SY0-801 cheat sheet — every exam topic on one page

General Security Concepts

Security+ SY0-801 Security Controls: Categories, Types, CIA, AAA and Zero Trust

• Defense in depth stacks independent, diverse layers; a second copy of the control that failed, or a tweak to it, is not a new layer.
• Ask what happened to the data: disclosed is confidentiality, changed is integrity, unreachable is availability. Ransomware without exfiltration is an availability attack.
• Encryption protects confidentiality, and a private circuit is isolated, not encrypted; hashes and signatures protect integrity; replication and RAID protect availability but copy every alteration, so recovery from tampering needs immutable, versioned backups.
• Identification claims, authentication proves, authorization permits or denies (for every request and every object), accounting records. A denial after a successful sign-in is authorization.
• Non-repudiation needs a private key only the signer holds and an individual account per person; shared secrets and shared accounts defeat it.
• Zero Trust removes trust based on network location and re-verifies identity, device and context for every request and throughout the session.
• Least privilege limits both scope and time: scoped roles and service accounts, plus just-in-time elevation for occasional privileged work.
• Category is how a control is implemented (technical, managerial, operational, physical); type is what it does (prevent, deter, detect, correct, compensate, direct). Classify each axis separately.
• Classify the function and configuration in front of you: a fast automatic repair is still corrective, and a prevention product that only alerts is detective.

Security+ SY0-801 Change Management: CAB, Backout and Fail Forward

• The CAB is cross-functional so each affected area can judge a change's risk; it decides, while the owner and implementers plan, test and do the work.
• Emergency changes get expedited approval and an after-the-fact review; they are never undocumented.
• Routine, repeatable work is pre-approved as a standard change under an SOP, and that approval covers only the task the SOP describes.
• The change owner is accountable end to end; the implementer only does the work. Stakeholders include every team, record and device the change affects.
• Impact analysis must flag security impacts (controls that stop working) and single points of failure, and rank findings by consequence.
• Failed tests or an untested backout plan are reasons to defer approval; tests only count if the test environment matches production.
• Back out when a change is broken and no fix is known, before the window runs out; fail forward when going back is unsafe or would reopen a security flaw.
• Size the maintenance window for the work plus the backout, and implement only within the approved scope and time.
• A change that alters what runs or connects needs allow/deny list updates; plan the narrowest restart and restart security tooling in batches.
• Close a change only after updating diagrams, policies and procedures; keep configurations, scripts and policies under version control and revert rather than rewrite history.

Security+ SY0-801 Cryptography: PKI, Certificates, Encryption and Hashing

• Symmetric encryption is fast but has a key-distribution problem; asymmetric solves distribution but is slow, so systems use hybrid encryption.
• Encrypt with the recipient's public key; sign with your own private key. Losing a private key loses everything encrypted to it.
• Key escrow keeps decryption keys recoverable but creates one high-value store; never escrow signing keys.
• Trust traces to a root in the client's trust store; servers must send the full chain, and a rogue trusted root enables silent interception.
• A CSR carries the public key and subject, signed by a private key that never leaves the host; *.example.com covers one label only.
• CRLs are scheduled lists; OCSP answers per certificate; stapling removes the client's call to the CA, and soft-fail clients accept a missing answer.
• Disk, partition and volume encryption protect powered-off devices; file encryption travels with the file; record-level encryption hides fields from DBAs.
• Ephemeral Diffie-Hellman gives forward secrecy but must be authenticated; ECC matches RSA strength with much smaller keys.
• Hashes are fixed-length and one-way; MD5 and SHA-1 are collision-broken; salts defeat rainbow tables, key stretching slows guessing.
• TPM = one device's boot measurements and sealed keys; HSM = shared high-volume key operations; KMS = central key lifecycle; obfuscation is not encryption, and tokenization (a random token resolved only by a separate vault) differs from masking, which only hides the display.

Threats, Vulnerabilities, and Attacks

CompTIA Security+ SY0-801 Threat Intelligence, CVSS and CVE Explained

• Threat = what could cause harm; vulnerability = the weakness it exploits; risk = likelihood combined with impact.
• Preventive measures and patching lower likelihood; backups, segmentation, encryption and recovery lower impact; insurance transfers cost rather than reducing harm.
• Threat feeds stream machine-readable indicators into tools; STIX is the content language and TAXII is the HTTPS transport.
• A useful feed is accurate (confidence-scored), timely, relevant and ages out stale indicators; volume is not quality.
• Intelligence sources differ by who produces them and who can see them: OSINT is public, commercial is paid, ISACs share within a sector, governments advise everyone, internal telemetry is yours alone.
• Life cycle: planning and direction, collection, processing, analysis, dissemination, feedback; a failure early in the cycle shows up as a symptom later.
• CVE names one specific flaw (assigned by CNAs, enriched by the NVD); CWE names the type of weakness; many CVEs map to one CWE.
• CVSS bands: Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0; v3.1 and v4.0 scores are not interchangeable.
• Base metrics are constant; exploit status goes in Temporal (v3.1) or Threat (v4.0); local context in Environmental; Supplemental never changes the score.
• CVSS measures severity, not risk: KEV (exploited now), EPSS (likely soon), exposure and asset value drive prioritization.

