COMPTIA SECURITY+ / STUDY RESOURCE Find the detail you need.
Keep the concepts connected.
Review protocols, attacks, cryptography, and controls as you prepare for your next practice session.
Published by PrepForCerts · Editorial responsibility and sources
CompTIA Security+ Cheat Sheet: The Ultimate Quick Reference Guide
This Security+ cheat sheet condenses essential exam information into a quick-reference format. While understanding beats memorization, having key facts at your fingertips accelerates exam performance. Use this during study sessions and as a final review tool—but always pair it with deeper conceptual learning.
Key points for your next step
This Security+ cheat sheet covers essential ports and protocols, encryption algorithms, attack types, security frameworks, and key acronyms. Use it for quick reference during study and final review before your exam—but remember to understand concepts, not just memorize lists.
- Key Ports
- 20+
- Attack Types
- 25+
- Encryption Types
- 15+
- Frameworks
- 10+
Exam reference: SY0-701 has up to 90 questions in 90 minutes and uses a scaled 750/900 passing score. Use the current CompTIA objectives. Study durations and practice percentages here are planning examples, not requirements or pass guarantees. Provider and regional prices change; confirm current costs before purchase.
Retake policy · Renewal routes · CE fees
SY0-701 retirement: English ends June 11, 2027; Japanese, Portuguese, Spanish, and Thai end August 13, 2027. Check the official exam page before booking and choose resources for your exam version.
This CompTIA Security+ cheat sheet distills the most critical concepts, ports, protocols, acronyms, and formulas from all five exam domains into a single reference guide. Whether you are reviewing the night before your exam or reinforcing key topics during your study period, this cheat sheet covers the high-frequency items that appear most often on the Security+ exam.
Remember: you cannot bring notes into the exam, but you can perform a "brain dump" — writing down memorized formulas and key facts on the provided whiteboard immediately after the exam starts. Practice your brain dump with this cheat sheet until you can reproduce the critical tables from memory.
Domain 1: General Security Concepts (12%)
This domain covers the foundational security principles that underpin every other topic on the exam:
- CIA Triad: Confidentiality (encryption, access controls), Integrity (hashing, digital signatures), Availability (redundancy, fault tolerance)
- AAA Framework: Authentication (who are you?), Authorization (what can you access?), Accounting (what did you do?)
- Zero Trust: "Never trust, always verify." Assumes no implicit trust regardless of network location. Key principles: least privilege, microsegmentation, continuous verification.
- Defense in Depth: Layered security approach — physical, network, host, application, and data layers.
- Separation of Duties: No single person should control all aspects of a critical function.
- Least Privilege: Users and systems should have only the minimum access necessary to perform their function.
Domain 2: Threats, Vulnerabilities, and Mitigations (22%)
Common Attack Types
| Attack | Description | Mitigation |
|---|---|---|
| Phishing | Social engineering via fraudulent emails | User training, email filtering, MFA |
| Ransomware | Encrypts data, demands payment | Backups, endpoint protection, network segmentation |
| SQL Injection | Malicious SQL in input fields | Parameterized queries, input validation, WAF |
| XSS | Injecting scripts into web pages | Output encoding, CSP headers, input sanitization |
| Man-in-the-Middle | Intercepting communications | TLS/SSL, certificate pinning, HSTS |
| DDoS | Overwhelming resources with traffic | CDN, rate limiting, cloud-based DDoS protection |
| Brute Force | Trying all possible passwords | Account lockout, MFA, long passphrases |
| Privilege Escalation | Gaining unauthorized higher access | Patching, least privilege, monitoring |
Threat Actors
Nation-states (APTs, well-funded), Hacktivists (politically motivated), Organized crime (financially motivated), Insider threats (employees, contractors), Script kiddies (low skill, using existing tools).
