Questions? Call 1.800.716.8955

PASS the CompTIA Security+ (SY0-801)

Quick Reference

This quick reference condenses the facts that SY0-801 questions most often depend on: port numbers, algorithms and key lengths, formulas, recovery metrics, control classifications, incident response phases, access control models, attack indicators, email authentication records, cloud responsibility, and the acronyms you must recognize instantly. Use it for review in the final weeks before the exam and as a lookup while working practice questions. Chapter numbers in parentheses point to the full explanation.

  • Ports and Protocols
  • Common Ports (Chapters 11, 14, 17)
  • Port Transport Protocol Secure? Secure alternative or note

20, 21 TCP FTP (data, control) No — cleartext credentials

SFTP (22) or FTPS (989/990)

22 TCP SSH, SFTP, SCP Yes Replaces Telnet, rlogin, FTP

23 TCP Telnet No — cleartext

SSH (22)

25 TCP SMTP (server to server relay)

No by default STARTTLS on 25; submission on 587

49 TCP TACACS+ Yes — encrypts entire payload

Device administration AAA

53 UDP and

Tcp

DNS (TCP for zone transfers and large responses)

No DNSSEC (integrity), DoT (853), DoH (443)

67, 68 UDP DHCP (server, client) No DHCP snooping on switches

69 UDP TFTP No — no authentication

SFTP or SCP

80 TCP HTTP No HTTPS (443)

88 TCP and

Udp

Kerberos Yes Ticket-based authentication in Active Directory

110 TCP POP3 No POP3S (995)

123 UDP NTP No NTS (Network Time Security); time sync is critical for logs

135 TCP Microsoft RPC endpoint mapper

No Block at perimeter

137-139 UDP and

Tcp

  • NetBIOS No Disable where possible
  • Port Transport Protocol Secure? Secure alternative or note
  • 143 TCP IMAP No IMAPS (993)

161, 162 UDP SNMP (queries, traps) v1/v2c no SNMPv3 (authentication and encryption)

389 TCP and

Udp

LDAP No LDAPS (636) or StartTLS

443 TCP (UDP for

Quic/http/

3)

HTTPS Yes TLS 1.2 or 1.3

445 TCP SMB Depends on version

SMBv3 with encryption; never expose to internet

465 TCP SMTPS (implicit TLS submission)

Yes Alternative to 587

500 UDP IKE (IPsec key exchange)

Yes 4500/UDP for NAT traversal

514 UDP Syslog No Syslog over TLS (6514/TCP)

587 TCP SMTP submission Yes with

Starttls

  • Client-to-server mail submission
  • 636 TCP LDAPS Yes Secure LDAP
  • 853 TCP DNS over TLS (DoT) Yes Encrypted DNS
  • 989, 990 TCP FTPS (data, control) Yes FTP over TLS
  • 993 TCP IMAPS Yes IMAP over TLS
  • 995 TCP POP3S Yes POP3 over TLS
  • 1433 TCP Microsoft SQL Server Depends Never expose to internet

1521 TCP Oracle database listener

  • Depends Never expose to internet
  • 1701 UDP L2TP No by itself Pair with IPsec
  • 1723 TCP PPTP No — broken Replace with IPsec or TLS VPN

1812, 1813 udp radius

(authentication, accounting)

Partial — encrypts password only

RadSec (RADIUS over TLS)

3306 TCP MySQL Depends Restrict to app servers

3389 TCP and

Udp

RDP Encrypted, but

heavily attacked

Gateway, VPN, or ZTNA plus MFA

5060, 5061 TCP and

Udp

SIP, SIP over TLS 5060 no, 5061 yes

Use SRTP for media

5900 TCP VNC Weak Tunnel through SSH or VPN

5985, 5986 TCP WinRM (HTTP, HTTPS) 5985 no, 5986 yes

  • PowerShell remoting
  • Port Transport Protocol Secure? Secure alternative or note
  • 6514 TCP Syslog over TLS Yes Secure log forwarding

8080, 8443 TCP Alternate HTTP, HTTPS 8080 no, 8443 yes

Common for proxies and admin consoles

IPsec itself runs over IP protocol numbers, not ports: ESP is IP protocol 50 (confidentiality, integrity, authentication) and AH is IP protocol 51 (integrity and authentication only, no encryption). Insecure-to-Secure Replacements

