Security+ SY0-701

Cheat Sheet Overview

Keep this page light, fast, and reliable. Focus on the four sections below and cycle through them every study session.

  • PBQs when fresh, flag tricky MCQs, revisit with spare time.
  • Daily routine: 15 questions per domain + 1 scenario run-through.
  • Use spaced repetition—scan this layout quickly instead of reading long paragraphs.

Exam Window

90 Minutes

Budget ~1 minute per question and reserve 10 for PBQs

Passing Score

750 / 900

Target 83%+ on practice sets to stay ahead of curve

Study Index

01 Overview 02 Domains 03 References 04 Memory

Section 01

Exam Overview

Baseline stats + daily ritual so you always know what to do next.

Exam Window

90 Minutes

Budget ~1 minute per question and reserve 10 for PBQs

Passing Score

750 / 900

Target 83%+ on practice sets to stay ahead of curve

Question Mix

PBQ + MCQ

Expect 3-5 PBQs plus scenario-driven MCQs

Domain Weights

5 Pillars

Ops & IR (28%) + Threats (22%) carry the exam

Simple Daily Loop

  • 1. Warm-up: 5 quick recall questions while reviewing acronyms.
  • 2. Timed block: 15 mixed questions focusing on a single domain.
  • 3. Review: Note weak topics, schedule deeper dive tomorrow.
  • 4. Scenario: Walk through one PBQ or tabletop log review.

Section 02

Domain Game Plan

Every domain summarized with tactics and a single insight.

12% Weight

Domain 1 · General Security Concepts

Focus

Core principles, frameworks, and control families that anchor every decision.

  1. Map CIA, AAA, and control categories (preventive, detective, corrective) to scenarios.
  2. Understand governance terms like due diligence, data classification, risk appetite.
  3. Tie frameworks (NIST CSF, ISO 27001, CIS) to stakeholder requests and gap analyses.

Insight: Questions love phrasing like "best next step"—link the control objective to the action.

22% Weight

Domain 2 · Threats, Vulnerabilities & Mitigations

Focus

Adversary TTPs, malware, and intel handling from alert to containment.

  1. Tell the story: recon → weaponize → deliver → execute (kill chain mentality).
  2. Differentiate malware purpose (worm vs trojan vs fileless) and delivery method.
  3. Prioritize vulnerability reports using CVSS, exploitability, and business impact.

Insight: Expect log snippets, packet captures, and threat actor profiles to analyze.

18% Weight

Domain 3 · Architecture & Design

Focus

Secure network patterns, zero trust, cloud responsibilities, and hardening baselines.

  1. Sketch DMZs, microsegmentation, NAC, and zero trust flows until second nature.
  2. Compare on-prem vs cloud vs hybrid controls and who owns which responsibility.
  3. Secure emerging tech: OT, IoT, virtualization, containers, and edge compute.

Insight: Diagram questions appear often—annotate every component during practice.

28% Weight

Domain 4 · Operations & Incident Response

Focus

Monitoring, playbooks, automation, and forensic handling—the largest domain.

  1. Memorize IR lifecycle (Preparation → Lessons Learned) plus order of volatility.
  2. Decide when to contain vs eradicate vs recover in scenario prompts.
  3. Understand SOAR, EDR, script automation, and evidence handling requirements.

Insight: Weighted heavily—daily reps here deliver the fastest score gains.

20% Weight

Domain 5 · Governance, Risk & Compliance

Focus

BIA outputs, testing methods, legal requirements, and program maturity.

  1. Translate BIA findings into RTO, RPO, MTTR, and continuity strategies.
  2. Know testing types (tabletop, walkthrough, parallel, full interruption).
  3. Map privacy and regulatory requirements (PII, PCI-DSS, HIPAA, GDPR) to controls.

Insight: Look for keywords like "evidence", "attestation", or "stakeholder" in stems.

Section 03

Quick Reference Cards

Short bullet lists you can read in under a minute.

Risk Math & Metrics

Quantitative questions lean on these simple formulas.

  • Risk = Threat × Vulnerability × Impact
  • SLE = Asset Value × Exposure Factor
  • ALE = SLE × ARO
  • ARO represents expected frequency per year

Identity & Access Stack

Layer factors, federate identities, enforce least privilege.

  • MFA factors: know, have, are, do, where
  • SSO protocols: SAML (XML), OIDC (JSON), Kerberos (tickets)
  • Account policies: lockout threshold, password history, time-of-day
  • Auth models: RBAC, ABAC, MAC, DAC

Network & Platform Defense

Layer 2-7 protections keep adversaries boxed in.

