Cram Sheet · Final Review

Security+ SY0-701: Final Review Sheet

Targeted weak-spot terms organized by domain, with recall mnemonics. Exam: July 31, 2026.

Domain 1.0: General Security Concepts (12%)

Policy-Driven Access Control: Zero Trust concept combining adaptive identity with predefined rules. Policy Engine evaluates, Policy Administrator enforces via the PEP. Mnemonic: PDP Decides, PEP Performs (enforces).
Stream vs. Block Cipher: Stream: encrypts bit-by-bit/byte-by-byte, fast, real-time (e.g. RC4). Block: encrypts fixed-size chunks with padding/mode (e.g. AES), generally stronger. Mnemonic: STREAM = river (continuous). BLOCK = brick (fixed size).

On-Path Attack: Attacker positioned between two parties, intercepts and relays live traffic (formerly “man-in-the-middle”). Mnemonic: ON the path = standing in the road between you and your destination.
Insider Threat vs. Shadow IT: Insider threat: malicious or negligent intent with authorized access. Shadow IT: unauthorized tech use, usually convenience-driven, not malicious. Mnemonic: THREAT has teeth. Shadow IT just hides in the shadows.
Privilege Escalation: Vertical: gaining a higher access tier. Horizontal: moving to a different account at the same tier. Mnemonic: Escalator goes UP (vertical). Hallway walk = horizontal.

EAP / 802.1X: 802.1X: port-based Network Access Control, blocks access until auth succeeds. EAP: the authentication framework/method used within it. Mnemonic: 802.1X = the bouncer. EAP = your ID check.
Masking: Data obfuscation that hides part of a field (e.g. last 4 digits of a card number) while keeping the record usable. Mnemonic: A mask covers the face; the person is still there.
RPO vs. RTO: RPO: max acceptable data loss, measured backward in time. RTO: max acceptable downtime before restoration, measured forward. Mnemonic: RPO = Point (data point in time). RTO = Time (time to restore).
Wireless Encryption Upgrade: Best answer: AES, the actual cipher used inside WPA2/WPA3. TKIP and WEP are broken/deprecated; WPA is the protocol, not the cipher. Mnemonic: AES = the engine. WPA = the car it's bolted into.

NetFlow: Traffic flow statistics collection. A probe watches traffic and sends summary records to a collector; not full packet capture. Mnemonic: NetFLOW = watching the flow, not the content.
SPF / DKIM / DMARC: SPF: DNS record listing authorized senders. DKIM: digital signature validating message integrity. DMARC: policy layer enforcing action + reporting if SPF/DKIM fail. Mnemonic: SPF = guest list. DKIM = wax seal. DMARC = the bouncer's rulebook.
Ticket Creation: Formal record/tracking of an incident: documents timeline, actions taken, and ownership for accountability. Mnemonic: No ticket, no trail.
Continuous Integration: Practice of frequently merging code changes into a shared repo with automated build/test on each merge. Mnemonic: CI = Constantly Integrating.
Blocked Content: DNS/content filtering outcome: traffic denied based on category, reputation, or policy rule. Mnemonic: Blocked = bounced at the door before it's on your network.

Committees: Governance bodies (e.g., change control board, security steering committee) that review and approve policy and risk decisions before operations enforces them. Mnemonic: Committee writes it, ops enforces it.
Risk Tolerance: Degree of risk variance an organization will accept on a specific risk (vs. risk appetite, which is the overall willingness to accept risk). Mnemonic: Tolerance = what you can stomach right now.
Pen Testing: White / Black / Gray Box: White box: full knowledge given beforehand. Black box: zero prior knowledge, simulates an external attacker. Gray box: partial knowledge (e.g. user-level access). Mnemonic: White = full light. Black = pitch dark. Gray = dim.
SOW / SLA / MSA / MOU: SOW: defines deliverables/timeline. SLA: defines minimum performance/uptime. MSA: overarching contract governing future SOWs. MOU: non-binding mutual intent. Mnemonic: SOW = what you'll DO. SLA = how WELL. MSA = the contract UNDER it all. MOU = just a handshake.

Security+ SY0-701: Final Review Sheet