  • Insecure Problem Use instead
  • Telnet Cleartext session and credentials SSH
  • FTP, TFTP Cleartext; TFTP has no authentication SFTP, FTPS, SCP
  • HTTP Cleartext; no server authentication HTTPS (TLS 1.2 or 1.3), HSTS
  • SNMPv1/v2c Community strings in cleartext SNMPv3
  • LDAP Cleartext binds LDAPS or LDAP with StartTLS
  • POP3, IMAP Cleartext mail retrieval POP3S, IMAPS

Ssl 2.0/3.0, tls

  • 1.0/1.1
  • Known protocol weaknesses (POODLE, BEAST) TLS 1.2 or 1.3
  • WEP, WPA (TKIP) Broken encryption WPA3 (SAE) or WPA2-AES (CCMP)
  • PPTP Broken authentication (MS-CHAPv2) IPsec IKEv2 or TLS VPN

RDP exposed to internet

Brute force, exploits RDP via VPN, gateway, or ZTNA with

Mfa

DNS Spoofing, cache poisoning, eavesdropping DNSSEC for integrity; DoH or DoT for privacy

  • NTP Spoofable time NTS
  • Syslog over UDP Cleartext, unreliable Syslog over TLS
  • RTP Cleartext voice and video SRTP

Shared Wi-Fi PSK No per-user accountability WPA3-Enterprise with 802.1X Cryptography

Symmetric Algorithms (Chapter 3)

Algorithm Type Key length Block size Status

AES Block cipher 128, 192, 256 bits 128 bits Current standard; AES-256 for top-secret-level protection

Algorithm Type Key length Block size Status

AES-GCM Authenticated encryption mode

128 or 256 bits 128 bits Preferred in TLS 1.3; provides confidentiality and integrity

ChaCha20-

Poly1305

Stream cipher with MAC

256 bits Stream Fast on mobile devices without AES hardware;

Tls 1.3

3DES Block cipher 112 or 168 bits effective key

  • 64 bits Deprecated; legacy only
  • DES Block cipher 56 bits 64 bits Broken; never use
  • Blowfish Block cipher 32 to 448 bits 64 bits Legacy; basis of bcrypt

Twofish Block cipher 128, 192, 256 bits 128 bits AES finalist; secure but less common RC4 Stream cipher 40 to 2,048 bits Stream Broken (used in WEP); never use Avoid ECB mode: identical plaintext blocks produce identical ciphertext blocks, leaking patterns. Prefer GCM (authenticated) or CBC with a MAC.

Asymmetric Algorithms

Algorithm Purpose Typical key length Notes

RSA Encryption, digital signatures, key transport

2,048 bits minimum; 3,072 or 4,096 for long-term

Security relies on factoring large primes

Diffie-Hellman (DH)

Key exchange only 2,048 bits or larger Does not encrypt or sign; vulnerable to on-path attacks without authentication

Ecdhe /

Dhe

Ephemeral key exchange ECC 256 or 384 bits Provides perfect forward secrecy; required in

Tls 1.3

ECC Encryption, signatures, key exchange

256 bits (about equal to RSA 3,072)

Smaller keys, less CPU; ideal for mobile and IoT

ECDSA Digital signatures 256 or 384 bits Elliptic curve signatures

EdDSA (Ed25519)

Digital signatures 256 bits Modern, fast signatures (SSH keys)

DSA Digital signatures only 2,048 or 3,072 bits Largely superseded by ECDSA and EdDSA

Ml-kem

(FIPS 203)

Post-quantum key encapsulation

Parameter sets 512, 768,

1024

NIST post-quantum standard (2024), based on CRYSTALS-Kyber

Ml-dsa

(FIPS 204)

Post-quantum signatures Parameter sets 44, 65,

NIST post-quantum standard (2024), based on CRYSTALS-Dilithium

Hashing Algorithms

Algorithm Digest length Status and use

MD5 128 bits Broken (collisions); acceptable only for non-security checksums SHA-1 160 bits Deprecated (practical collisions demonstrated); do not use for signatures

Sha-256 / sha-384 / sha-512

(SHA-2)

256 / 384 / 512 bits

Current standard for integrity, signatures, certificates

SHA-3 (Keccak) 224 to 512 bits Current; different internal design from SHA-2 RIPEMD-160 160 bits Niche; seen in some cryptocurrency systems

HMAC (with SHA-256, etc.)

