Security+ Cram Sheet: Last-Minute Review

The exam at a glance

Questions

Up to 90

Time

90 minutes

Passing score

750 on a 100 to 900 scale

PBQs

Usually first

Ports: the secure swaps

You'll likely see at least one question asking for the secure replacement of a cleartext protocol or asking which service runs on a given port number. Know these swaps cold. The complete list of ports appears on the ports cheat sheet.

Risk formulas and recovery numbers

Domain 5 nearly always includes a quantitative risk question. Learn to follow this sequence: first, multiply asset value by exposure factor to find single loss expectancy; then, multiply that figure by the annual rate of occurrence to get the annualized loss expectancy, the number you compare against control costs.

Two orders to know

Two orders come up as "what do you do next" questions. Get the sequence wrong and every answer choice starts to look reasonable.

Pairs people mix up

The wrong answers on Security+ often closely resemble the correct ones, coming from a similar family but serving a slightly different purpose. These are the pairs that cause the most confusion for test-takers.

• Control category vs control type

  Category tells you who or what enforces the control (technical, managerial, operational, or physical), and type describes what the control aims to do, such as prevent, deter, detect, correct, compensate, or direct. Each control falls into one category but can fit more than one type.

• Incremental backup vs differential backup

  Incremental backups only record changes since the last backup of any kind, making each backup swift; however, a restore needs the last full backup plus every incremental since then. Differential backups capture what has changed since the last full backup, meaning you need just the most recent full and differential for a recovery.

• RTO vs RPO

  RTO, the Recovery Time Objective, is the time needed to get back online, while RPO, the Recovery Point Objective, is how much data, measured back in time, you can afford to lose.

  Full comparison: RTO vs RPO

• IDS vs IPS

  An IDS (Intrusion Detection System) monitors a copy of the traffic and sends alerts; an IPS (Intrusion Prevention System) sits inline and can block threats. If the question mentions stopping an attack, it's looking for the IPS.

  Full comparison: IDS vs IPS

• Hashing vs encryption

  Hashing verifies data integrity through one-way functions, while encryption protects confidentiality but requires the right key to reverse.

  Full comparison: Hashing vs encryption

• Symmetric vs asymmetric encryption

  Symmetric uses one shared key and is speedy for handling large amounts of data, like AES does. Asymmetric requires a pair of keys and moves slower, used for exchanging keys and creating digital signatures, as RSA and ECC do.

  Full comparison: Symmetric vs asymmetric encryption

• Signing vs encrypting for someone

  You sign something with your private key, and anyone can verify it using your public key. To encrypt a message for someone else, you use their public key; only they can unlock it with their private key.

• Authentication vs authorization

  Authentication verifies your identity. Authorization grants permissions once the identity is confirmed.

  Full comparison: Authentication vs authorization

• Vulnerability scan vs penetration test

  A vulnerability scan finds weaknesses and reports them without exploiting them. A penetration test aims to exploit these under agreed rules to show potential attacker capabilities.

  Full comparison: Vulnerability scan vs penetration test

• False positive vs false negative

  A false positive alerts on harmless activity, while a false negative misses a real attack and is more dangerous.

Lists to recognize

These are often presented as "which of the following is an example of" questions, so be sure to know which items fit each list.

How to use this sheet in the last 48 hours

1. 1Quiz yourself from itCover the right-hand column and say the answer out loud before looking. Mark every mistake. Rereading the sheet seems like progress, but recalling the answer from memory is what helps on test day.
2. 2Drill the missesFor each error, do a brief practice set on that topic so you understand it in context, not just by definition.
3. 3Try one PBQIf you've never done a performance-based question, look at one now. They usually come first on the exam, and meeting the format for the first time on exam day wastes time you need later.
4. 4Stop the night beforeChoose a stop time and stick to it. Make sure both IDs match the name on registration and that you know your check-in time, then get some rest.

Security+ cram sheet FAQ

• What should I review the night before the Security+ exam?

  Review facts prone to confusion, like port numbers and their secure replacements, risk formulas, incident response order, the order of volatility, and control categories versus types. Don't begin a new topic you haven't studied. There's not enough time for it to stick and it cuts into sleep.
• Can you pass Security+ by cramming?

  Not from nothing. The exam has up to 90 questions in 90 minutes, with many scenario questions that require understanding over rote memorization. Cramming helps just at the end for recalling facts on this sheet after you've worked through all five domains.
• What are the most commonly confused Security+ topics?

  The ones people struggle with most are control categories versus control types and incremental versus differential backups. RTO and RPO get mixed up a lot too, as do IDS and IPS. Each pair is listed above with differences noted in a few lines.
• How do I know I am ready to take Security+?

  Take a full timed practice test and analyze the results by domain. If you score well across every domain, not just on average, you're close. But if one domain scores much lower than others, spend your remaining time there instead of rereading this sheet, or move the appointment. You can push a test center booking back up to 24 hours ahead, and an online one right up to its start time.

Keep reading

• Ports cheat sheet
• Cryptography cheat sheet
• Mnemonics
• PBQ guide
• Practice test
• Exam day
• 2-week study plan