Security+ SY0-801 Threat Actors and Motivations

• Actor type (who), motivation (why) and attributes (position and capacity) are separate dimensions: classify each on its own
• Internal means access the organization granted, including contractors and MSP staff; external actors must break in or trick someone first
• Funding is what an actor can buy and replace; sophistication is what it can build and evade with its own skill, and the two can diverge
• Organized crime works like a business for profit; state-sponsored actors have the most resources and pursue espionage, influence or disruption without a payday
• Hacktivists publicize a cause; terrorists aim for fear and harm, often through critical infrastructure; competitors seek market advantage and stay silent
• An insider misuses legitimate access deliberately; an accidental actor causes harm by mistake with no intent
• Financial is direct theft; extortion is a demand backed by a threat, even when a grievance started it
• Intellectual property is taking a creation; espionage is covert watching over time; influence is changing what people think
• Ideological is a belief system choosing the targets; political is a demand about a law, policy, government or vote
• Notoriety wants an audience, curiosity does not, revenge follows a grievance with no demand, and ethical disclosure reports real wrongdoing for no gain

Security+ SY0-801 Threat Vectors and Attack Sources

• A threat vector is how an attack arrives; classify a scenario by what the malicious content or access actually travelled through, because each channel has its own controls.
• An APT is defined by long, quiet dwell time and rotating infrastructure; blocking its old indicators fails, and hunting for anomalous use of valid accounts finds it.
• Collaboration tools and RCS bypass email controls entirely: restrict external chat federation to approved domains, and remember RCS lives in the phone's built-in texting app.
• Macros need Enable Content; RTF has no macros but can embed exploit objects; PDFs run JavaScript and launch actions, so disable reader JavaScript when PDFs must still be read.
• A stolen session token replays an already-authenticated session and skips MFA; only revoking sessions and tokens ends it, not a password or authenticator reset.
• Password manager autofill keys on the domain, and a stolen client-side-encrypted vault is only as safe as the master password, because cracking happens offline without MFA.
• Infrastructure devices and hypervisor consoles sit outside EDR: rely on device logs, integrity checks, patching and protected management planes; ephemeral key exchange protects recorded traffic.
• Living-off-the-land tools are signed and allowed, so detection must be behavioural; a USB device that claims to be a keyboard bypasses mass-storage blocks.
• OT puts availability first: unpatched, unauthenticated controllers are protected by segmentation and passive monitoring, not active scanning or agents.
• Challenge-response stops cloning and replay but not relay; cloneable 125 kHz badges are fixed with encrypted smart cards plus a PIN.

Security+ SY0-801 Vulnerability Types and Attack Surfaces

• No fix yet = zero-day; fix available but not installed = unpatched; no fix ever for this version = unsupported; can't meet current requirements even if patched = obsolete
• Approved but outside management tools = unmanaged system; never approved hardware on the network = rogue device; unapproved service adopted by staff = shadow IT
• Accounts that outlive their owners are stale; credentials created outside the central identity system are unmanaged, and offboarding there never reaches them
• Remove or disable services the role does not need; limiting reach to a running service reduces exposure but leaves its flaws in place
• A changeable default password is a misconfiguration; a secret only a new build can change is hardcoded
• Fix TOCTOU race conditions by making check and use atomic, and make security checks fail closed when they error
• A valid signature on an update proves who shipped it, not that it is safe: malicious updates reach fully up-to-date systems
• A strong cipher is undone by weak randomness, unsalted fast hashes or deprecated algorithms
• An IdP signing key and an LLM's connected data and tools are high-value surfaces: everything that trusts them is exposed with them
• A secret that was ever in a public repository is burned: revoke or rotate it first, then clean up; public buckets risk tampering (write) as well as leaks (read)