Same as underlying hash

Keyed hash: integrity plus authenticity using a shared secret; no non-repudiation bcrypt 184-bit output Password hashing with built-in salt and work factor PBKDF2 Configurable Key stretching via many iterations of HMAC

scrypt Configurable Memory-hard key derivation

Argon2 (Argon2id)

  • Configurable Modern memory-hard password hashing; recommended
  • Cryptographic Concepts at a Glance
  • You need Use Key used

Confidentiality of bulk data Symmetric encryption (AES) Shared secret key Confidentiality of a message to a recipient

Encrypt the symmetric key with recipient's public key

Recipient's public key (recipient decrypts with private)

Integrity Hash (SHA-256) None

Integrity plus authenticity, shared secret

HMAC Shared secret key

Non-repudiation and integrity Digital signature Sender's private key signs; anyone verifies with sender's public key

Secure key agreement over untrusted network

Diffie-Hellman / ECDHE Ephemeral key pairs

Protect stored passwords Salted, slow hash (Argon2, bcrypt, PBKDF2)

Unique salt per password

Prevent rainbow table attacks Salting Random salt stored with hash

Strengthen weak passwords or keys Key stretching Many iterations or memory-hard functions

Verify certificate status CRL (downloaded list) or OCSP (real-time query); OCSP staplingCA-signed responses Hide meaning without encryption Obfuscation, steganography, tokenization, masking

Full disk (FDE) Entire drive when powered off BitLocker, FileVault, self-encrypting drives Partition One partition Encrypted data partition

Volume A logical volume, possibly spanning disks Encrypted volume container File Individual files EFS, encrypted archives

Database Whole database (TDE) Transparent data encryption

Record Specific rows or fields Column- or field-level encryption of SSNs Transport Data in transit TLS, IPsec, SSH

  • Certificate Types
  • Type Purpose
  • Root CA certificate Self-signed anchor of trust; keep offline

Intermediate CA Issues end-entity certificates; limits exposure of root Wildcard Covers all first-level subdomains, such as *.example.com

SAN (multi-domain) Lists multiple names in the Subject Alternative Name field Self-signed Signed by its own key; not trusted by default; internal or testing use Third-party Issued by a public CA trusted by browsers

  • Code signing Proves software origin and integrity
  • Email (S/MIME) Signs and encrypts email
  • Risk Formulas (Chapter 23)
  • Term Formula or definition
  • Asset value (AV) Monetary value of the asset

Exposure factor (EF) Percentage of asset value lost in one incident (0 to 100 percent) Single loss expectancy (SLE) SLE = AV x EF

Annualized rate of occurrence (ARO)

  • Expected number of occurrences per year (once every 4 years = 0.25)
  • Term Formula or definition
  • Annualized loss expectancy (ALE) ALE = SLE x ARO
  • Risk (qualitative) Likelihood x Impact

Control value ALE before control minus ALE after control minus annual cost of control Residual risk Risk remaining after controls are applied

Inherent risk Risk before any controls are applied

Risk appetite Amount of risk the organization is willing to pursue or retain Risk tolerance Acceptable variation around the risk appetite

Worked example. A server worth $200,000 would lose 40 percent of its value in a flood. Floods occur once every 10 years.

  • SLE = $200,000 x 0.40 = $80,000
  • ARO = 1 / 10 = 0.1
  • ALE = $80,000 x 0.1 = $8,000 per year

A flood control costing $3,000 per year that reduces ARO to 0.02 lowers ALE to $1,600, saving $6,400 for a $3,000 cost, so it is justified.

Risk Treatment

Strategy Meaning Example

Mitigate (reduce)

Apply controls to lower likelihood or impact Patch, segment, add MFA

Transfer (share)

Shift financial impact to another party Cyber insurance, outsourcing with contract terms Avoid Stop the risky activity Decommission the vulnerable service

Accept Acknowledge and retain the risk Documented exception with owner sign-off Recovery Metrics and Resilience (Chapter 13)

Metric Meaning Memory hook

RTO (recovery time objective) Maximum acceptable time to restore a system after disruption

Time to get back up

RPO (recovery point objective) Maximum acceptable data loss, measured in time How far back the last good backup can be

MTTR (mean time to repair or recover)

Average time to fix a failed component Lower is better

Metric Meaning Memory hook

MTBF (mean time between failures)

Average operating time between failures of a repairable system

Higher is better

MTTF (mean time to failure) Average time to failure for non-repairable items Higher is better MTD / MAD (maximum tolerable

downtime)

Longest outage the business can survive RTO must be less than

Mtd

WRT (work recovery time) Time to verify data and resume business after systems are restored

RTO + WRT should not exceed MTD

Availability = MTBF / (MTBF + MTTR).