Domain 3: Security Architecture (18%)
Network Architecture Concepts
- DMZ (Demilitarized Zone): Network segment between external and internal networks for public-facing services
- VLAN: Logically segments a network at Layer 2 to reduce broadcast domains and improve security
- NAC (Network Access Control): Verifies device compliance before granting network access
- Microsegmentation: Granular network isolation, often software-defined, core to zero trust architecture
- Air Gap: Complete physical isolation of a network from all other networks
Cloud Security Models
| Model | You Manage | Provider Manages |
|---|---|---|
| IaaS | OS, apps, data, middleware | Hardware, virtualization, networking |
| PaaS | Apps and data | OS, middleware, runtime, hardware |
| SaaS | Data (sometimes configuration) | Everything else |
Domain 4: Security Operations (28%)
This is the largest domain at 28% of the exam. Focus heavily on these operational concepts:
Security Tools and Technologies
- SIEM: Aggregates and correlates logs from multiple sources for threat detection (e.g., Splunk, Microsoft Sentinel)
- SOAR: Automates incident response workflows and orchestrates security tools
- IDS/IPS: Intrusion Detection (passive monitoring) vs. Intrusion Prevention (active blocking)
- EDR: Endpoint Detection and Response — monitors endpoints for suspicious behavior
- DLP: Data Loss Prevention — prevents unauthorized data exfiltration
- NAC: Controls network access based on device compliance and user identity
Incident Response Process
- Preparation — Policies, procedures, team training, tools
- Detection & Analysis — Identify indicators of compromise (IoCs)
- Containment — Isolate affected systems (short-term and long-term)
- Eradication — Remove the threat completely
- Recovery — Restore systems to normal operation
- Lessons Learned — Post-incident review and documentation
Domain 5: Security Program Management and Oversight (20%)
Risk Management Formulas
SLE (Single Loss Expectancy) = Asset Value × Exposure Factor
ALE (Annualized Loss Expectancy) = SLE × ARO (Annual Rate of Occurrence)
Risk = Likelihood × Impact
Risk Response Strategies
- Avoidance: Eliminate the risk by removing the activity or asset
- Mitigation: Reduce the likelihood or impact through controls
- Transfer: Shift risk to a third party (insurance, contracts)
- Acceptance: Acknowledge the risk and proceed without additional controls
Compliance Frameworks
NIST CSF (Identify, Protect, Detect, Respond, Recover), ISO 27001 (ISMS standard), PCI DSS (payment card data), HIPAA (healthcare data), GDPR (EU personal data), SOC 2 (service organization controls).
Essential Ports and Protocols
| Port | Protocol | TCP/UDP | Secure Alternative |
|---|---|---|---|
| 20/21 | FTP | TCP | SFTP (22) or FTPS (990) |
| 22 | SSH / SFTP / SCP | TCP | Already secure |
| 23 | Telnet | TCP | SSH (22) |
| 25 | SMTP | TCP | SMTPS (465/587) |
| 53 | DNS | TCP/UDP | DoH (443) / DoT (853) |
| 80 | HTTP | TCP | HTTPS (443) |
| 110 | POP3 | TCP | POP3S (995) |
| 143 | IMAP | TCP | IMAPS (993) |
| 161/162 | SNMP | UDP | SNMPv3 |
| 389 | LDAP | TCP | LDAPS (636) |
| 443 | HTTPS | TCP | Already secure |
| 3389 | RDP | TCP | RDP over VPN/gateway |
Secure Protocols (Memorize These):
- HTTPS (443/TCP): Secure web traffic
- SSH (22/TCP): Secure remote access
- SFTP (22/TCP): Secure file transfer over SSH
- FTPS (990/TCP): FTP over TLS/SSL
- LDAPS (636/TCP): Secure LDAP
- IMAPS (993/TCP): Secure IMAP
- POP3S (995/TCP): Secure POP3
- SMTPS (465/587/TCP): Secure SMTP
Standard Protocols:
- HTTP (80/TCP): Web traffic
- FTP (21/TCP control, 20/TCP data): File transfer
- DNS (53/UDP/TCP): Name resolution
- DHCP (67-68/UDP): IP assignment
- SMTP (25/TCP): Email sending
- IMAP (143/TCP): Email retrieval
- POP3 (110/TCP): Email retrieval
- SNMP (161-162/UDP): Network management
- RDP (3389/TCP): Remote Desktop
- Telnet (23/TCP): Unsecured remote access
VPN and Security:
- IPSec (500/UDP, 4500/UDP): VPN
- IKE (500/UDP): Key exchange
- L2TP (1701/UDP): VPN tunneling
- PPTP (1723/TCP): Legacy VPN
- OpenVPN (1194/UDP): VPN
- Syslog (514/UDP): Logging
Memory Tip
Secure versions often add 443 (HTTPS) or use the original port with S suffix. Know both secure and insecure versions—Security+ tests which protocol is appropriate.
