A compact review aid for the concepts that are easy to mix up under time pressure. Use it after full study, not as a substitute for the official objectives or hands-on practice.
Tip: use your browser's Print command to save this page as a PDF or print a paper copy.
Exact response actions depend on the incident, evidence requirements, business impact, and authorization.
Zeph Tech is not CompTIA and this page does not reproduce confidential or recalled exam questions. Use the certification owner's current exam objectives as the source of truth for the live exam.
Check the reviewed Security+ exam recordUse this cram sheet as a compression layer after you have already studied the domains. If a term below feels unfamiliar, stop and return to the full study guide before continuing. Last-minute review is most effective when it refreshes connected concepts you already understand rather than introducing large amounts of new material.
For cryptography, keep the purpose of each primitive clear. Symmetric encryption protects confidentiality efficiently with one shared secret. Asymmetric cryptography supports key exchange, digital signatures, and identity use cases with a public/private pair. Hashing is one-way integrity verification, while digital signatures combine hashing with asymmetric operations to provide integrity, authenticity, and non-repudiation properties.
For identity and access management, distinguish authentication from authorization every time. MFA strengthens proof of identity; RBAC and ABAC influence what an authenticated subject can do; privileged access management constrains administrative power; federation allows identity assertions across trust boundaries; SSO reduces repeated authentication but does not itself guarantee stronger authentication.
For network defense, remember that segmentation reduces blast radius, NAC controls admission, firewalls enforce traffic policy, IDS detects suspicious activity, IPS can block it inline, WAFs specialize in web-layer traffic, and secure DNS controls or filtering can disrupt malicious resolution. The exam often mixes these controls in one scenario, so match the control to the layer and objective.
A vulnerability is a weakness, a threat is something capable of exploiting a weakness, an exploit is the method or code used to take advantage of it, and risk combines likelihood with impact. Vulnerability scanning identifies known weaknesses at scale; penetration testing attempts exploitation to validate attack paths; red-team activity measures broader defensive effectiveness against an adversary-style objective.
When reviewing social-engineering terms, tie each label to the attacker’s delivery mechanism and target. Phishing is broad deceptive messaging, spear phishing is targeted, whaling focuses on high-value executives, smishing uses SMS, vishing uses voice, and business email compromise frequently abuses trusted identities or payment workflows. The scenario details matter more than memorizing the labels alone.
RTO is the target time to restore a service; RPO is the maximum acceptable data-loss window measured backward from disruption. High availability reduces interruption through redundancy, while backup and recovery address restoration after loss. Hot, warm, and cold recovery strategies trade readiness and cost. Always connect the continuity term to the business requirement stated in the question.
Incident response is sequential even when real incidents overlap activities. Preparation comes first, followed by detection and analysis, containment, eradication, recovery, and lessons learned. Preserve evidence and document actions as required by policy. If the question asks for the next step, choose the action that fits the current phase rather than the most technically dramatic response.
Logs and telemetry are useful only when you understand what they can prove. Authentication logs can show sign-in attempts and privilege events; endpoint telemetry can reveal processes and files; network records show connections and flows; DNS records reveal name-resolution behavior; cloud audit logs capture administrative actions. Correlating several sources produces stronger conclusions than relying on one alert.
Policies state management intent, standards define mandatory specifics, procedures describe how work is performed, and guidelines provide recommended practices. Risk acceptance keeps the risk, transfer shifts some financial or contractual consequence, mitigation reduces likelihood or impact, and avoidance removes the activity creating the risk. These distinctions appear frequently because several answers can sound reasonable.
On exam day, slow down when the prompt contains words such as BEST, FIRST, MOST likely, LEAST privilege, or NEXT. Those qualifiers often separate the correct response from another answer that is technically valid. Read the final sentence first, identify the requested decision, then return to the scenario details that constrain that decision.
If two answers remain, state aloud or mentally what each option accomplishes. Prefer the answer that directly satisfies the stated objective with the least unnecessary scope or disruption. When a question describes an existing process stage, stay within that stage. When it describes a business constraint, do not ignore it in favor of a theoretically stronger but operationally incompatible control.
Finish your review by revisiting only your weak domains and missed-question categories. Do not spend the final hour re-reading material you consistently answer correctly. Targeting recurring confusion—especially sequencing, similar acronyms, control placement, recovery metrics, and governance vocabulary—usually produces more value than one more full-length practice set immediately before the exam.