  • Availability Downtime per year (approx.)
  • 99 percent (two nines) 3.65 days
  • 99.9 percent (three nines) 8.76 hours
  • 99.99 percent (four nines) 52.6 minutes
  • 99.999 percent (five nines) 5.26 minutes
  • Recovery Sites
  • Site Readiness Cost Recovery time

Hot Fully equipped, data replicated, ready to run Highest Minutes to hours Warm Hardware and connectivity, data partially current Moderate Hours to days Cold Space, power, and cooling only Lowest Days to weeks

Mobile Portable site (trailer) Varies Varies

Cloud / DRaaS

Changes since last backup of any type Cleared Last full plus every incremental since Differential Changes since last full Not cleared

Last full plus latest differential

Snapshot Point-in-time image of a VM or volume N/A The snapshot (often with base disk) Remember the 3-2-1 rule (three copies, two media types, one offsite) and add immutability or an offline copy to resist ransomware. Test restorations regularly.

Control Categories and Types (Chapter 1)

Category Description Examples

Technical (logical) Implemented by systems Firewalls, encryption, MFA, EDR, ACLs Managerial (administrative)

Policies, planning, oversight Risk assessments, policies, security awareness program requirement

Operational Performed by people day to day Guards checking badges, training delivery, log review Physical (environmental)

Protect facilities and hardware Fences, locks, bollards, cameras, fire suppression Type Purpose Examples

Preventive Stop an incident before it occurs Firewall rules, locks, IPS, least privilege Deterring Discourage an attacker Warning signs, visible cameras, lighting Detective Identify an incident during or after IDS, SIEM alerts, log review, motion sensors Corrective Fix or limit damage after an incident Restoring backups, patching, quarantining malware Compensa

ting

Alternative when primary control is not feasible

Isolating a legacy system that cannot be patched

Directive Instruct required behavior Policies, "Authorized personnel only" signs, AUP Incident Response (Chapter 20)

SY0-801 Incident Response Phases

Phase Key activities

Preparation IR plan, roles, playbooks, training, tabletop exercises, simulations, tools, jump kits Identification Detection, alert triage, internal and external advisories, threat hunting, declaring an incident Investigation Digital forensics, chain of custody, preservation, e-discovery, scoping Containment Quarantine and isolation to stop spread (short-term then long-term)

Negotiation Communication with threat actors (for example ransomware), usually with legal and specialist support

Eradication / recovery

Remove malware and attacker access, rebuild, restore from clean backups, monitor Notification / external reporting

Stakeholders, customers, law enforcement, mandatory regulatory reporting Phase Key activities

Post-incident Lessons learned, root cause analysis, post-incident report (PIR), update controls and plans For comparison, NIST SP 800-61 historically groups this as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

  • Order of Volatility (Collect Most Volatile First)
  • Order Evidence source Why
  • 1 CPU registers and cache Change in nanoseconds

2 Routing table, ARP cache, process table, kernel statistics Change constantly 3 System memory (RAM) Lost at power-off; holds keys, processes, fileless malware

  • 4 Temporary file systems and swap/page files Overwritten frequently
  • 5 Disk (persistent storage) Persistent but alterable
  • 6 Remote logging and monitoring data May roll over
  • 7 Physical configuration and network topology Changes slowly
  • 8 Archival media and backups Most stable
  • Forensic Essentials
  • Concept Key point

Chain of custody Documents every person who handled evidence, when, and why Legal hold Preserve data when litigation is anticipated; suspends deletion Bit-level (forensic) image

  • Exact copy including unallocated space; verify with hash
  • Write blocker Prevents changes to source media during acquisition
  • Hashing evidence Hash before and after to prove integrity
  • Memory dump Captures RAM before shutdown

E-discovery Identifying and producing electronic information for legal proceedings Timeline Correlate events using synchronized time (NTP)

Access Control Models (Chapter 18)

Model Who decides How it works Example

Mandatory (MAC)

System, based on labels

Subjects have clearances, objects have classifications; users cannot change

  • Military classification; SELinux
  • Model Who decides How it works Example
  • Discretionar
  • y (DAC)

Data owner Owner grants permissions at will NTFS file permissions set by file owner