Security+ SY0-801 Indicators of Malicious Activity

• Name an attack by the one detail that separates it from its near twins, then check the tempting alternatives' defining traits are missing
• A worm spreads with no user action; a virus needs a user to run its host file; a trojan hides inside software the user wanted
• Ransomware is loud (renamed files, ransom notes, deleted shadow copies); a logic bomb is defined by its dormant trigger condition
• A rootkit makes the OS's own tools lie, so trust network or offline evidence; fileless malware runs in memory through built-in tools, with persistence in places like Run keys or WMI subscriptions and no file to hash
• DNS cache poisoning corrupts a resolver while the authoritative answer is correct; domain hijacking corrupts the authoritative answer; ARP spoofing maps the right gateway IP to the wrong MAC; rogue DHCP hands out the wrong gateway IP
• Spear phishing is tailored to specific people; whaling is spear phishing aimed at executives; smishing, vishing and quishing are named by the channel
• CSRF is forged by the victim's browser; SSRF is forged by the server; replay reuses captured hashes or tokens without cracking them
• Brute force means many passwords on one account and lockouts; spraying means few passwords across many accounts and no lockouts; enumeration exploits different responses for valid and invalid users
• Hashes and IPs are the easiest indicators for attackers to change; plaintext strings and behaviour last longer
• Impossible travel is about distance over time; concurrent sessions are about two live sessions at once; event 1102 means the Security log was cleared

Security+ SY0-801 AI Threats and Vulnerabilities

• Poisoning corrupts training or retraining data (including feedback loops and trigger backdoors); model manipulation alters the trained model's weights, file or threshold directly; evasion fools an unchanged model with crafted inputs.
• Integrity checks locate the attack: training data that no longer matches its source means poisoning; a deployed model or setting that no longer matches the approved build means manipulation; if both are intact, crafted inputs mean evasion.
• Prompt injection overrides the application's instructions, typed directly or hidden in emails, web pages and retrieved documents; jailbreaking talks the model past its own safety restrictions.
• Hallucinations are confident fabrications with no attacker; attackers can exploit them, for example by registering package names that assistants invent.
• Bias most often comes from unrepresentative or historically skewed data, even when every record is genuine, but labels, features and design can introduce it too; explainability is about whether a specific decision can be traced and justified.
• Data loss is the organization's confidential data leaving its control through AI tools and features; privacy is individuals' personal data, memorization, membership inference and deletion rights.
• AI session hijacking reuses stolen cookies or tokens, or guesses predictable session IDs, to act as the victim with their history and connected tools.
• AI code execution comes from loading unsafe model files or running model output and model-written code without validation and real isolation.
• Ethical considerations remain when an AI use is legal, unbiased and explainable but undisclosed, deceptive or unfair to the people affected.
• Classify by mechanism, not by consequence: a hijacked session or an injection may lead to data exposure, but the attack is what the scenario describes.

Security Architecture

CompTIA Security+ SY0-801 Security Architecture Models: Cloud, On-Premises, OT and Segmentation

• Deployment models differ by who shares the hardware: public (anyone), private (one organization, hosted or self-run), community (a closed group with shared requirements), hybrid (a connected mix whose link must be secured).
• Private is about tenancy, not location; isolated virtual networks, dedicated hosts and colocation all leave a third party with the hardware or the room.
• In every cloud model you keep your data, users and access; IaaS also leaves you the guest OS, PaaS hands the platform to the provider, and serverless leaves you function code, triggers and permissions.
• In serverless, a function's permissions set the blast radius of any code flaw; multicloud removes provider dependence but multiplies control sets to keep consistent.
• IaC gives consistent, reviewable deployments but copies a template flaw everywhere: scan templates before deployment, because drift detection only finds changes from the template.
• OT puts safety and availability first; protect unpatchable controllers by restricting who can reach them and detect threats with passive monitoring, not agents or active scans.
• An air gap closes every network path, so removable media becomes the way in; any link, even a data diode, ends the air gap.
• Microservices add APIs to secure: authenticate every service-to-service call. Physical segmentation removes the shared device a misconfiguration could use to bridge networks.
• Resilience keeps a system running through a failure; ease of recovery restores it afterwards; availability is the uptime that results.
• Unusable controls get bypassed; constrained devices need collection at the edge and analysis elsewhere; sovereignty is about where data sits, classification about which environment may hold it.

