CompTIA Security+ (SY0-701) Exam-Day Cheat Sheet
High-yield reference matrices, control taxonomies, cryptographic algorithms, and attack vector summaries for the CompTIA Security+ (SY0-701) examination. Memorize these critical tables before sitting for your exam.
📌 Quick Summary / Core Test Principles:SY0-701 Quick Rules: Controls: Technical (logical machine logic), Managerial (policy/governance), Operational (human procedure); Types: Preventative (blocks), Detective (records), Corrective (fixes), Compensating (substitutes); Cryptography: AES (symmetric, 128/192/256), RSA/ECC (asymmetric), SHA-256 (hash/integrity), HMAC (integrity+auth); Ports: 88 Kerberos, 49 TACACS+, 636 LDAPS, 1812/1813 RADIUS, 514 Syslog-TLS, 161/162 SNMPv3; Incident Response (NIST): Preparation -> Detection -> Containment -> Eradication -> Recovery -> Lessons Learned.
Governance & Architecture
Security Control Categories & Functional Types
| Control Category / Type | Primary Purpose & Operational Mechanism | Enterprise Implementation Example | CompTIA Exam Distinction |
|---|---|---|---|
| Technical (Logical) Controls | Enforced through hardware, software, or firmware computer logic and automated rules. | Firewalls, IDS/IPS, access control lists (ACLs), full-disk encryption, MFA tokens. | Implemented via machine code and electronic configurations, not human paperwork. |
| Managerial (Administrative) Controls | Strategic governance, policies, compliance frameworks, risk assessments, and oversight established by leadership. | Acceptable Use Policy (AUP), annual security awareness training, third-party vendor risk assessments. | Focuses on administrative decisions, documentation, and organizational rules. |
| Operational Controls | Day-to-day procedures and tactical human workflows executed by personnel. | Security guards, backup tape rotation, incident response runbook drills, manual visitor sign-in logs. | Executed by people carrying out standard operational workflows. |
| Preventative Control Type | Actively stops an unauthorized action or security incident before or as it attempts to occur. | Biometric mantrap door locks, next-gen firewall drop rules, application whitelisting. | Acts as a barrier; blocks the unauthorized event in real time. |
| Detective Control Type | Identifies, discovers, and records unauthorized activities or anomalies during or after an incident. | CCTV security cameras, network IDS alerts, motion sensors, audit log review engines. | Does not block traffic; records evidence and triggers notifications. |
| Corrective Control Type | Restores systems and recovers services to a normal state following a security breach or system failure. | Restoring servers from clean immutable backups, applying emergency firmware patches, rebooting quarantined VMs. | Acts after the event to mitigate damage and restore normal operations. |
| Compensating Control Type | Alternative or secondary safeguard deployed when a primary control is technically unfeasible or cost-prohibitive. | Placing legacy unpatchable medical devices on an isolated, monitored VLAN behind an inline firewall. | Temporarily or permanently satisfies policy requirements using alternative protections. |
| Deterrent Control Type | Discourages potential threat actors from attempting a violation through psychological discouragement. | Prominent warning banners on login screens, guard dog warning signs, visible dummy cameras. | Psychological barrier; does not physically or technically prevent determined adversaries. |
💡 Pro Tip:On the Security+ exam, first determine whether the question asks for the IMPLEMENTATION CATEGORY (Managerial, Operational, Technical) or the FUNCTIONAL TYPE (Preventative, Detective, Corrective, Compensating, Deterrent). Do not mix up the two classification dimensions.
