Cram Sheet · Weak Spots
Pulled from the Ultimate SY0-701 Study Guide — targeted at flagged confusion points. Exam: July 31, 2026.
Ask “who decides who gets access?” for each model — that single question separates all four.
| Model | Who decides | Basis |
|---|---|---|
| DAC (Discretionary) | The data owner | Owner's own judgment — flexible, weak consistency |
| MAC (Mandatory) | The system, via fixed labels | Classification labels (Top Secret/Secret/etc.) — no user override |
| RBAC (Role-based) | An admin, via job role | What role you hold (e.g., “HR Manager”) |
| ABAC (Attribute-based) | A policy engine | Multiple attributes at once (role + time + location + device) |
Espionage motive points to a nation-state actor. An APT (Advanced Persistent Threat) is advanced, well-funded, and persistent — that combination of traits is itself the signal for a nation-state actor, as opposed to a hacktivist (ideological/political motive) or an unskilled attacker (low sophistication, low funding).
A rootkit hides and persists deep in the system, typically at the kernel or boot level, to maintain long-term concealed access. Spyware's job is different: it collects and exfiltrates data (keystrokes, browsing habits, credentials) rather than focusing on staying hidden at the system level.
DNS poisoning (DNS spoofing) corrupts DNS resolution so a device resolves a domain to the wrong IP. Impact scope depends on where the poisoning happens:
| Method | How | Impact |
|---|---|---|
| Host file modification | Attacker edits the local hosts file on one device (needs local access) | Single user |
| On-path interception | Attacker sits mid-conversation, spoofs the reply in real time | Single user/session |
| DNS server compromise | Attacker modifies records on the DNS server itself | Multiple users / org-wide |
An on-path attack (formerly “man-in-the-middle”) is broader than DNS poisoning specifically: it's an attacker positioned between two parties, intercepting and relaying live traffic of any kind — DNS interception is just one way an on-path attacker can operate.
Related terms: DNS hijacking (domain hijacking) — the attacker takes control of a domain's registration itself and repoints it, affecting everyone who visits that domain. Pharming — redirects users to a fraudulent site with no user action required; the user types the correct address and still lands on the attacker's site because DNS resolution itself was corrupted.
| Category | Description |
|---|---|
| Technical | Implemented using hardware, software, and/or firmware components. Can be native or supplemental. |
| Managerial | Support risk management, governance, oversight, strategic alignment, and decision making. |
| Operational | Aligned with a process that is primarily implemented and executed by people. |
| Physical | Designed to address physical interactions. Generally related to buildings and equipment. |
The Managerial/Operational split is the one that trips people up: Managerial controls are about the decision layer (policy, governance, risk strategy), while Operational controls are the people executing a process day to day. If a question describes a committee approving a policy, that's managerial; if it describes people following a procedure, that's operational.
Categorize vulnerabilities by their root cause — misconfiguration, missing patch, design flaw — not by the symptom they produce on the surface. Two vulnerabilities that look similar in their observed effect can have completely different root causes, and the exam tests whether you can trace back to the actual underlying issue rather than pattern-matching on the visible symptom.
Source: Ultimate CompTIA SY0-701 Security+ Study Guide (Miranda) — cross-referenced against Professor Messer notes and other session materials.