Cryptography Quick Reference
Symmetric Encryption (Same Key)
AES (128/192/256-bit) — current standard, used everywhere. 3DES (168-bit effective) — legacy, being phased out. ChaCha20 — fast on mobile devices, used in TLS 1.3.
Asymmetric Encryption (Key Pair)
RSA (2048/4096-bit) — most common for digital signatures and key exchange. ECC (256-bit ≈ RSA 3072-bit) — faster, smaller keys, preferred for mobile. Diffie-Hellman — key exchange protocol, not encryption itself.
Hashing Algorithms
SHA-256 — current standard for integrity verification. SHA-3 — next-generation hash. MD5 — broken, do not use for security (still seen in legacy systems). bcrypt/scrypt — designed for password hashing with salt and work factor.
Symmetric Encryption (Same key encrypts/decrypts):
- AES: Current standard, 128/192/256-bit keys
- 3DES: Legacy, being phased out
- Blowfish/Twofish: Block ciphers
- RC4: Stream cipher, deprecated
Asymmetric Encryption (Public/private key pairs):
- RSA: Most common, key exchange and signing
- ECC: Smaller keys, mobile-friendly
- Diffie-Hellman: Key exchange only
- DSA: Digital signatures
Hashing (One-way, integrity verification):
- MD5: 128-bit, deprecated for security
- SHA-1: 160-bit, deprecated
- SHA-256/SHA-3: Current standards
- HMAC: Hash with key, authentication
Key Concepts:
- Symmetric = Fast, shared key problem
- Asymmetric = Slow, solves key distribution
- Hybrid = Asymmetric for key exchange, symmetric for data
- Digital Signature = Hash encrypted with private key
- Certificate = Public key + identity, signed by CA
Common Exam Scenarios
Know when to use each type: symmetric for bulk data, asymmetric for key exchange and signatures, hashing for integrity verification without decryption.
Social Engineering:
- Phishing: Fraudulent emails for credentials
- Spear Phishing: Targeted phishing
- Whaling: Executive-targeted phishing
- Vishing: Voice phishing
- Smishing: SMS phishing
- Pretexting: Fabricated scenario
- Tailgating: Physical access following
Network Attacks:
- DoS/DDoS: Service disruption
- Man-in-the-Middle: Traffic interception
- ARP Poisoning: MAC address manipulation
- DNS Poisoning: Fake DNS responses
- Session Hijacking: Stealing active sessions
- Replay Attack: Captured data reuse
Application Attacks:
- SQL Injection: Database manipulation
- XSS: Script injection in browsers
- CSRF: Unauthorized actions via user session
- Buffer Overflow: Memory manipulation
- LDAP Injection: Directory service attacks
- XML Injection: XML data manipulation
Malware Types:
- Virus: Requires host, replicates
- Worm: Self-replicating, no host needed
- Trojan: Disguised malicious software
- Ransomware: Encrypts for ransom
- Spyware: Surveillance software
- Rootkit: Hidden admin access
- Logic Bomb: Trigger-based execution
- Keylogger: Keystroke capture
Attack vs. Mitigation Pairs
For each attack, know the primary mitigation: SQL injection → input validation/parameterized queries; XSS → output encoding; DDoS → CDN/rate limiting.