Role-based (RBAC)

Administrator via roles

Permissions assigned to job roles; users assigned to roles

"Accounts Payable Clerk" role

Rule-based Administrator-defined rulesGlobal rules apply to all users Firewall ACL; "no logins from outside the country"

Attribute-based (ABAC)

Policy engine Evaluates attributes of user, resource, action, environment

Allow if department = finance and device = managed

Time-based Policy Access limited to specific times Contractors allowed 08:00-18:00 weekdays

Just-in-time (JIT)

Request and approval workflow

Privileges granted temporarily and revoked automatically

  • Admin rights for a two-hour change
  • window
  • Authentication Factors
  • Factor Examples
  • Something you know Password, PIN, passphrase

Something you have Smart card, hardware token, phone authenticator, FIDO2 key Something you are Fingerprint, face, iris, retina, voice

Somewhere you are Geolocation, IP range (attribute, not a standalone factor)

Something you do Typing rhythm, gait (attribute)

Biometric errors: FAR (false acceptance rate, a Type II error) and FRR (false rejection rate, a Type I error); the CER/EER (crossover/equal error rate) where they meet compares systems, and lower is better.

Identity Protocols

Protocol Purpose Notes

SAML 2.0 Federation and web SSO XML assertions from IdP to service provider OAuth 2.0 Delegated authorization Access tokens; not authentication by itself OpenID Connect Authentication on top of OAuth 2.0 ID tokens (JWT)

  • LDAP / LDAPS Directory queries 389 / 636
  • Kerberos Ticket-based authentication 88; relies on time sync
  • RADIUS Network access AAA UDP 1812/1813; encrypts password only
  • Protocol Purpose Notes

TACACS+ Device administration AAA TCP 49; encrypts full payload; per-command authorization

802.1X Port-based network access control Supplicant, authenticator, authentication server (RADIUS)

Fido2 /

WebAuthn / passkeys

  • Phishing-resistant passwordless Public key credentials bound to origin
  • Attack-to-Indicator Mapping (Chapters 8, 21)
  • Attack Key indicators

Ransomware Mass file renames or new extensions, ransom notes, high disk I/O, deleted shadow copies, disabled backups

Worm Rapid spread across hosts, unusual scanning traffic, bandwidth spikes, no user action needed Trojan Legitimate-looking program with hidden functions; unexpected outbound connections Rootkit Hidden processes or files, integrity check failures, kernel modifications, security tools disabled Keylogger Unknown processes hooking keyboard input, unusual outbound data, credential misuse Logic bomb Malicious code triggered by date or event, often planted by an insider Fileless malware PowerShell or WMI abuse, malicious activity in memory, few disk artifacts, living-off-the-land binaries

Spyware / adware

Pop-ups, browser changes, unexplained data transmission

Brute force Many failed logins for one account, account lockouts

Password spraying

Few attempts per account across many accounts, often from one source; avoids lockout Credential stuffing

Logins with breached username-password pairs across many accounts

MFA fatigue / bypass

Many push prompts to a user; approval at odd hours; token or session reuse Impossible travel Successful logins from distant locations too close together in time Concurrent sessions

Same account active from multiple locations or devices at once

SQL injection Quotes, OR 1=1, UNION SELECT, or comment sequences in input or URLs; database errors Cross-site scripting

Script tags or event handlers in input fields or URLs

Directory traversal

../ or encoded variants such as %2e%2e%2f in requests

Buffer overflow Crashes, long repeated strings, NOP sleds, unexpected code execution Attack Key indicators

Privilege escalation

Standard account gaining admin rights; new accounts added to privileged groups Replay Reused tokens, session IDs, or authentication messages; duplicate transactions Forgery (CSRF, SSRF)

Unintended state-changing requests; server requests to internal or metadata addresses DDoS Traffic surge from many sources, service slowdown, resource exhaustion On-path Duplicate MAC addresses for one IP, ARP anomalies, certificate warnings DNS / cache poisoning

Legitimate domain resolving to wrong IP; unexpected TTL changes

Protocol downgrade

Sessions negotiating weak TLS versions or ciphers; stripped HTTPS

Rogue access point / evil twin

Duplicate SSID, unknown BSSID, users prompted to re-authenticate

Log manipulation

Gaps in logs, cleared event logs (Windows event 1102), timestamp anomalies Data exfiltration Large outbound transfers, uploads to unusual cloud storage, DNS tunneling, after-hours activity Phishing / BEC Lookalike domains, mismatched Reply-To, urgency, payment change requests Physical attacks Tailgating, skimmers on card readers, broken locks, badge reader anomalies Email Authentication Records (Chapter 14)

Record Location What it does Sample

SPF DNS TXT at domain Lists servers authorized to send mail for the domain

v=spf1 ip4:203.0.113.10 include:_spf.mailhost.example -

all

DKIM DNS TXT at selector._domaink

ey.domain

Publishes public key; sending server signs messages so receivers verify integrity and domain

v=DKIM1; k=rsa; p=MIIBIjANBg...