CompTIA Security+ SY0-801 Securing Infrastructure: Zones, Zero Trust, VPNs and Failure Modes

• Only inline devices can block; a sensor on a SPAN port or tap alerts on copies and sees only the segments it is attached to.
• Keep back-end data out of the screened subnet and scope every inter-zone rule to exact source, destination and port; put IoT and OT devices in their own zone.
• Attack-surface reduction removes unneeded exposure; MFA, patches, IPS signatures and nonstandard ports leave the service reachable. Diversity means layers that share no common component.
• Zero Trust checks user, device health, device inventory and per-application authorization on every request, from any network, and keeps evaluating the session.
• Revoke a stolen device's enrollment and certificate; let a noncompliant device reach only remediation services; use ZTNA rather than a VPN to give access to one application.
• Full tunnel sends everything through company inspection; split tunnel saves capacity but bypasses it. Confidentiality needs ESP, hidden internal addresses need tunnel mode, and multicast routing needs GRE inside IPsec.
• SFTP runs over one SSH connection; FTPS is FTP plus TLS with separate data connections. End-to-end encryption moves archiving and DLP to the endpoints.
• Out-of-band management is the only option that both isolates management from users and works when production is down.
• SSE is SWG + CASB + ZTNA from the cloud; SASE adds SD-WAN. A gMSA gives several hosts one identity with an AD-rotated password; an sMSA is limited to one computer.
• Separate daily and privileged accounts, remove prior-role access at each transfer, recertify periodically, and choose fail-open or fail-closed per system by its priority.

CompTIA Security+ SY0-801 Data Protection: States, Classifications, Methods and Roles

• Data type (structured or unstructured) and data state (at rest, in transit, in use) are independent; field-based controls such as column encryption cannot reach unstructured documents, recordings and images.
• Full-disk encryption protects only against offline access to a powered-off drive; storage and transport encryption do nothing for data in use, which needs isolated processing such as a secure enclave.
• Government levels rank by damage: confidential (damage), secret (serious), top secret (exceptionally grave). Critical data is about availability and integrity, so even public data can be critical; sensitive is commonly used for PII, PHI and intellectual property.
• Hash what you only verify, encrypt what you must restore, tokenize what systems must reference without holding, and mask what people should see only in part.
• In vault-based tokenization a random token has no mathematical link to the original and maps back only through an isolated vault, which is why it shrinks PCI DSS scope where encryption generally does not.
• Pseudonymized data can be re-identified and is still personal data; anonymized data cannot. Filtering leaves a field out entirely, unlike masking or tokenization.
• The owner decides classification and access, the custodian implements controls, the steward keeps data accurate and labeled, the operator works with it; a processor needs the controller's authorization to engage a subprocessor.
• Geofencing reacts to where the device is; data location is the country where data is stored; data placement is which systems may hold it.
• Labels protect only the copy that carries them; people need visible markings and tools need metadata labels.
• A legal hold suspends every routine disposal process for relevant data, including leaver procedures and backup rotation, from the moment it is issued.

CompTIA Security+ SY0-801 Resilience and Recovery: Sites, Backups, Redundancy and RTO/RPO

• RTO = maximum acceptable downtime; RPO = maximum acceptable data loss in time. Both are business targets. MTTR (average repair time) and MTBF (average time between failures) are measured figures.
• RPO sets backup or replication frequency; RTO sets how ready the recovery site must be. If MTTR exceeds RTO, add redundancy; a higher MTBF only makes failures rarer.
• Hot site = running systems and current data (minutes, costliest); warm = hardware ready, data restored from backups; cold = space, power and cooling only (slowest, cheapest). Pick the cheapest that meets the RTO.
• A recovery site must not share the primary site's flood zone, storm path or power grid; location, not site type, decides whether one disaster hits both.
• Identical redundant components share the same flaw; platform diversity and multicloud break that dependence at the cost of management complexity. Multiple regions of one provider do not survive a provider-wide outage.
• Load balancers spread requests and use health checks to skip dead servers; clusters move a failed node's service and address to a standby; autoscaling changes how many instances exist.
• UPS = seconds to minutes and bridges to a generator; generator = hours to days; redundant power supply = failed PSU in a device; surge protector = spikes only, no runtime.
• RAID and replication protect against disk failure, not deletion or ransomware. RAID 6 survives any two disk failures; RAID 10 only if they are in different pairs.
• Incremental = changes since the last backup (restore needs every one); differential = changes since the last full (restore needs the full plus the latest). Retention must outlast dwell time, immutability in compliance (locked) mode stops even administrators deleting backups, and only a timed full restore proves the RTO.
• Failover test moves production (needs an outage window); parallel processing runs the real workload alongside production; simulation rehearses a scripted scenario. DR restores systems, BC keeps the business running, capacity planning ensures enough people and technology.

