CompTIA Security+
Security+ Cheat Sheet
Security+ Is About Knowing What to Do FIRST — Not Just What to Do
The exam tests incident response sequencing, threat identification, and security control selection. Knowing the right answer matters less than knowing the right order.
Check Your Readiness →
Among the harder certs
Avg: Approximately 62–67%
Pass: 750 / 1000
Most candidates understand CompTIA Security+ concepts — and still fail. This exam tests how you apply knowledge under pressure.
Core Framework
Security+ Control Categories and Response Sequencing
Security+ (SY0-701) tests practical security judgment across threat management, architecture, implementation, and operations. Know the control types and when each applies. Incident response sequencing is heavily tested.
-
01
Preventive
— Stop attacks before they happen (firewalls, MFA, encryption)
-
02
Detective
— Identify attacks in progress (IDS, SIEM, log monitoring)
-
03
Corrective
— Respond and recover (patching, reimaging, restoring backups)
-
04
Deterrent
— Discourage attacks (warning banners, visible cameras)
-
05
Compensating
— Alternative controls when primary controls aren't feasible
Scenario Traps
Wrong instinct vs correct approach
An employee's workstation is suspected of being infected with malware
✕ Wrong instinct
Run antivirus to remove the malware immediately
✓ Correct approach
First contain — isolate the machine from the network; then identify the malware; then eradicate; then recover. Evidence preservation may also be required.
A company needs to ensure only authorized devices can connect to the network
✕ Wrong instinct
Implement a firewall with strict rules
✓ Correct approach
Implement Network Access Control (NAC) or 802.1X authentication — these verify device identity before granting network access, which a firewall alone cannot do
Sensitive files must be securely deleted before hardware disposal
✕ Wrong instinct
Delete the files and empty the recycle bin
✓ Correct approach
Use cryptographic erasure, secure overwrite (DoD 5220.22-M), or physical destruction depending on data classification — standard deletion is insufficient
Quick Rules
Know these cold
-
▸
Incident response order — repare → Identify → Contain → Eradicate → Recover → Lessons
-
▸
IDS alerts; IPS blocks — know which is needed before selecting
-
▸
Least privilege and need-to-know are always correct for access control
-
▸
MFA is the most effective single control against credential-based attacks
-
▸
Certificate authority (CA) issues digital certificates; PKI manages the infrastructure
-
▸
Zero trust — erify explicitly, use least privilege, assume breach
-
▸
Physical security first — f someone can touch it, all software controls are secondary
Self Check
Can you answer these without checking your notes?
In this scenario: "An employee's workstation is suspected of being infected with malware" — what should you do first?
First contain — isolate the machine from the network; then identify the malware; then eradicate; then recover. Evidence preservation may also be required.
In this scenario: "A company needs to ensure only authorized devices can connect to the network" — what should you do first?
Implement Network Access Control (NAC) or 802.1X authentication — these verify device identity before granting network access, which a firewall alone cannot do
In this scenario: "Sensitive files must be securely deleted before hardware disposal" — what should you do first?
Use cryptographic erasure, secure overwrite (DoD 5220.22-M), or physical destruction depending on data classification — standard deletion is insufficient
Failure Patterns
Common Exam Mistakes — What candidates get wrong
Eradicating malware before containing the threat
Containment must precede eradication. Running a malware removal tool before isolating the system allows lateral movement. Disconnect first, then remediate.
Confusing IDS with IPS
IDS detects and alerts — it does not block. IPS detects and actively blocks. Recommending IDS when blocking is required (or vice versa) is a common error in security architecture questions.
Applying symmetric encryption when asymmetric is needed
Symmetric encryption is fast but requires secure key exchange. Asymmetric is used for key exchange and digital signatures. Using symmetric encryption to securely share a key defeats the purpose.
Misidentifying social engineering attack types
Phishing (broad email), spear phishing (targeted), whaling (executive), vishing (voice), smishing (SMS) — the delivery method and target audience distinguish them.
Treating vulnerability scanning as penetration testing
Vulnerability scanning identifies potential weaknesses passively. Penetration testing actively exploits vulnerabilities. They have different scopes, outputs, and authorization requirements.
Security+ rewards response sequencing over security trivia. Test whether you'd make the right call in a real incident.