Key Acronyms to Memorize
| Acronym | Full Name |
|---|---|
| CIA | Confidentiality, Integrity, Availability |
| AAA | Authentication, Authorization, Accounting |
| SIEM | Security Information and Event Management |
| SOAR | Security Orchestration, Automation, Response |
| PKI | Public Key Infrastructure |
| MFA | Multi-Factor Authentication |
| IDS/IPS | Intrusion Detection/Prevention System |
| EDR | Endpoint Detection and Response |
| XDR | Extended Detection and Response |
| DLP | Data Loss Prevention |
| WAF | Web Application Firewall |
| CASB | Cloud Access Security Broker |
| NAC | Network Access Control |
| IoC | Indicator of Compromise |
| APT | Advanced Persistent Threat |
Frequently Asked Questions
Frameworks and Standards
Security Frameworks:
- NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, Recover
- ISO 27001/27002: Information security management
- CIS Controls: Prioritized security actions
- COBIT: IT governance framework
Compliance and Regulations:
- PCI-DSS: Payment card security
- HIPAA: Healthcare data protection
- GDPR: EU data privacy
- SOX: Financial reporting
- FERPA: Educational records
- GLBA: Financial institution privacy
Risk Management:
- Risk = Threat × Vulnerability × Impact
- Risk Response: Accept, Avoid, Transfer, Mitigate
- Quantitative: ALE = SLE × ARO
- Qualitative: High/Medium/Low ratings
Authentication Standards:
- RADIUS: AAA for network access
- TACACS+: AAA, separates auth/author/account
- SAML: SSO, XML-based
- OAuth: Authorization (not authentication)
- OpenID Connect: Authentication layer on OAuth
- Kerberos: Ticket-based authentication
Framework Selection
Know which framework applies to which industry: healthcare → HIPAA, payment cards → PCI-DSS, general security → NIST CSF.
Must-Know Acronyms
Security Concepts:
- CIA: Confidentiality, Integrity, Availability
- AAA: Authentication, Authorization, Accounting
- DAD: Disclosure, Alteration, Destruction
- IAAA: Identification, Authentication, Authorization, Accounting
Access Control:
- RBAC: Role-Based Access Control
- ABAC: Attribute-Based Access Control
- MAC: Mandatory Access Control
- DAC: Discretionary Access Control
Security Tools:
- IDS: Intrusion Detection System
- IPS: Intrusion Prevention System
- SIEM: Security Information and Event Management
- SOAR: Security Orchestration, Automation, Response
- DLP: Data Loss Prevention
- EDR: Endpoint Detection and Response
- XDR: Extended Detection and Response
- NAC: Network Access Control
Incident Response:
- IOC: Indicator of Compromise
- IOA: Indicator of Attack
- TTP: Tactics, Techniques, Procedures
- MITRE ATT&CK: Adversary behavior framework
Cryptography:
- PKI: Public Key Infrastructure
- CA: Certificate Authority
- CRL: Certificate Revocation List
- OCSP: Online Certificate Status Protocol
- CSR: Certificate Signing Request
Acronym Strategy
Create flashcards for acronyms. Security+ questions often use acronyms without expansion—you must know them instantly.
Put the guidance into practice
Learn Concepts First
Use this cheat sheet to reinforce learning, not replace it. Understand why before memorizing what.
For each item on the cheat sheet, be able to explain its purpose and when to use it.
Create Flashcards
Turn key sections into flashcards for active recall practice.
Digital flashcard apps like Anki use spaced repetition for efficient memorization.
Practice Application
Use practice questions to apply cheat sheet knowledge to scenarios.
Security+ tests application, not just recall—know when to use each concept.
Final Review
Review this cheat sheet in the final days before your exam.
Write key items on scratch paper at exam start while fresh in memory.
More study tips
Understand concepts before memorizing—the exam tests application, not just recall.
Create attack/mitigation pairs for each attack type.
Know secure vs. insecure protocol alternatives (HTTPS vs HTTP, SSH vs Telnet).
Practice writing key information from memory—this builds exam-day recall.
Focus on high-frequency items: common ports, encryption types, major attack categories.
Mistakes to check for
Memorizing without understanding—you must apply knowledge to scenarios.
Focusing on obscure items while missing common, high-frequency content.