Security Operations

CompTIA Security+ SY0-801 Mitigating Controls: Firewalls, IDS/IPS, EDR, NAC and Email Security

• Can't change the device? Segment it and permit only the peers it needs. Can change it? Harden it to a secure baseline.
• Deception decoys alert on any contact: honeypot = fake system, honeynet = fake network, honeyfile = decoy file, honeytoken = decoy data or credential, canary account = decoy user.
• Allow list = default deny, stops unknown code, suits fixed-purpose systems; block list = default allow, stops known-bad, keeps flexibility.
• IDS alerts, IPS blocks; network sensors can't read traffic you won't decrypt, so inspect on the host; rogue access points need a wireless sensor (WIPS to contain).
• Firewall rules are top-down, first match, implicit deny; a specific permit goes above the broad deny, and the source is whoever opens the connection.
• Same port, different application: only Layer 7 inspection separates them; a WAF protects inbound web applications; rate limiting slows guessing without locking accounts; UTM is convenient but a single point of failure.
• Off-network or USB data paths need agent-based filtering and endpoint DLP; a central proxy sees only traffic sent through it.
• Antivirus matches files, EDR investigates and isolates endpoints, XDR correlates endpoint, email, identity and cloud.
• A leaked secret is fixed by revoking it; validate input on the server; HttpOnly blocks script access and Secure blocks plain HTTP; code signing proves publisher and integrity, not safety.
• SPF = authorized senders, DKIM = signature, DMARC = alignment plus policy, BIMI = logo that needs DMARC quarantine or reject.

CompTIA Security+ SY0-801 Asset Management Life Cycle: Procurement, Tracking and Secure Disposal

• You cannot protect what you do not know you have: unlisted assets are missed by scanning, patching and monitoring.
• The five stages are planning/scoping, acquisition/procurement, assignment/accounting, monitoring/asset tracking and disposal/decommissioning.
• Planning sets the scope (hardware, software and data) and the security requirements; procurement checks specific products against them before contracts are signed.
• Buying through authorized suppliers counters counterfeit or tampered hardware; buying outside procurement creates shadow IT that is never inventoried or hardened.
• Every asset needs an accountable owner and a record of who holds it; reassignment means sanitize, reimage and update the record.
• Reconcile automated discovery with the inventory: unrecorded live hosts are unmanaged, records with no host may be lost or stolen.
• RFID tags are read automatically at reader gates; barcodes need a person to scan; short-lived cloud instances are tracked from provider API events.
• Software tracking records installs, versions, end-of-support status and license renewal dates; end of support means no more security patches.
• Degaussing does nothing to flash and host overwrites are unreliable on SSDs; use secure erase or cryptographic erase for reuse, shredding for destruction.
• Decommissioning archives retained data first, gets certificates listing drive serials, and removes DNS records, firewall rules, accounts and inventory entries.

CompTIA Security+ SY0-801 Vulnerability Management: Scanning, Prioritization, Remediation and Disclosure

• Vulnerability management is a cycle: identify, prioritize, remediate, verify, report.
• Credentialed scans see patch levels and local settings; non-credentialed internal scans model an unauthenticated insider; fragile devices get non-intrusive checks, not no scans.
• Distributions backport fixes without changing version strings, so validate banner-based findings with a credentialed check and log confirmed ones as false positives.
• Feed scan scope from IPAM and track findings by asset, not IP address; unknown hosts go into scan scope first.
• CSPM checks cloud account settings that host scans cannot see; fix infrastructure-as-code findings in the template.
• Source code review finds business-logic and authorization flaws that pattern-based tools cannot infer.
• Context sets priority: exposure and asset value can make a medium finding outrank a critical one, and proven exploitation or an attack chain outranks a scanner score.
• Compensating controls lower urgency but never close a finding; unpatchable systems are isolated to only the flows they need.
• Exceptions are time-limited, approved by the accountable risk owner and renewed by a fresh decision when they expire.
• Close findings only after a rescan or retest proves the fix, report fix lists to owners and trends such as MTTR to managers, and disclose flaws in others' products privately to the vendor first.

Security+ SY0-801 Security Monitoring and Alerting: SIEM, Logs, NetFlow, SNMP and SCAP