  • Segment with VLANs, SDN microsegments, air gaps for OT
  • Inline stack: NGFW, IPS, SWG, CASB, WAF
  • NAC posture checks (agent/agentless) with 802.1X enforcement
  • Preferred secure protocols: HTTPS, SFTP, SSH, LDAPS, IMAPS

Cloud & Virtualization

Shared responsibility and automation underpin resilience.

  • Service models: IaaS, PaaS, SaaS, FaaS—know who secures what
  • CASB delivers visibility, policy enforcement, and SaaS DLP
  • Container security: image signing, runtime profiles, orchestrator RBAC
  • Object storage controls: versioning, immutability, lifecycle policies

Crypto & PKI Essentials

Symmetric for speed, asymmetric for trust—mix wisely.

  • AES (symmetric) vs RSA/ECC (asymmetric) roles
  • Cipher modes: CBC (legacy), GCM/CCM (authenticated), ECB (avoid)
  • Hashing: SHA-256/3, HMAC = integrity + authenticity
  • PKI chain: Root → Intermediate → Issued cert; validate via CRL/OCSP

Incident Response Micro-Playbook

Order of operations matters when adrenaline spikes.

  • Preparation → Identification → Containment → Eradication → Recovery → Lessons
  • Order of volatility: CPU/cache → memory → disk → logs → backups
  • Containment options: isolate host, disable account, geo-fence, block IOC
  • Chain of custody: hash evidence before/after transport, log handlers

Section 04

Memory + Acronyms

Say these out loud—speed matters as much as accuracy.

Mnemonic Wall

Mnemonic

CIA Triad

Keep secrets, accuracy, uptime
  • C Confidentiality: encryption, access control, need-to-know
  • I Integrity: hashing, digital signatures, change control
  • A Availability: redundancy, fault tolerance, DR/BCP

Mnemonic

AAA Framework

Who are you, what may you do, prove it
  • AuthN Authentication verifies identity (passwords, certs, biometrics)
  • AuthZ Authorization enforces least privilege via policies
  • Acct Accounting logs activity for audits and forensics

Mnemonic

STRIDE Threats

Spoof · Tamper · Repudiate · Info · DoS · Elevate
  • S Spoofing → strong authentication, signed requests
  • T Tampering → integrity checks, code signing, immutability
  • R Repudiation → logging, non-repudiation controls
  • I Information disclosure → classification, DLP, encryption
  • D Denial of service → scaling, rate limits, scrubbing
  • E Elevation of privilege → timely patching, least privilege

Mnemonic

OSI Story

Please Do Not Throw Sausage Pizza Away
  • 7 Application – user interfaces, APIs, proxies
  • 6 Presentation – TLS, SSL, data formatting
  • 5 Session – NetBIOS, RPC, dialogs
  • 4 Transport – TCP/UDP, segmentation, ports
  • 3 Network – IP, routing, ACLs
  • 2 Data Link – MAC, switching, ARP
  • 1 Physical – cabling, RF, power

Mnemonic

DREAD Risk Model

Prioritize vuln backlog objectively
  • D Damage potential – blast radius if exploited
  • R Reproducibility – how easily repeated
  • E Exploitability – skill/tool requirement
  • A Affected users – population hit
  • D Discoverability – chance an attacker finds it

Acronym Board

Governance & Risk

4 terms
ALE SLE × ARO

Annualized Loss Expectancy

ARO Expected frequency / year

Annualized Rate of Occurrence

MTTR Recovery speed metric

Mean Time To Repair

MTBF Reliability indicator

Mean Time Between Failures

Identity & Access

4 terms
MFA 2+ different categories

Multi-Factor Authentication

SSO One login, many apps

Single Sign-On

RBAC Job function driven

Role-Based Access Control

ABAC Contextual rules

Attribute-Based Access Control

Network & Platform

4 terms
NAC Health + identity enforcement

Network Access Control

SDN Controller-based segmentation

Software-Defined Networking

CASB Policy enforcement for SaaS

Cloud Access Security Broker

WAF Layer 7 shield

Web Application Firewall

Threat Intel & Ops

4 terms
IoC Artifacts of intrusion

Indicator of Compromise

TTP Behavioral fingerprint

Tactics, Techniques, Procedures

EDR Continuous endpoint telemetry

Endpoint Detection & Response

SOAR Playbook automation

Security Orchestration, Automation & Response

Final Lap

Simulate exam day often

Keep the structure above visible beside your practice engine, narrate your choices, and tighten the weakest section each evening.

Run a 90 min mock Write one PBQ walkthrough Log lessons learned