Not practicing active recall—passive review doesn't build exam-day performance.
Relying only on the cheat sheet without comprehensive study.
Cramming the night before instead of consistent review over time.
Study note
This cheat sheet is a tool, not a shortcut. Candidates who memorize without understanding fail scenario-based questions. Use it to reinforce and organize knowledge you've built through proper study.
Test Your Security+ Knowledge
Practice applying cheat sheet concepts to realistic exam scenarios.
Start Free Practice TestWhat should a Security+ cheat sheet include?
A comprehensive Security+ cheat sheet should cover all 5 exam domains (threats, architecture, implementation, operations, governance), essential ports and protocols, cryptography algorithms with key sizes, common acronyms, risk management formulas, and attack type definitions.
Can I bring a cheat sheet to the Security+ exam?
No. You cannot bring any notes, cheat sheets, or reference materials into the exam. However, you can do a "brain dump" — writing down memorized formulas and key facts on the provided whiteboard or scratch paper immediately after the exam starts.
No. You cannot bring any materials into the testing room. However, you're given scratch paper—write key memorized information immediately when the exam starts.
What ports should I memorize for Security+?
Key ports include: FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53), HTTP (80), HTTPS (443), POP3 (110), IMAP (143), LDAP (389), LDAPS (636), RDP (3389), and SNMP (161/162). Memorize both the port number and whether it uses TCP, UDP, or both.
What are the most important acronyms for Security+?
Critical acronyms include: CIA (Confidentiality, Integrity, Availability), AAA (Authentication, Authorization, Accounting), SIEM (Security Information and Event Management), IDS/IPS (Intrusion Detection/Prevention System), PKI (Public Key Infrastructure), and SOAR (Security Orchestration, Automation, and Response).
How many domains does the Security+ exam have?
The current exam has 5 domains: General Security Concepts (12%), Threats Vulnerabilities and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%).
What risk formulas appear on Security+?
Key formulas include: SLE = Asset Value × Exposure Factor, ALE = SLE × ARO (Annual Rate of Occurrence), and Risk = Likelihood × Impact. Understanding quantitative vs. qualitative risk assessment is essential.
What cryptography concepts are on Security+?
You should know symmetric vs. asymmetric encryption, hashing algorithms (SHA-256, MD5), key exchange (Diffie-Hellman), digital signatures, PKI and certificate authorities, and common algorithms (AES-256, RSA, ECC) with their typical key sizes.
How should I use this cheat sheet to study?
Use this cheat sheet as a review tool, not a primary study resource. Study each domain in depth first, then use the cheat sheet to reinforce key facts. In the final week before your exam, review the cheat sheet daily and practice writing a brain dump from memory.
Test Your Security+ Knowledge
Practice with unlimited adaptive questions covering all five Security+ domains.
Start Free Practice Test →More questions about Security+
Should I memorize all these ports?
Focus on the most common 15-20 ports. Know secure alternatives for each insecure protocol. Obscure ports rarely appear on the exam.
How do I use this cheat sheet effectively?
Use it for reference during study, create flashcards from key sections, and review during the final week before your exam. Don't rely on it as your only study resource.
Is this cheat sheet enough to pass?
No. This is a reference tool to supplement comprehensive study. Security+ requires understanding concepts and applying them to scenarios—not just memorization.
Related Security+ resources
Practice and topic review
Study and exam planning
- Security+ Study Guide
- Security+ Requirements
- Security+ Exam Cost
- Security+ Exam Tips
Test-taking strategies
- Certification Overview
Complete guide and requirements
- How to Pass
Study tips and exam strategies
- CompTIA Security+ Exam Objectives & Domains (2026)
Exam objectives
- CompTIA Security+ Renewal: Requirements & Costs (2026)
Renewal & CE
- CompTIA Security+ Weekend Study Plan: Pass While Working Full-Time 2026
Study plan
- Is CompTIA Security+ Hard? Honest Difficulty Analysis for 2026
Difficulty
- Security+ Flashcards
Turn the cheat sheet into active recall