Cryptography Core
Cryptographic Algorithms, Key Lengths & Protocols
| Algorithm / Standard | Type & Architecture | Approved Key Lengths / Modes | Primary Real-World Use Case |
|---|---|---|---|
| AES (Advanced Encryption Standard) | Symmetric block cipher (128-bit block size) | 128, 192, 256 bits (GCM mode for authenticated encryption; CBC mode requires IV) | Bulk data encryption, TLS transport payloads, full-disk BitLocker encryption. |
| ChaCha20-Poly1305 | Symmetric stream cipher with Poly1305 authenticator | 256 bits | High-performance mobile and IoT encryption without hardware AES-NI acceleration (WireGuard VPN). |
| RSA (Rivest-Shamir-Adleman) | Asymmetric public key based on factoring large prime numbers | 2048, 3072, 4096 bits (minimum 2048-bit mandated) | Digital certificates (X.509), digital signatures, legacy TLS key exchange. |
| ECC (Elliptic Curve Cryptography) | Asymmetric public key based on algebraic elliptic curve math | 256-bit (P-256 ≈ RSA-3072 strength), 384-bit (P-384 ≈ RSA-7680 strength) | Modern TLS 1.3 key exchange (ECDHE), digital signatures (ECDSA/Ed25519), mobile/IoT devices. |
| Diffie-Hellman (DH / ECDH) | Asymmetric key agreement protocol (not data encryption) | Ephemeral modes (DHE, ECDHE) mandate Perfect Forward Secrecy (PFS) | Secure negotiation of shared symmetric session keys over an untrusted network. |
| SHA-2 / SHA-3 | Cryptographic one-way hashing algorithms | SHA-256, SHA-384, SHA-512 (SHA-3 uses sponge construction) | Integrity verification, digital signature hashing, code signing certificates. |
| HMAC (Hash-based Message Authentication Code) | Keyed hash combining shared secret key with cryptographic hash | HMAC-SHA256, HMAC-SHA512 | Message integrity and source authentication between two parties sharing a secret key. |
| Argon2 / bcrypt / PBKDF2 | Key Derivation Functions (KDF) / Password hashing | Configurable salt length, computational work factor (iterations), memory-hardness | Secure storage of user passwords in databases; resists GPU and ASIC brute-force cracking. |
💡 Pro Tip:Remember key equivalence: 256-bit ECC provides equivalent cryptographic protection to 3072-bit RSA with a fraction of the computational and memory footprint, making ECC the premier choice for constrained mobile and IoT devices.
Network Security
Common Port Numbers & Secure Protocol Replacements
| Insecure / Legacy Protocol | Insecure Port | Secure Standard Replacement | Secure Port & Mechanism |
|---|---|---|---|
| HTTP (Hypertext Transfer Protocol) | TCP 80 (Cleartext web traffic) | HTTPS (HTTP over TLS) | TCP 443 (TLS 1.3 encrypted browser sessions). |
| Telnet (Remote Terminal) | TCP 23 (Cleartext terminal credentials) | SSH (Secure Shell) | TCP 22 (Asymmetric host key + symmetric session encryption). |
| FTP (File Transfer Protocol) | TCP 21 (Command), 20 (Data) | SFTP (SSH File Transfer) or FTPS (FTP over SSL) | TCP 22 for SFTP; TCP 990 for FTPS explicit/implicit. |
| DNS (Domain Name System) | UDP/TCP 53 (Unencrypted queries/responses) | DNSSEC / DoH (DNS over HTTPS) / DoT (DNS over TLS) | TCP 443 (DoH) or TCP 853 (DoT); DNSSEC validates origin authenticity and record integrity. |
| LDAP (Lightweight Directory Access) | TCP 389 (Cleartext Active Directory queries) | LDAPS (LDAP over SSL/TLS) | TCP 636 (X.509 certificate encrypted directory lookups). |
| SNMPv1 / SNMPv2c | UDP 161 / 162 (Cleartext community strings) | SNMPv3 | UDP 161 / 162 (Adds user authentication via SHA and privacy via AES-128/256 encryption). |
| SMTP / POP3 / IMAP (Cleartext Email) | TCP 25 (SMTP), 110 (POP3), 143 (IMAP) | SMTPS, POP3S, IMAPS (Explicit TLS/STARTTLS) | TCP 587/465 (SMTPS Submission), TCP 995 (POP3S), TCP 993 (IMAPS). |
| RDP (Remote Desktop Protocol) | TCP 3389 (Cleartext or legacy RDP encryption) | RDP with Network Level Authentication (NLA) over TLS | TCP 3389 (Requires pre-authentication before full GUI desktop session initialization). |
💡 Pro Tip:CompTIA loves asking which secure protocol replaces an insecure legacy service. Always match Telnet -> SSH (22), FTP -> SFTP (22), HTTP -> HTTPS (443), LDAP -> LDAPS (636), and unencrypted SNMP -> SNMPv3 (161/162).