• Systems monitoring watches hosts, application monitoring watches the software and its transactions, infrastructure monitoring watches the network and shared services; locate a problem by where its symptom is measured
• Aggregated logs need parsers (missing parser = raw data but empty fields) and synchronised clocks via NTP (drift = events out of order)
• A SIEM aggregates, normalises and correlates events across sources inside a time window; orchestration (SOAR) acts on the alert across other tools with playbooks
• Tune alerts as narrowly as possible: exclude only the precisely described known-good activity; rule-wide changes trade false positives for false negatives, and cosmetic changes leave the noise
• Archive aged logs (the records themselves) to cheaper storage for retention; prove integrity with write-once storage plus hashes recorded at archiving, because confidentiality and availability controls prove nothing about change
• Dashboard = live, continuous status; report = periodic summary of a period; automated alert = one event needing action now; NMS = device discovery, topology, availability and utilisation
• Agents keep collecting off-network; agentless installs nothing; credentialed scans see patch levels, non-credentialed scans see only the outside
• SNMP counters say how much, NetFlow says who and where, only a packet capture says what; a switch needs port mirroring before an analyzer can see another host's traffic
• SNMP polls on UDP 161 (manager to agent), traps on UDP 162 (agent to manager); v1/v2c are cleartext, SNMPv3 authPriv authenticates and encrypts
• syslog severity 0 is Emergency and 7 is Debug (lower = worse); UDP 514 is cleartext and lossy, syslog over TLS on TCP 6514 is encrypted and connection-oriented; SCAP lets different scanners run the same XCCDF/OVAL content

CompTIA Security+ SY0-801 Identity and Access Management: SSO, MFA, Access Control Models and Passkeys

• A leaver whose account still works failed deprovisioning; disabling the directory account is not enough when apps issue their own tokens, so deprovision inside each app too (SCIM, or manual revocation where the app does not support it).
• Access that piles up across job changes is privilege creep; access reviews by owners who check entitlements, not just employment status, catch it along with orphaned accounts.
• Identity proofing verifies the person before credentials are issued or reset; knowledge questions built from leakable facts are weak proof.
• SSO works inside one organization, federation across organizations; SAML = signed XML assertion in the browser, OAuth = scoped access token after consent (OIDC adds identity), LDAP = directory bind, protected by LDAPS on 636 or StartTLS.
• A local admin password reused on every machine behaves like a global credential; make it unique and rotated per machine.
• Service accounts: non-interactive, least privilege, system-managed rotated credentials. Third-party accounts: named, sponsored, with an account expiration date. Emergency accounts: independent of the failed dependency, alerted on use.
• MFA needs two different categories; HOTP counts presses, TOTP follows the clock; biometrics cannot be reissued; backup codes are single-use offline recovery codes.
• Rule-based applies the same condition to everyone, role-based follows the job; MAC = labels the owner cannot override, DAC = owner decides; time-based = schedule, JIT = request with approval and expiry.
• Passkeys are origin-bound key pairs: they defeat phishing relays, leave only public keys on the server, and their PIN unlocks a key that never leaves the device.
• Favour long passwords, breached-password screening and change on compromise over complexity and timed expiry; use a password manager where SSO cannot reach.

Security+ SY0-801 Automation and Orchestration: Use Cases, AI, Guardrails and CI/CD

• Automation does one task without a person; orchestration chains tasks across tools into a workflow, and integrations (APIs) make that possible.
• Automated deprovisioning must remove every account that automated provisioning created, including local accounts outside the directory.
• Resource provisioning sets secure configuration at creation; desired state management keeps it by reverting drift, so change the declaration, not the server.
• Anomaly detection catches the unknown but raises false positives; let it learn in alert-only mode before it takes disruptive action.
• Agentic AI acts, chatbots answer, predictive analysis forecasts, AI-augmented baselines learn normal; a baseline trained during a compromise learns the compromise as normal.
• Guardrails bound automation without making it manual: protected-asset allowlists, change-volume circuit breakers, scoped permissions, approval only for high-impact actions.
• Good automation logic verifies results and escalates failures to a human; fix the process before automating it.
• Centralised automation needs redundancy and per-workflow credentials; deploy it with a pilot, staged rollout and rollback.
• Pipeline security checks must fail the build to protect production; tune a noisy gate instead of removing it.

Security+ SY0-801 Incident Response: Process, Forensics, Containment and Reporting

• After preparation: identify, investigate and contain, then eradicate, then recover; never restore a system while its foothold or entry point remains.
• Train people on their roles before testing the plan; a tabletop talks through decisions, a simulation proves hands-on skill with real tools, off production.
• The incident commander settles conflicting priorities; the communications lead owns all statements to the media and the public.
• A playbook gives ordered steps for one incident type; the plan and policy set scope, roles and authority.
• Classify advisories by issuer (outside body is external, your own team is internal); threat hunting proactively searches your own telemetry for behaviours, because indicators rotate.
• Collect memory before disk, image through a write blocker and hash at acquisition; the hash proves integrity, only the chain-of-custody log proves who handled evidence.
• A legal hold stops routine deletion once litigation is expected; a Faraday bag stops remote wipes; e-discovery produces electronic records for legal proceedings.
• Isolate the host itself (for example via EDR) and keep it powered when memory matters; eradication includes resetting stolen credentials and fixing the entry point.
• Check sanctions before any ransom payment; backups defeat encryption, not data theft (double extortion).
• Mandatory reports follow a legal clock that starts at awareness; lessons learned judges the response, root cause analysis explains the incident, the PIR records it.