DMARC DNS TXT at _dmarc.domain

Policy for failures of SPF/DKIM alignment, plus reporting

v=DMARC1; p=reject; rua=mailto:dmarc@example.co

m

BIMI DNS TXT at default._bimi.dom

ain

Displays verified brand logo; requires enforced

Dmarc

v=BIMI1; l=https://example.com/logo.svg

  • SPF qualifier Meaning
  • -all Hard fail: reject unlisted senders
  • ~all Soft fail: accept but mark
  • SPF qualifier Meaning
  • ?all Neutral
  • +all Pass everything (dangerous)
  • DMARC policy Action on failure
  • p=none Monitor only; collect reports
  • p=quarantine Send to spam or junk
  • p=reject Reject the message
  • Cloud Models and Shared Responsibility (Chapter 10)
  • Service Models
  • Responsibility On-premises IaaS PaaS SaaS
  • Data and its classification Customer Customer Customer Customer
  • User accounts and access Customer Customer Customer Customer
  • Endpoints and client devices Customer Customer Customer Customer
  • Application Customer Customer Customer Provider
  • Runtime and middleware Customer Customer Provider Provider
  • Operating system Customer Customer Provider Provider
  • Virtualization Customer Provider Provider Provider
  • Physical servers, storage, network Customer Provider Provider Provider
  • Physical data center Customer Provider Provider Provider

The customer is always responsible for its data, identities and access, and configuration of the services it uses. Most cloud breaches result from customer misconfiguration (such as public object storage), not provider failure.

Deployment Models and Related Terms

Term Meaning

Public cloud Multi-tenant infrastructure owned by a provider and shared by many customers Private cloud Dedicated to one organization, on-premises or hosted

Community cloud

Shared by organizations with common requirements (for example, government agencies)

Hybrid cloud Combination of public and private (or on-premises) with orchestration between them Term Meaning

Multicloud Using several cloud providers to avoid lock-in or improve resilience Serverless (FaaS)

Provider runs code on demand; customer manages code and permissions only Infrastructure as code (IaC)

Infrastructure defined in templates; enables consistency and scanning before deployment CASB Visibility and policy enforcement between users and cloud services CSPM Continuously checks cloud configuration against policy

SSE / SASE Security service edge (SWG, CASB, ZTNA) delivered from the cloud; SASE adds SD-WAN Data sovereignty

  • Data subject to laws of the country where it is stored
  • Data Protection Quick Facts (Chapter 12)
  • Topic Key points

Data states At rest (stored), in transit (moving), in use (in memory, being processed) Data types Structured (databases), unstructured (documents, email, media)

Data owner Senior business role accountable for the data and its classification Data custodian Implements and operates controls (often IT)

Data steward Manages data quality and metadata

Data controller Determines purposes and means of processing personal data (privacy law) Data processor / subprocessor

Processes data on behalf of the controller / on behalf of the processor Masking Hides part of a value (XXX-XX-1234)

Tokenization Replaces value with a non-sensitive token mapped in a secure vault Hashing One-way transformation; integrity or pseudonymization

De-identification Removes identifiers so data cannot be linked to individuals Geofencing Restricts access or data based on location

  • Wireless Security (Chapter 14)
  • Standard Encryption Authentication Notes
  • WEP RC4 Shared key Broken
  • WPA TKIP (RC4) PSK or 802.1X Deprecated

WPA2 AES-CCMP PSK or 802.1X (Enterprise) PSK vulnerable to offline dictionary attack Standard Encryption Authentication Notes

WPA3 AES-GCMP (192-bit mode in Enterprise) or

Ccmp

SAE (Personal) or 802.1X SAE resists offline cracking; forward secrecy; protected management frames

