Here is a Security+ (SY0-701) Exam Cram Guide for the topics most frequently tested.
CIA Triad + Non-Repudiation
Confidentiality
Goal: Prevent unauthorized disclosure of data.
Keywords
- Encryption
- Access control
- Permissions
- Data classification
- Need-to-know
- Least privilege
- Data masking
- Tokenization
Examples
- AES encryption
- TLS/HTTPS
- VPNs
- File permissions
- MFA
Exam Tip
If the question is about keeping information secret, think Confidentiality.
Examples:
- Encrypting emails
- Securing customer data
- Preventing unauthorized viewing
Integrity
Goal: Ensure data is accurate and has not been altered.
Keywords
- Hashing
- Digital signatures
- Checksums
- Change management
- File integrity monitoring
Examples
- SHA-256
- MD5 (not secure, but tested)
- Digital signatures
- Certificates
Exam Tip
If the question asks whether data was modified, think Integrity.
Examples:
- Verifying a downloaded file
- Detecting tampering
- Validating data accuracy
Availability
Goal: Ensure systems and data are accessible when needed.
Keywords
- Redundancy
- Fault tolerance
- Load balancing
- Clustering
- Backups
- RAID
- UPS
- Disaster Recovery
Examples
- Redundant ISP
- RAID arrays
- Generators
- Failover clusters
Exam Tip
If the question focuses on uptime, think Availability.
Examples:
- DDoS attacks affect Availability
- Hardware redundancy increases Availability
Non-Repudiation
Goal: Prevent someone from denying an action they performed.
Keywords
- Digital signatures
- PKI
- Certificates
- Audit logs
- Email signing
Examples
- Signed email
- Digitally signed document
- Code signing
Exam Tip
If a user cannot deny they sent a message, think Non-Repudiation.
Remember:
Security Control Categories
These describe how controls are managed or implemented.
Technical Controls
Keywords
- Hardware
- Software
- Systems
Examples
- Firewalls
- IPS
- Antivirus
- MFA
- Encryption
Exam Tip
If technology enforces the control, it is Technical.
Managerial Controls
Keywords
- Risk management
- Governance
- Planning
- Policies
Examples
- Risk assessments
- Security policies
- Security awareness program
Exam Tip
Managers create the rules.
Think:
Operational Controls
Keywords
- People
- Processes
- Procedures
Examples
- User training
- Incident response
- Change management
- Daily operations
Exam Tip
If humans perform the control, it is usually Operational.
Physical Controls
Keywords
- Building
- Access
- Environmental
Examples
- Locks
- Fences
- Guards
- Cameras
- Bollards
- Mantraps
Exam Tip
If it protects a physical location, think Physical Control.
Security Control Functional Types
These describe what the control does.
Preventive Controls
Purpose
Stop attacks before they occur.
Examples
- Firewall
- MFA
- ACL
- Security guard
- Mantrap
Exam Tip
Detective Controls
Purpose
Discover attacks.
Examples
- IDS
- SIEM
- Audit logs
- Cameras
- Motion detectors
Exam Tip
Corrective Controls
Purpose
Fix issues after an incident.
Examples
- Patching
- Antivirus quarantine
- Restoring configurations
Exam Tip
Deterrent Controls
Purpose
Discourage attackers.
Examples
- Warning signs
- Security guards
- Lighting
- Fences
Exam Tip
Compensating Controls
Purpose
Alternative control when the primary control cannot be used.
Example
Can't use MFA?
Use:
- Extra monitoring
- Enhanced passwords
Exam Tip
Directive Controls
Purpose
Tell users what must be done.
Examples
- Policies
- Procedures
- Standards
- Security training
Exam Tip
Recovery Controls
Purpose
Restore systems after an outage.
Examples
- Backups
- Disaster Recovery
- Business Continuity
- Site failover
Exam Tip
Security+ Memory Trick
Common Exam Match-Ups
- Firewall = Technical + Preventive
- IDS = Technical + Detective
- IPS = Technical + Preventive
- Security Guard = Physical + Deterrent
- CCTV = Physical + Detective
- Security Policy = Managerial + Directive
- User Awareness Training = Operational + Directive
- Backup System = Technical + Recovery
- Disaster Recovery Plan = Operational + Recovery
- MFA = Technical + Preventive
- Audit Logs = Technical + Detective + Non-Repudiation
Fast Exam Rule:
When you see a Security+ control question, ask:
- Is it Technical, Managerial, Operational, or Physical?
- Does it Stop, Detect, Fix, Deter, Guide, Replace, or Recover?
That two-step process answers most Security+ control questions in under 10 seconds. ✅
No comments:
Post a Comment