Security+ SY0-801 Investigation Data: Logs, Data Sources, System Images and Log Parsing

• Authentication logs show who signed in; logical access logs show what they opened; accounting shows how long and how much; audit logs show who changed a setting.
• Physical access logs prove which badge opened a door; surveillance footage shows who walked through it.
• Process name, parent process and command line are endpoint evidence; full URLs and parameters for HTTPS sites are in the web server's logs, written after decryption.
• Behind a load balancer or proxy, the real client address is in the load balancer's logs or the X-Forwarded-For header.
• NetFlow/IPFIX: who, where, when and how much, kept for a long time, no payload. Packet captures: full content, short retention, unreadable if encrypted. Neither sees traffic that never passes its sensor.
• Memory dumps hold fileless malware, decrypted data and disk encryption keys; bit-level copies hold deleted files and unallocated space; snapshots preserve virtual and cloud systems without physical access.
• Hash evidence at collection; forward logs off the host as they are written to write-once storage, and trust the forwarded copy over the local one.
• Dashboards show status now; archived automated reports and stored scan results show status then.
• Count values with sort | uniq -c | sort -rn, find values by shape with regular expressions, and normalize all timestamps to one zone before building a timeline.
• Attribute an address in two steps (DHCP lease or NAT/PAT log at that time, then authentication logs), and route discipline to HR, legal decisions to Legal and payment records to Accounts.

Security Program Management and Oversight

CompTIA Security+ SY0-801 Policies, Standards, Procedures and Guidelines

• Policy = intent, authority and accountability; standard = mandatory, measurable requirement; procedure = mandatory steps; guideline = advice.
• Changes flow down: a new standard forces procedures and configurations to change, not the policy above it.
• An organization can only mandate what it controls; recommendations for equipment it does not own are guidelines.
• Benchmarks harden a platform, advisories warn about one flaw, reference architectures design before purchase, implementation guides deploy a chosen product.
• A security baseline is the documented minimum configuration that systems are built from and checked against for drift.
• RFCs are the IETF's documents that specify internet protocols such as TLS; implementers follow them to interoperate.
• SOPs keep recurring people-driven processes consistent; runbooks hold exact technical steps for one task or alert, often automated.
• Business continuity keeps the business functioning (including fallback ways of working); disaster recovery restores IT systems and data; incident response deals with the incident itself.
• Classification sets sensitivity and handling, retention sets how long, disposal sets how data is destroyed, privacy sets what personal data may be used for.
• A vulnerability disclosure policy invites outside reports with scope and safe harbor and need not pay; a bug bounty pays; an advisory informs customers.

CompTIA Security+ SY0-801 Risk Management: Risk Analysis, Treatment, BIA and SLE, ALE and ARO

• No asset list, no risk list: inventory assets and assign an accountable business owner before scoring anything.
• The risk owner is the accountable business stakeholder with authority to decide treatment; reporting, operating or auditing a risk does not make someone its owner.
• Rank risks by the combined likelihood × impact score, not by the highest single factor.
• Inherent risk ignores controls; residual risk counts them, and residual risk is what is compared with the risk appetite.
• Qualitative analysis (ratings, heat maps) ranks many risks quickly; quantitative analysis (dollars, rates) justifies spending. Combine them where data allows.
• SLE = AV × EF; ARO is occurrences per year (once every N years = 1/N); ALE = SLE × ARO.
• A control's value is (ALE before − ALE after) − its annual cost; the biggest ALE is not always the best investment.
• Transfer moves the financial impact, never the accountability; avoid stops the activity; mitigate keeps it with controls; accept is a documented decision within appetite.
• The risk register is reviewed on a schedule and whenever conditions change; accepted risks stay in it.
• A BIA assumes the disruption happens and measures how the harm grows over time; laws, regulations and binding contracts decide which treatments are allowed before cost-benefit picks among them.