Eap

method

Credentials Notes

EAP-TLS Client and server certificates Strongest; mutual certificate authentication PEAP Server certificate plus password in TLS tunnel Common in Windows environments EAP-TTLS Server certificate plus inner method Flexible inner authentication EAP-FAST Protected access credential (PAC) Cisco-developed alternative to certificates Program Management Quick Facts (Chapters 22-27)

Item Key distinction

Policy vs standard vs procedure vs guideline

Policy: what and why (mandatory, high level). Standard: specific mandatory requirement. Procedure: step-by-step how. Guideline: recommended, not mandatory

SLA vs SLO SLA: contractual commitment with penalties. SLO: specific measurable target within it MOU vs MOA MOU: statement of intent, usually not binding. MOA: defines specific responsibilities, more formal

MSA vs SOW MSA: overall terms for future work. SOW: specific deliverables, timeline, and cost RFI vs RFP vs RFQ RFI gathers information; RFP requests detailed proposals; RFQ requests prices for defined items

Known vs partially known vs unknown environment

Full information (white box); some information (gray box); no information (black box) Red vs blue vs purple Offensive; defensive; integrated collaboration

Passive vs active reconnaissance

No contact with target systems (OSINT) vs direct probes (scans)

Gap analysis vs benchmarking

Against a standard vs against peers or reference baselines

SOC 2 Type I vs Type II Design at a point in time vs operating effectiveness over a period Training types Onboarding (joining), ongoing (continuous), targeted (role or risk), corrective (after a mistake)

Delivery methods LMS (tracked), self-service portal (on demand), one-to-one (personal), one-to-many (broad) Top Acronyms by Domain

  • Domain 1: General Security Concepts
  • Acronym Meaning
  • AAA Authentication, authorization, and accounting
  • CIA Confidentiality, integrity, availability
  • CAB Change advisory board
  • SOP Standard operating procedure
  • PKI Public key infrastructure
  • CA Certificate authority
  • CRL Certificate revocation list
  • OCSP Online Certificate Status Protocol
  • CSR Certificate signing request
  • HSM Hardware security module
  • TPM Trusted Platform Module
  • KMS Key management system
  • PFS Perfect forward secrecy
  • PEP / PDP Policy enforcement point / policy decision point
  • ZTNA Zero Trust network access
  • Domain 2: Threats, Vulnerabilities, and Attacks
  • Acronym Meaning
  • APT Advanced persistent threat
  • CVE Common Vulnerabilities and Exposures
  • CVSS Common Vulnerability Scoring System
  • IoC Indicator of compromise
  • TTP Tactics, techniques, and procedures
  • OSINT Open-source intelligence
  • BEC Business email compromise
  • RCS Rich Communication Services
  • XSS Cross-site scripting
  • CSRF / XSRF Cross-site request forgery
  • SSRF Server-side request forgery
  • SQLi SQL injection
  • Acronym Meaning
  • DDoS Distributed denial of service
  • LOTL Living off the land
  • LLM Large language model
  • TOC / TOU Time of check / time of use
  • RFID / NFC Radio-frequency identification / near-field communication
  • Domain 3: Security Architecture
  • Acronym Meaning
  • IaaS / PaaS / SaaS Infrastructure / platform / software as a service
  • IaC Infrastructure as code
  • SDN Software-defined networking
  • SSE / SASE Security service edge / secure access service edge

OT / ICS / SCADA Operational technology / industrial control system / supervisory control and data acquisition RTOS Real-time operating system

  • VPN Virtual private network
  • gMSA Group managed service account
  • DLP Data loss prevention
  • RTO / RPO Recovery time objective / recovery point objective
  • MTTR / MTBF Mean time to repair / mean time between failures
  • UPS / RPS Uninterruptible power supply / redundant power supply
  • BCP / DRP Business continuity plan / disaster recovery plan
  • Domain 4: Security Operations
  • Acronym Meaning
  • SIEM Security information and event management
  • SOAR Security orchestration, automation, and response
  • EDR / XDR Endpoint / extended detection and response
  • IDS / IPS Intrusion detection / prevention system
  • WAF Web application firewall
  • UTM / NGFW Unified threat management / next-generation firewall
  • NAC Network access control
  • MDM Mobile device management
  • Acronym Meaning

Spf / dkim /

Dmarc / bimi

Sender Policy Framework / DomainKeys Identified Mail / Domain-based Message Authentication, Reporting, and Conformance / Brand Indicators for Message Identification SCAP Security Content Automation Protocol

