Skip to main content
Offline·Progress is saved on this device and syncs the next time you open the app online.
Free cheat sheet

Security+ Mnemonics and Memory Tricks (SY0-701)

The acronyms and confusable pairs that trip people up on the CompTIA Security+ SY0-701 exam, each with a memory hook that makes it stick. Free, no account. Download the PDF or study it here.

Last updated August 2026

Free PDF: Security+ mnemonics cheat sheetEvery memory hook on one page. Print it, pin it.

Mnemonics are a supplement, not a substitute for understanding the concept. Use them for the dense acronyms and the pairs you keep mixing up, then confirm you can explain the real idea.

AAA and access control

  • AAAAuthentication, Authorization, Accounting, in that order: who are you, what may you do, what did you do.
  • RADIUS vs TACACS+RADIUS uses UDP and encrypts only the password. TACACS+ (Cisco) uses TCP and encrypts the whole packet, and splits the three As apart.
  • MAC / DAC / RBACMAC = the system (Machine) decides by labels. DAC = the Data owner decides. RBAC = your Role decides.
  • FAR vs FRRFAR (False Acceptance) lets the wrong person in, a security failure. FRR (False Rejection) keeps the right person out, an annoyance. CER is where the two cross.

Detection and monitoring

  • IDS vs IPSIDS Detects and alerts (passive, off to the side). IPS Prevents: inline, in the Path, and can drop the traffic.
  • HIDS vs NIDSHIDS = Host, watches one machine. NIDS = Network, watches a whole segment.
  • SIEM vs SOARSIEM spots it (aggregates logs and alerts). SOAR acts on it (runs automated playbooks).

Risk and recovery metrics

  • RPO vs RTORPO = recovery POINT = how much DATA you can lose, back to your last backup. RTO = recovery TIME = how long you can be DOWN.
  • MTBF vs MTTRMTBF = Mean Time Between Failures (reliability; higher is better). MTTR = Mean Time To Repair (how fast you fix it; lower is better).
  • MTTFMean Time To Failure, for components you replace rather than repair (one-and-done parts).
  • SLE, ARO, ALESLE = Asset Value times Exposure Factor (one event). ARO = times per year. ALE = SLE times ARO (the yearly cost).

Cryptography

  • CIA triadConfidentiality (keep it secret), Integrity (keep it true), Availability (keep it reachable).
  • Symmetric vs asymmetricSymmetric = one Shared key, fast, for bulk data. Asymmetric = a pair (public and private), slow, for key exchange and signatures.
  • Hashing vs encryptionHashing is one-way (integrity and passwords). Encryption is two-way with a key (confidentiality). You can decrypt; you cannot de-hash.
  • Salt vs pepperA salt is a unique random value stored with each hash to beat rainbow tables. A pepper is a secret value stored separately from the hash.

Wireless security

  • WEPWired Equivalent Privacy = Weak, Easily Penetrated. The broken original.
  • WPA2 vs WPA3WPA2 uses the crackable 4-way handshake. WPA3 uses SAE, which blocks offline password guessing. Both can use AES-CCMP.
  • SAESimultaneous Authentication of Equals, the WPA3 Dragonfly handshake that replaced WPA2's weak one.

Cloud, network, and threat intel

  • CASBCloud Access Security Broker, the policy checkpoint between your users and cloud apps.
  • SASESay 'sassy': SD-WAN networking plus cloud-delivered security, combined into one edge service.
  • ZTNAZero Trust Network Access: verify every request and grant access to one app, never the whole network.
  • STIX vs TAXIISTIX writes the threat intel (the what). TAXII ships it (the how, the transport).

Social engineering and attacks

  • Phishing familyPhishing = email. Spear phishing = a specific person. Whaling = an executive. Vishing = Voice. Smishing = SMS.
  • Virus vs wormA virus needs a host file and user action. A worm self-replicates and spreads across the network on its own.
  • DoS vs DDoSDoS = one source floods a target. DDoS = many sources (a botnet) flood it at once.

Hooks help; repetition makes it stick

A mnemonic gets it into your head; spaced review keeps it there. SecPlus Mastery drills every acronym with over 1,000 practice questions, flashcards, and spaced repetition across all five SY0-701 domains.

Create a free accountSee plans

Security+ mnemonics FAQ

  • Are these Security+ mnemonics free?
    Yes. Every memory hook on this page is free, and you can download the one-page PDF with no account, payment, or signup.
  • What is the easiest way to remember AAA?
    Authentication, Authorization, Accounting, in that order. Who are you (authentication), what may you do (authorization), and what did you do (accounting).
  • How do I remember RPO vs RTO?
    RPO is the recovery POINT objective: how much data you can lose, measured back to your last backup, so RPO equals data. RTO is the recovery TIME objective: how long you can be down, so RTO equals time.
  • How do I tell IDS and IPS apart?
    An IDS only detects and alerts; it sits passively off to the side. An IPS prevents: it sits inline in the traffic path and can drop the attack. P is for Prevent and in-Path.
  • Do mnemonics actually help on the Security+ exam?
    For dense acronyms and confusable pairs, yes. They give you a fast, reliable hook under time pressure. Treat them as a supplement to understanding the concept, not a replacement for it.

Keep studying: acronyms glossary, cryptography cheat sheet, and the ports cheat sheet.

Aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.