Security+ Mnemonics and Memory Tricks (SY0-701)

Loading page

AAA and access control

AAAAuthentication, Authorization, Accounting, in that order: who are you, what may you do, what did you do.
RADIUS vs TACACS+RADIUS uses UDP and encrypts only the password. TACACS+ (Cisco) uses TCP and encrypts the whole packet, and splits the three As apart.
MAC / DAC / RBACMAC = the system (Machine) decides by labels. DAC = the Data owner decides. RBAC = your Role decides.
FAR vs FRRFAR (False Acceptance) lets the wrong person in, a security failure. FRR (False Rejection) keeps the right person out, an annoyance. CER is where the two cross.

Detection and monitoring

IDS vs IPSIDS Detects and alerts (passive, off to the side). IPS Prevents: inline, in the Path, and can drop the traffic.
HIDS vs NIDSHIDS = Host, watches one machine. NIDS = Network, watches a whole segment.
SIEM vs SOARSIEM spots it (aggregates logs and alerts). SOAR acts on it (runs automated playbooks).

Risk and recovery metrics

RPO vs RTORPO = recovery POINT = how much DATA you can lose, back to your last backup. RTO = recovery TIME = how long you can be DOWN.
MTBF vs MTTRMTBF = Mean Time Between Failures (reliability; higher is better). MTTR = Mean Time To Repair (how fast you fix it; lower is better).
MTTFMean Time To Failure, for components you replace rather than repair (one-and-done parts).
SLE, ARO, ALESLE = Asset Value times Exposure Factor (one event). ARO = times per year. ALE = SLE times ARO (the yearly cost).

Cryptography

CIA triadConfidentiality (keep it secret), Integrity (keep it true), Availability (keep it reachable).
Symmetric vs asymmetricSymmetric = one Shared key, fast, for bulk data. Asymmetric = a pair (public and private), slow, for key exchange and signatures.
Hashing vs encryptionHashing is one-way (integrity and passwords). Encryption is two-way with a key (confidentiality). You can decrypt; you cannot de-hash.
Salt vs pepperA salt is a unique random value stored with each hash to beat rainbow tables. A pepper is a secret value stored separately from the hash.

Wireless security

WEPWired Equivalent Privacy = Weak, Easily Penetrated. The broken original.
WPA2 vs WPA3WPA2 uses the crackable 4-way handshake. WPA3 uses SAE, which blocks offline password guessing. Both can use AES-CCMP.
SAESimultaneous Authentication of Equals, the WPA3 Dragonfly handshake that replaced WPA2's weak one.

Cloud, network, and threat intel

CASBCloud Access Security Broker, the policy checkpoint between your users and cloud apps.
SASESay 'sassy': SD-WAN networking plus cloud-delivered security, combined into one edge service.
ZTNAZero Trust Network Access: verify every request and grant access to one app, never the whole network.
STIX vs TAXIISTIX writes the threat intel (the what). TAXII ships it (the how, the transport).

Social engineering and attacks

Phishing familyPhishing = email. Spear phishing = a specific person. Whaling = an executive. Vishing = Voice. Smishing = SMS.
Virus vs wormA virus needs a host file and user action. A worm self-replicates and spreads across the network on its own.
DoS vs DDoSDoS = one source floods a target. DDoS = many sources (a botnet) flood it at once.

Security+ mnemonics FAQ

Are these Security+ mnemonics free?

Yes. Every memory hook on this page is free, and you can download the one-page PDF with no account, payment, or signup.

What is the easiest way to remember AAA?

Authentication, Authorization, Accounting, in that order. Who are you (authentication), what may you do (authorization), and what did you do (accounting).

How do I remember RPO vs RTO?

RPO is the recovery POINT objective: how much data you can lose, measured back to your last backup, so RPO equals data. RTO is the recovery TIME objective: how long you can be down, so RTO equals time.

How do I tell IDS and IPS apart?

An IDS only detects and alerts; it sits passively off to the side. An IPS prevents: it sits inline in the traffic path and can drop the attack. P is for Prevent and in-Path.

Do mnemonics actually help on the Security+ exam?

For dense acronyms and confusable pairs, yes. They give you a fast, reliable hook under time pressure. Treat them as a supplement to understanding the concept, not a replacement for it.