: 802.1X is the port-based access control mechanism; EAP is the authentication framework used inside it.
- Masking: hides part of a field (last 4 digits of a card) while keeping the record usable.
- RPO vs RTO: RPO = max acceptable data loss, measured backward in time; RTO = max acceptable downtime, measured forward.
- Wireless encryption upgrade question: answer is AES, the actual cipher; WPA is just the protocol it runs inside, TKIP/WEP are broken.
CVSS Quick Reference
- 8 base metrics: AV, AC, PR, UI, S, C, I, A (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability).
- Severity bands: 0 None · 0.1–3.9 Low · 4.0–6.9 Medium · 7.0–8.9 High · 9.0–10.0 Critical.
Ports: Most-Tested (Domain 4)
| Port | Service | Port | Service | Port | Service |
|---|
| 20/21 | FTP | 69 | TFTP | 445 | SMB |
| 22 | SSH/SFTP/SCP | 80 | HTTP | 1433 | MS SQL |
| 23 | Telnet | 88 | Kerberos | 3306 | MySQL |
| 25 | SMTP | 110 | POP3 | 3389 | RDP |
| 53 | DNS | 119 | NNTP | 5060/1 | SIP |
| 67/68 | DHCP | 123 | NTP | 8080 | HTTP alt/proxy |
| 135 | RPC | 137–139 | NetBIOS | 465/587 | SMTPS |
| 143 | IMAP | 161/162 | SNMP | 514 | Syslog |
| 389 | LDAP | 443 | HTTPS | 636 | LDAPS |
| 993 | IMAPS | 995 | POP3S | | |
Nmap Flags: Most-Tested (Domain 4.1)
| Flag | What it does |
|---|
-sS | TCP SYN scan, “stealth”/half-open, never completes the handshake, less likely to be logged |
-sT | TCP connect scan, full three-way handshake, noisier, used when SYN scan isn't available |
-sU | UDP scan, slower and less reliable than TCP scans |
-sV | Service/version detection, identifies what's running on open ports |
-O | OS detection, fingerprints the target OS |
-sn | Ping scan, host discovery only, no port scan |
-Pn | Skip host discovery, treats all hosts as up and scans anyway |
-p | Port spec, e.g. -p 1-1000, -p- for all 65535 |
-A | Aggressive scan, bundles OS detection + version detection + scripts + traceroute |
-T0–T5 | Timing template, paranoid to insane, lower is slower/stealthier |
Domain 4 — Security Operations
- NetFlow: traffic flow statistics, not full packet capture.
- SPF / DKIM / DMARC: SPF lists authorized senders in DNS; DKIM is a digital signature validating message integrity; DMARC is the policy layer enforcing action when SPF/DKIM fail.
- Ticket creation: formal record/tracking of an incident for accountability.
- Monitoring/asset tracking vs audits: “continuous” or “consistently” points to monitoring/tracking; “periodically” or “annually” points to an audit or certification.
- Group-level permissions vs role-based access: a group ties to ONE resource/team; a role ties to a job function spanning MANY systems.
- Endpoint logs: show activity/installs on the device itself, not app logs (perf/errors), OS security logs (broader events), or IDS/IPS logs (network attacks).
- Proprietary/third-party threat feeds: curated, industry or device specific intel, more targeted than general OSINT.
- Ownership question (asset mgmt): the Assignment/Accounting phase is what establishes ownership.
Domain 5 — Security Program Management
- Exposure Factor vs SLE vs ALE: EF = raw % of asset value lost (the tell: a percentage in the question). SLE = Asset Value × EF, one incident in dollars. ALE = SLE × ARO, dollars per year.
- Committees: change control board / security steering committee approve policy and risk decisions before operations enforces them.
- Risk tolerance vs risk appetite: tolerance is acceptable variance on ONE specific risk; appetite is the org's overall willingness to accept risk.
- Pen test box types: white box = full knowledge given beforehand; black box = zero prior knowledge, simulates an outside attacker; gray box = partial knowledge.
- SOW / SLA / MSA / MOU: SOW defines deliverables/timeline; SLA defines minimum performance/uptime; MSA is the overarching contract governing future SOWs; MOU is non-binding mutual intent.
- Self-assessment for compliance: build a checklist against the regulation's actual requirements, not hire an external auditor.
Governance Frameworks
- NIST CSF: voluntary, common in private industry. 5 functions: Identify, Protect, Detect, Respond, Recover.
- NIST SP 800-53: control catalog underlying the mandatory federal RMF.
- ISO/IEC 27001: international, certifiable information security management system (ISMS) standard.
- COBIT: IT governance/audit framework maintained by ISACA (CISA/CISM creators).
PBQ Traps & Exam Strategy
- Qualifier words (“best,” “first,” “most likely”) are the #1 PBQ failure point. Read the LAST sentence of the scenario first.
- Jump box belongs in the management zone, never the DMZ.
- ICS/OT compensating controls: reason from the safety/availability-first priority order, not standard IT confidentiality-first logic.
- 3 to 5 PBQs are typically front-loaded at the start of the exam. Partial credit beats skipping — attempt every part.
- Third-party sims (e.g. Walker Press) sometimes use non-standard terms. Trust Professor Messer / official CompTIA wording on exam day.
Security+ SY0-701: Exam Eve Cram Sheet — you know this. Sleep well.