Architecture & Defense
Network Security Appliance & Perimeter Defense Matrix
| Appliance / Technology | OSI Layer | Primary Defensive Function | Typical Network Placement |
|---|---|---|---|
| Next-Generation Firewall (NGFW) | Layer 3 through Layer 7 | Deep packet inspection (DPI), application identification, TLS decryption, URL filtering, integrated threat intelligence. | Enterprise network perimeter, between trusted internal zones and untrusted internet/DMZ. |
| Web Application Firewall (WAF) | Layer 7 (Application) | Inspects HTTP/HTTPS transactions to detect and block OWASP Top 10 exploits (SQLi, XSS, CSRF, SSRF). | In front of public-facing web applications or integrated into cloud load balancers/CDNs. |
| Inline IPS (Intrusion Prevention System) | Layer 3 through Layer 7 | Active inline packet inspection; immediately drops malicious packets and resets suspicious connections (TCP RST). | Directly in the data path immediately behind perimeter firewalls or between critical VLANs. |
| Passive IDS (Intrusion Detection System) | Layer 3 through Layer 7 | Passive out-of-band monitoring of mirrored traffic; generates alerts without blocking or delaying live packets. | Connected to switch SPAN (mirror) ports or passive optical network TAPs. |
| Forward Proxy Server | Layer 7 (Application) | Intercepts outbound internal client requests to the internet; performs URL content filtering, caching, and client anonymity. | Between internal user workstations and the outbound internet egress gateway. |
| Reverse Proxy Server | Layer 7 (Application) | Intercepts inbound public internet requests; provides TLS termination, backend server cloaking, caching, and load balancing. | In the DMZ or edge, positioned directly in front of backend application and database clusters. |
| Unidirectional Data Diode | Layer 1 (Physical) | Hardware-enforced one-way data transmission (fiber optic transmitter with no return path); physically blocks inbound traffic. | Between critical Operational Technology (OT/SCADA) networks and corporate IT networks. |
| Bastion Host / Jump Box | Layer 7 (Application) | Hardened, heavily monitored gateway server through which administrators must authenticate before managing internal systems. | In a management DMZ, bridging administrative workstations to isolated production server enclaves. |
💡 Pro Tip:Remember: IDS is PASSIVE (detects, alerts, out-of-band); IPS is ACTIVE (inline, drops packets in real time). WAF protects WEB APPLICATIONS on Layer 7 HTTP/HTTPS; NGFW protects the entire network perimeter across all protocols.