Security+ SY0-801 Third-Party Risk: Vendor Selection, Agreements and Monitoring

• RFI explores the market, EOI builds a shortlist, RFP asks for full proposals against written requirements, RFQ prices an exact specification.
• Due diligence happens before signing; monitoring happens after. Scale both to the vendor's risk.
• A conflict of interest belongs to the evaluator: disclose it and recuse that person, rather than disqualifying the bidder.
• MSA = terms for all engagements; SOW = one engagement's deliverables; SLA = service levels and remedies; SLO = one measurable target in the SLA.
• An MOU records intent and is generally not binding; an MOA spells out each party's responsibilities and conditions.
• An NDA protects information shared before any contract exists.
• Right to audit: you choose who examines the vendor. Compliance attestation: the vendor's assessor examines it and you receive the report.
• SOC 2 Type 1 shows control design at a point in time; Type 2 shows controls operated effectively over a period.
• A testing clause grants permission; rules of engagement set scope, techniques, windows and contacts. Anything beyond scope is reported, not pursued.
• Staffing and resource limits are met by tiering vendors in a registry and assessing the critical tier in depth; lock-in is prevented at contract time with export and exit terms.

Security+ SY0-801 Security Compliance, Privacy and Legal Holds

• Compliance training is matched to role: data handling for people who touch regulated data, AML/CTF for people who see money move, anti-bribery for people who deal with officials and intermediaries.
• Structuring is splitting cash to stay under a reporting threshold; staff report suspicions to the compliance officer and never tip off the customer.
• An acknowledgement proves someone read a policy; an attestation is an accountable party's formal statement that controls or requirements are met.
• Name the consequence by who acts: the market (reputational), a contract partner (contractual), a regulator (sanctions), a licensing authority (loss of license), courts (legal).
• PCI DSS is enforced through merchant and acquirer agreements, so failing it is primarily a contractual consequence.
• Erasure deletes, correction fixes, restriction keeps but freezes all use, prevention stops one purpose only.
• Erasure yields to legal obligations and legal claims: erase what you can now and keep only the records the law requires.
• Opt-in needs an affirmative act before processing; pre-ticked boxes and silence are not consent.
• The controller decides purposes and means; a processor acts on instructions and becomes a controller for any purpose it decides itself.
• A legal hold suspends every deletion route, including erasure, for the in-scope data only; legal orders are validated by counsel and answered with exactly what they cover; retention floors apply only to the records they name.

Security+ SY0-801 Audits, Assessments and Penetration Testing

• Sampling tests a subset of records and projects the result; surveys give breadth; interviews give depth and allow follow-up questions.
• A sample exception rate is exceptions divided by items tested, compared with the tolerable rate set before testing, and the conclusion is projected to the whole population.
• An assertion is management's claim about its controls; audit evidence supports or refutes it.
• MITRE ATT&CK catalogues specific techniques, the Cyber Kill Chain orders seven phases (reconnaissance, weaponization, delivery, exploitation, installation, C2, actions on objectives), and the Diamond Model links adversary, capability, infrastructure and victim.
• The audit charter, approved by the board or audit committee, grants the audit function its authority, scope and access; audit frequency should follow risk.
• Independence separates internal from external engagements: only an outside party with no stake gives an independent opinion, and self-assessments are the least independent.
• Gap analysis compares against a standard's requirements; benchmarking compares against peers and industry norms.
• Known, partially known and unknown environment tests differ in how much testers are told; physical tests target buildings and people.
• Red attacks, blue defends, purple integrates the two in real time; passive reconnaissance never touches the target's systems, active reconnaissance does.
• PCI DSS is industry-based, ISO/IEC 27001 is the certifiable international ISMS standard (27002 is guidance), UK Cyber Essentials is region-specific; functional testing checks the specification, behavioral testing checks real behavior.

Security+ SY0-801 Security Awareness Training: Types, Delivery, Metrics and Topics

• Training type is set by the trigger: joining (onboarding), the calendar (ongoing), a risky role before any failure (targeted), an individual's failure (corrective).
• Decline across the whole workforce over time calls for ongoing training; individual failures call for corrective training scoped to those individuals.
• An LMS assigns, tracks and evidences training at scale; a self-service portal is on-demand and untracked; one-to-one is tailored coaching; one-to-many reaches everyone at once.
• Completion and quiz scores show activity; click rate, report rate and time to report show behaviour. Once clicks are low, push reporting.
• Managerial reports give managers their team's status; behavior risk scores rank individuals by what they have actually done.
• Verify payment changes and unusual requests out of band, using contact details you already hold. Email authentication proves the sending domain, not who controls the mailbox.
• AI-written phishing and deepfakes remove the old cues, so train people to judge the request and verify it independently rather than to detect the fake.
• An unexpected MFA prompt means the password is already known: deny it and alert security.
• Never connect a found or unknown USB drive or cable: malicious devices can pose as keyboards, a device class a mass-storage block does not cover.
• Use the VPN and a privacy screen in public, report lost BYOD devices immediately, send visitors to the sign-in process, and keep internal details out of public posts.