High-Frequency Exam Topics Review

Cryptography is one of the most tested topic areas on Security+. Master these comparisons: Symmetric vs Asymmetric — symmetric (AES, 3DES) is faster and used for bulk data encryption; asymmetric (RSA, ECC) is slower but solves key distribution (used for key exchange and signatures). Key sizes to know: RSA-2048 minimum for current security, AES-128 or AES-256 for symmetric. Common algorithms: SHA-256/SHA-3 for hashing, HMAC for message authentication, ECDHE for key exchange, AES-GCM for authenticated encryption. Questions often ask you to select the correct algorithm for a specific use case — know which algorithm class (symmetric/asymmetric/hash/MAC) applies to each scenario.

PKI questions are common and often scenario-based. Know these roles precisely: Root CA — top of the trust hierarchy, self-signed certificate, typically kept offline; Intermediate/Subordinate CA — signs end-entity certificates, online, allows Root CA to stay offline; Registration Authority (RA) — verifies identity before a CA issues a certificate (can be separate from CA); CRL (Certificate Revocation List) — periodically published list of revoked certificates; OCSP (Online Certificate Status Protocol) — real-time revocation check; OCSP Stapling — server pre-fetches OCSP response and staples it to TLS handshake, reducing latency. Certificate fields: subject, issuer, validity period, public key, SAN (Subject Alternative Names), extensions.

Access control model questions appear in scenarios — you must identify which model is in use or recommended. DAC (Discretionary Access Control) — the resource owner controls access (Windows NTFS permissions, Linux file permissions); flexible but relies on user judgment. MAC (Mandatory Access Control) — the system enforces access based on labels (Top Secret/Secret/Confidential); used in government/military systems; users cannot change permissions. RBAC (Role-Based Access Control) — access granted by role membership; most common in enterprise; scalable. ABAC (Attribute-Based Access Control) — access based on attributes of user, resource, and environment; most flexible, used in cloud IAM. Rule-Based AC — access determined by rules (firewall ACLs, time-of-day restrictions).

The NIST SP 800-61 Incident Response lifecycle is a guaranteed exam topic. The four phases and their key activities: Preparation — IR plan, playbooks, CSIRT formation, tools deployment, tabletop exercises; Detection and Analysis — alert triage, IoC identification, scope determination, severity classification, evidence preservation; Containment, Eradication, and Recovery — network isolation, account lockout, malware removal, system restoration from clean backups, monitoring for re-infection; Post-Incident Activity — blameless post-mortem, root cause analysis, lessons-learned documentation, process improvements. Questions often ask which phase a specific activity belongs to or what order phases occur.

Recognize these attacks from scenario descriptions: DoS/DDoS — overwhelming a target to deny legitimate access; SYN Flood — DDoS by sending many SYN packets without completing the handshake, exhausting server connection table; Smurf Attack — amplified ICMP flood using broadcast address; ARP Poisoning — sending fake ARP replies to redirect traffic through attacker (enables MITM); DNS Poisoning — injecting false DNS records to redirect users to malicious sites; VLAN Hopping — attacking network segmentation via 802.1Q double-tagging or rogue trunk negotiation; Replay Attack — capturing and retransmitting a valid authentication session; MITM — attacker intercepts and optionally modifies traffic between two parties.

Risk calculation questions require knowing the quantitative risk formulas exactly: SLE (Single Loss Expectancy) = Asset Value × Exposure Factor (EF). Example: server worth $100,000 with 40% expected loss per incident = SLE of $40,000. ARO (Annual Rate of Occurrence) = how many times per year the threat occurs. ALE (Annual Loss Expectancy) = SLE × ARO. Example: SLE $40,000 × ARO 0.5 = ALE $20,000/year. ROI of a control = (ALE before control) − (ALE after control) − (Annual Cost of Control). If the control costs more annually than the ALE reduction, it is not cost-effective. These formulas distinguish quantitative (objective numbers) from qualitative (High/Medium/Low ratings) risk analysis.

Authentication protocol questions are scenario-based — you identify the correct protocol for a situation: RADIUS — network access authentication (VPN, Wi-Fi 802.1X); uses UDP; encrypts only password; common in enterprise wireless; TACACS+ — Cisco-developed alternative; uses TCP; encrypts entire payload; preferred for device administration (routers/switches); SAML — XML-based SSO standard for web applications between IdP and SP; common for enterprise SSO to cloud SaaS; OAuth 2.0 — authorization framework (not authentication) for delegated access; what Facebook uses when 'Log in with Facebook'; OpenID Connect (OIDC) — authentication layer built on top of OAuth 2.0; adds identity token (JWT) to OAuth's access token.

Control classification is a frequent exam topic. Controls are classified by two dimensions: Type (by implementation): Technical (firewalls, encryption, MFA), Administrative/Managerial (policies, procedures, training, background checks), Physical/Operational (locks, guards, cameras, fencing). Category (by function): Preventive (stops an incident from occurring — firewall, badge access), Detective (identifies an incident that has occurred or is occurring — IDS, audit logs, CCTV), Corrective (reduces impact after an incident — backups, patch management), Deterrent (discourages attacks — warning signs, security cameras), Compensating (alternative control when primary cannot be implemented — air gap instead of encryption for legacy system).

Wireless security questions compare protocol generations: WEP — broken, never use; RC4 with static key and weak IV; crackable in minutes; WPA2-Personal (PSK) — uses CCMP/AES; secure but shared key vulnerable to brute-force if weak; KRACK attack bypasses WPA2 (patched); WPA2-Enterprise — 802.1X with RADIUS; individual authentication per user; no shared key; most secure for organizations; WPA3-Personal — SAE (Simultaneous Authentication of Equals) replaces PSK; forward secrecy; resistant to offline dictionary attacks; WPA3-Enterprise — adds 192-bit security mode with AES-256 and HMAC-SHA384. For the exam: know which version to recommend for home, small business, and enterprise scenarios.

The order of volatility defines the sequence in which evidence should be collected to preserve the most perishable data first. From most to least volatile: 1. CPU registers and cache (nanoseconds lifetime); 2. RAM and running processes (minutes lifetime — power loss destroys it); 3. Network connections and ARP cache (changes constantly); 4. Swap/page file (reflects recent RAM contents); 5. Disk images (persistent but can be modified); 6. Remote logging and monitoring data (offsite, most durable); 7. Archival media (tapes, backup disks — least volatile). Forensic investigators collect evidence starting from the top of this list — RAM is always collected before disk imaging.

The shared responsibility model is tested with service model scenarios. In IaaS (Infrastructure as a Service — EC2, Azure VM): provider secures physical data center, hypervisor; customer secures OS, applications, data, network config, identity. In PaaS (Platform as a Service — Heroku, RDS): provider adds OS and middleware; customer secures application code, data, access management. In SaaS (Software as a Service — Microsoft 365, Salesforce): provider secures everything except data content, access management, and regulatory compliance. The rule: the higher the service abstraction, the more security responsibility shifts to the provider — but data and identity are always the customer's responsibility across all models.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you reviewed: cryptography algorithm selection (symmetric for bulk data, asymmetric for key exchange/signatures, AEAD for authenticated encryption), risk calculation formulas (SLE = AV × EF, ALE = SLE × ARO) that distinguish quantitative from qualitative analysis, and control types and categories (technical/administrative/physical combined with preventive/detective/corrective/deterrent/compensating). These high-frequency topics appear across multiple exam questions in different contexts. Next up we cover time management and answer elimination strategies to maximize your exam score.