Security Operations
Incident Response Lifecycle & Digital Forensics Standards
| Phase / Standard | Governing Standard | Core Objectives & Key Actions | Critical Exam Distinction |
|---|---|---|---|
| 1. Preparation | NIST SP 800-61r2 | Developing incident response policies, establishing the CSIRT team, acquiring forensic tools, conducting tabletop training. | Occurs before any incident begins; builds capability and establishes communication trees. |
| 2. Detection & Analysis | NIST SP 800-61r2 | Monitoring telemetry (SIEM, EDR), identifying indicators of compromise (IoCs), validating alerts, determining incident scope. | Differentiates false positives from genuine security breaches; scopes the attack vector. |
| 3. Containment | NIST SP 800-61r2 | Stopping the active spread of the intrusion (isolating network VLANs, disabling accounts, blocking C2 IPs) while preserving RAM. | Prioritize logical network isolation over powering off machines to preserve volatile RAM evidence. |
| 4. Eradication | NIST SP 800-61r2 | Removing all threat remnants from the environment: deleting malware, closing vulnerabilities, rebuilding systems from golden images. | Purging the root cause so the adversary cannot immediately re-enter. |
| 5. Recovery | NIST SP 800-61r2 | Restoring clean systems to normal production operations, validating functionality, and conducting heightened continuous monitoring. | Returning business operations to safe normalcy with heightened post-incident monitoring. |
| 6. Post-Incident Activity | NIST SP 800-61r2 | Conducting the formal lessons learned meeting, creating the final incident report, updating policies to prevent recurrence. | Mandatory final step; informs future preparation and updates defense-in-depth controls. |
| Order of Volatility (RFC 3227) | RFC 3227 Forensic Standard | 1) CPU registers/cache -> 2) RAM/routing tables/ARP cache -> 3) Swap/temporary files -> 4) Disk -> 5) Remote logs -> 6) Archival backups. | Evidence must be gathered from most perishable (RAM) to least perishable (hard drive/backups). |
| Chain of Custody & Write Blockers | Federal Rules of Evidence | Hardware write blockers prevent drive tampering during bit-stream cloning; matching cryptographic hashes prove evidence integrity. | A broken chain of custody or mismatched hash makes digital evidence legally inadmissible in court. |
💡 Pro Tip:For forensic investigations: NEVER pull the power plug on a running, compromised machine unless explicitly required by policy. Pulling the plug destroys volatile RAM (active network connections, running processes, encryption keys). Isolate logically instead!
Risk & Compliance
Risk Management Formulas & Business Impact Metrics
| Metric / Formula | Mathematical Definition | Key Operational Meaning | Practical Calculation Example |
|---|---|---|---|
| Single Loss Expectancy (SLE) | SLE = Asset Value (AV) × Exposure Factor (EF) | Monetary loss realized each single time a specific threat occurs. | $1,000,000 datacenter (AV) suffering 30% flood damage (EF = 0.30) -> SLE = $300,000. |
| Annualized Loss Expectancy (ALE) | ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO) | Expected cumulative financial loss from a threat over a one-year period. | SLE of $200,000 occurring once every 4 years (ARO = 0.25) -> ALE = $50,000 per year. |
| Cost-Benefit Analysis | Net Annual Value = (ALE_before - ALE_after) - Annual_Cost_of_Control | Determines whether a proposed security safeguard is financially justified. | Reducing ALE from $100k to $10k with a $30k control -> ($90k savings) - $30k cost = $60k net benefit. |
| Recovery Time Objective (RTO) | Time target measured forward from incident to service restoration | Maximum acceptable duration of system or service downtime after an outage. | An enterprise payroll system must be restored within 4 hours (RTO = 4h) to avoid payroll delays. |
| Recovery Point Objective (RPO) | Time target measured backward from incident to most recent data state | Maximum acceptable amount of transactional data loss measured in time. | Backing up transaction logs every 15 minutes ensures maximum data loss is 15 minutes (RPO = 15m). |
| Mean Time to Detect (MTTD) | Average elapsed time from compromise to detection | Measures detection speed and effectiveness of SOC monitoring and SIEM correlation. | Adversary breaches network at 08:00; alert triggered at 08:30 -> MTTD = 30 minutes. |
| Mean Time to Remediate (MTTR) | Average elapsed time from detection to full threat containment and resolution | Measures responsiveness and efficacy of incident response playbooks and teams. | Alert triaged at 08:30; threat completely neutralized at 10:30 -> MTTR = 2 hours. |
| Mean Time Between Failures (MTBF) | Total operational uptime divided by number of failure events | Predicts the reliability and expected lifespan of hardware components. | Hard drive manufacturer rates enterprise SAS drives at 1,500,000 hours MTBF. |
💡 Pro Tip:Remember the fundamental distinction: RTO is about TIME TO RESTORE SERVICE (downtime); RPO is about DATA LOSS (backup frequency). Never confuse the two on scenario questions!