  • SNMP Simple Network Management Protocol
  • IPFIX IP Flow Information Export
  • CSPM Cloud security posture management
  • IPAM IP address management
  • SSO / MFA Single sign-on / multifactor authentication
  • SAML / OIDC Security Assertion Markup Language / OpenID Connect
  • LDAP Lightweight Directory Access Protocol
  • PAM Privileged access management
  • JIT Just-in-time (access)

Rbac / abac /

Mac / dac

Role-, attribute-based, mandatory, discretionary access control

Otp / totp /

Hotp

  • One-time password / time-based / HMAC-based
  • CI/CD Continuous integration / continuous delivery or deployment
  • PIR Post-incident report
  • UEBA User and entity behavior analytics
  • Domain 5: Security Program Management and Oversight
  • Acronym Meaning
  • GRC Governance, risk, and compliance
  • AUP Acceptable use policy
  • BYOD Bring your own device
  • BIA Business impact analysis

SLE / ARO / ALE Single loss expectancy / annualized rate of occurrence / annualized loss expectancy AV / EF Asset value / exposure factor

Rfp / rfi / rfq /

Eoi

  • Request for proposal / information / quotation; expression of interest
  • SLA / SLO Service-level agreement / objective
  • MOU / MOA Memorandum of understanding / agreement

Msa / sow /

Nda

Master service agreement / statement of work / non-disclosure agreement Acronym Meaning

  • RoE Rules of engagement
  • AML / CTF Anti-money laundering / counter-terrorist financing
  • GDPR General Data Protection Regulation
  • PCI DSS Payment Card Industry Data Security Standard

SOC System and Organization Controls (report) or security operations center ISMS Information security management system

  • LMS Learning management system
  • OPSEC Operational security
  • Final-Week Checklist
  • Seven to Three Days Out
  • Take one full-length timed practice exam (90 questions, 90 minutes) and score it honestly; the target is consistently above 85 percent on practice material.
  • List every missed question by objective number and reread those chapters' summaries and tips.
  • Drill this quick reference until you can recall from memory: secure port numbers, the four control categories and six control types, the SLE/ALE formulas, RTO versus RPO, the order of volatility, and the incident response phases in order.
  • Work through the performance-based question walkthroughs in this guide: firewall rule ordering, log analysis, matching attacks to indicators, and classifying controls.
  • Review the domain weights: Security Operations (27 percent) and Threats, Vulnerabilities, and Attacks (24 percent) together make up more than half the exam.

Two Days Out

  • Take a second practice exam or a set of weak-area questions; do not cram new material.
  • Review the acronym tables; cover the meaning column and test yourself.
  • Confirm your testing appointment, location or online proctoring requirements, and ID requirements.
  • For online testing, run the system check on the exact computer and network you will use, and clear your desk and room.

The Day Before

  • Light review only: this quick reference and your own notes on weak areas.
  • Prepare two forms of ID if required, directions, and a plan to arrive (or log in) early.
  • Sleep. A rested brain outperforms a crammed one.

Exam Day

  • Arrive or check in early; expect the check-in to take time.
  • Read every question stem twice and identify keywords: BEST, MOST, FIRST, LEAST, and "Select

Two."

  • Consider skipping lengthy PBQs at the start, answering the multiple-choice questions, and returning to PBQs with your remaining time; flag questions you are unsure about.
  • Eliminate clearly wrong answers first, then choose between the remaining options based on the exact wording of the scenario.
  • Answer every question; there is no penalty for guessing.
  • Watch the clock: 90 minutes for up to 90 questions is roughly one minute per question, with PBQs taking longer.
  • Do not change answers without a clear reason; first instincts based on preparation are usually sound.

Exam tip

When two answers both seem right, CompTIA usually wants the one that is most directly targeted at the stated problem, follows the correct process order (for example, contain before eradicating), and uses the least disruptive effective control. Look for the clue words in the scenario that rule out the other option.

Memory aid

The facts most worth memorizing cold: SSH 22, DNS 53, HTTPS 443, LDAPS 636, RDP 3389, SMB 445, SNMP 161/162, syslog 514, RADIUS 1812/1813, TACACS+ 49; ALE = SLE x ARO and SLE = AV x EF; RPO is about data, RTO is about time; collect RAM before disk; sign with your private key, encrypt with the recipient's public key.

Use ← → to move between sections