CompTIA SY0-701 Cheat Sheet: Security+ Traps

March 28, 2026

CompTIA SY0-701 cheat sheet for Security+ traps, controls, attacks, operations, and final review.

On this page

Use this for last-mile review, not first exposure. Security+ questions usually become easier when you classify the real problem first: is it identity, data, network path, active attack handling, or governance? The strongest answer is usually the one that fits the risk and the workflow at the same time.

IAM: Identity and access management, including authentication, authorization, privilege control, and account lifecycle.

Zero Trust: Security model built around explicit verification, least privilege, and the assumption that breach is possible.

GRC: Governance, risk, and compliance work that ties policy, risk handling, and evidence together.

Fast lane picker

If the question is really about…	Focus first on…	Strongest first move
access, credentials, or admin rights	IAM, MFA, least privilege, PAM/PIM	remove standing trust and narrow access
attack style or exposure path	threat vector, vulnerability, mitigation family	decide whether the problem is prevention, detection, or containment
architecture or trust boundary	segmentation, zero trust, data protection, resilience	place the control at the right boundary
evidence, logs, or incident handling	IR phase, chain of custody, telemetry, containment order	protect evidence while controlling damage
policy, audit, or third-party oversight	risk, governance, privacy, vendor control, compliance	choose the control that is supportable and auditable

Security+ decision flow

    flowchart LR
	  A["Read the operational constraint"] --> B["Classify the problem family"]
	  B --> C["Choose the control or workflow family"]
	  C --> D["Check least privilege, evidence, and business fit"]
	  D --> E["Eliminate answers that are broad, vague, or operationally unrealistic"]

SY0-701 answer sequence

Use this when the stem mixes an asset, a risk, a control, or an incident-response step.

    flowchart TD
	  S["Scenario"] --> A["Name the asset and risk"]
	  A --> C["Choose the control family"]
	  C --> I["Check identity, boundary, or evidence"]
	  I --> R["Follow the correct response sequence"]
	  R --> V["Verify business fit and recovery"]

What to notice:

the strongest answer usually fits both security theory and real operations
“more security everywhere” is often weaker than a narrower control that actually matches the scenario
if the scenario includes audit, legal, or recovery language, those constraints matter as much as the technical control

Control-family chooser

Requirement	Strongest first fit	Why
stop or reduce the chance of an event	preventive control	blocks or limits the problem early
notice suspicious behavior	detective control	improves visibility and response
fix the environment after an event	corrective control	restores safe state
replace an ideal control with a workable alternative	compensating control	keeps risk acceptable when the preferred control is not feasible
discourage bad behavior	deterrent control	changes behavior through warning or visibility

IAM and access chooser

Requirement	Strongest first fit	Why
stronger user authentication	MFA	independent factors improve assurance
reduce admin exposure	PAM/PIM plus least privilege	shortens privileged access duration
app or service authorization at scale	RBAC or ABAC depending context	role- or attribute-based control stays manageable
federated sign-in	SAML or OIDC style federation	centralizes identity and lifecycle
onboarding and offboarding discipline	joiner-mover-leaver process	stale access is a recurring exam trap

Pair	Keep this distinction clear
authentication vs authorization	prove identity vs decide permitted action
RBAC vs ABAC	role assignment vs policy from attributes and context
password spraying vs credential stuffing	one password across many accounts vs reused breached credentials
PAM/PIM vs MFA	privileged-session control vs authentication strength

Threats, attacks, and mitigation cues

Pattern	Best memory hook	Strongest first mitigation lane
phishing / spoofed mail	user trust is being manipulated	SPF, DKIM, DMARC, filtering, awareness
ransomware spread	encryption and propagation after compromise	isolate systems, contain spread, preserve evidence
SQL injection	attacker controls query input	parameterized queries and validation
XSS	hostile script reaches another user’s browser	output encoding and input handling
supply-chain compromise	trusted vendor or package path is poisoned	validation, provenance, monitoring, response planning
lateral movement	attacker is traversing trust boundaries	segmentation, least privilege, stronger identity controls

Architecture and zero-trust chooser

Requirement	Strongest first fit	Why
reduce implicit trust on the internal network	zero trust plus segmentation	do not trust network location alone
protect sensitive data in use, transit, and rest	appropriate encryption plus access control and monitoring	match control to data state
narrow admin and service exposure	least privilege, approved management path, logging	improves accountability and reduces abuse surface
improve resilience	HA, recovery planning, backup and tested restore	continuity is not only prevention

Pair	Keep this distinction clear
encryption vs hashing	confidentiality vs integrity check
hashing vs digital signature	integrity only vs integrity plus sender proof
tokenization vs encryption	replace sensitive value vs transform it cryptographically
HA vs backup	stay available during failure vs restore later
segmentation vs microsegmentation	broad internal boundary vs finer-grained workload boundary

Operations and incident-response chooser

Requirement	Strongest first fit	Why
preserve forensic value during an incident	containment plus evidence handling	control damage without destroying proof
improve detection	telemetry, correlation, alert tuning, SIEM workflow	signal quality matters
repeatable response to common events	automation and runbooks	reduces inconsistency under pressure
active incident handling	follow IR phases in order	containment before eradication is a recurring exam cue

    flowchart LR
	  A["Preparation"] --> B["Identification"]
	  B --> C["Containment"]
	  C --> D["Eradication"]
	  D --> E["Recovery"]
	  E --> F["Lessons learned"]

GRC and oversight quick map

Term	Fast distinction
policy	top-level requirement or intent
standard	mandatory supporting rule
procedure	exact how-to
guideline	preferred but more flexible practice
risk register	tracked list of risks, owners, and responses
BIA	identifies business impact and recovery priorities
due diligence	investigate and assess appropriately
due care	act responsibly based on what is known

High-confusion pairs

Pair	Fast distinction
vulnerability assessment vs penetration test	broad weakness identification vs authorized exploitation to prove impact
detective vs preventive control	notice it vs stop or reduce it
vulnerability vs threat vs exploit	weakness vs danger actor/event vs attack method
chain of custody vs basic documentation	evidence integrity trail vs ordinary note-taking
privacy requirement vs security requirement	lawful data handling vs protection control, though they overlap

Last 15-minute review

Review this	Because it fixes…
preventive/detective/corrective/compensating controls	control-family confusion
IAM, RBAC, ABAC, PAM/PIM, MFA	access and privilege mistakes
spraying vs stuffing, XSS vs SQLi, supply chain vs shadow IT	attack-pattern confusion
encryption, hashing, signatures, tokenization	crypto misuse
IR phases and evidence handling	operations mistakes
policy/standard/procedure/guideline plus BIA and risk register	governance misses

What strong answers usually do

choose the control that fits both the risk and the workflow
preserve least privilege, evidence, and business practicality
separate identity, data, path, and governance problems cleanly
favor targeted, supportable controls over vague “more security” answers

Quiz

Loading quiz…

From here, use the study plan for pacing, the glossary when terms blur together, or the resources page when you need the official CompTIA references.

Revised on Sunday, May 10, 2026

Sample Questions

Glossary