IT and cloud certifications · 35 cards · sources listed below

Security+ Flashcards (SY0-701)

This set follows the themes of the CompTIA Security+ SY0-701 objectives, with the heaviest focus on general security concepts, threats and vulnerabilities, and cryptography. The topic names were checked against a hosted copy of the SY0-701 objectives document (document version 5.0). CompTIA's Security+ page lists SY0-701 (V7) as the current version and says a newer V8 is expected on or around November 17, 2026, so confirm which exam you are booked for. It is an independent study aid and a starter set, not the full objectives list.

No signup needed. Hand-written and checked against the sources listed on this page.

Server rack, cloud, terminal window, padlock and network nodes

Free Security+ flashcards: 35-card starter set

No signup needed. Progress saves in your browser, and in your account if you sign in. Reviewed 2026-10-17.

General security concepts (11)

What does the CIA triad stand for?

Confidentiality (only authorized access), Integrity (data not altered improperly), Availability (systems and data usable when needed).

What is non-repudiation?

Assurance that someone cannot credibly deny an action or message they sent. Digital signatures and audit logs support it.

What do the three As of AAA mean?

Authentication (prove who you are), Authorization (what you may do), Accounting (record what you did).

Four security control categories

Technical, managerial, operational and physical.

Six security control types

Preventive, deterrent, detective, corrective, compensating and directive.

Preventive vs detective vs corrective control

Preventive stops an event (a firewall rule). Detective finds it (log monitoring, IDS alert). Corrective fixes the damage afterward (restoring from backup).

What is a compensating control?

An alternative control used when the normal control cannot be applied, to provide similar protection. For example, extra monitoring on a legacy system that cannot be patched.

Core idea of Zero Trust

Never trust by default based on network location; verify each request with policy, identity and context. Enforcement happens at a policy enforcement point.

Honeypot vs honeynet vs honeyfile vs honeytoken

A honeypot is a decoy system. A honeynet is a decoy network. A honeyfile is a decoy file. A honeytoken is fake data, such as a fake record or credential, that signals misuse if it is touched.

What is an access control vestibule?

A small space with two interlocking doors so only one set can open at a time. It prevents tailgating and lets a guard check each person.

What is gap analysis?

Comparing the current state of security against a desired standard or target to identify what is missing.

Threats, social engineering and attacks (14)

Phishing vs vishing vs smishing

Phishing is by email, vishing is by voice call, and smishing is by SMS text message.

What is pretexting?

Inventing a believable scenario or identity to persuade a victim to hand over information or access.

What is business email compromise (BEC)?

Fraud where an attacker impersonates or takes over a trusted business email account to trick staff into paying money or sharing data.

Typosquatting vs watering hole

Typosquatting registers look-alike misspelled domains. A watering hole attack compromises a website the target group is known to visit.

Virus vs worm vs trojan

A virus attaches to a host file and needs a user to run it. A worm self-replicates across a network. A trojan disguises itself as legitimate software.

What is a logic bomb?

Malicious code that triggers on a condition such as a date or an event, for example when an employee account is disabled.

What does a rootkit do?

It hides its presence and keeps privileged access by modifying the OS or firmware, so it is hard to detect and remove.

SQL injection vs cross-site scripting

SQLi sends crafted input that changes a database query. XSS injects script into a web page that runs in other users' browsers.

What is a buffer overflow?

Writing more data to a memory buffer than it can hold, which can overwrite adjacent memory and sometimes lets an attacker run code.

What is a race condition (TOC/TOU)?

A flaw where behavior depends on timing, such as time-of-check to time-of-use: the state changes between checking a condition and using the result.

What is a zero-day vulnerability?

A flaw unknown to the vendor, so there is no patch available when attackers start to use it.

Password spraying vs brute force

Brute force tries many passwords against one account. Spraying tries a few common passwords against many accounts to avoid lockouts.

Reflected vs amplified DDoS

Reflected attacks bounce traffic off third-party servers using a spoofed source address. Amplified attacks use a small request that triggers a much larger response.

What is an on-path attack?

An attacker positions themselves between two parties to intercept or alter traffic. It was formerly called man-in-the-middle.

Cryptography basics (10)

Symmetric vs asymmetric encryption

Symmetric uses one shared key and is fast, so it is used for bulk data. Asymmetric uses a public/private key pair and is slower, so it is used for key exchange and signatures.

What does hashing provide?

A fixed-length digest of data used to check integrity. It is one-way and is not encryption, because you cannot reverse it to get the data.

What does salting do?

Adds unique random data to each password before hashing so identical passwords hash differently and precomputed (rainbow) tables fail.

What is key stretching?

Making password hashing deliberately slow and costly (for example with many iterations) to slow down brute-force guessing.

What does a digital signature prove?

Integrity, authenticity and non-repudiation: the message came from the holder of the private key and was not changed.

CRL vs OCSP

A Certificate Revocation List is a published list of revoked certificates. OCSP (Online Certificate Status Protocol) checks the status of one certificate on request.

What is a CSR?

A certificate signing request: sent to a certificate authority to get a certificate; it carries the public key and identity details.

TPM vs HSM

A TPM is a chip on a device that stores keys and supports measured boot and disk encryption. An HSM is a dedicated, tamper-resistant device that protects and uses keys for many systems.

Steganography vs tokenization vs data masking

Steganography hides data inside another file. Tokenization replaces sensitive data with a placeholder token. Data masking hides part of a value, such as showing only the last four digits.

What is a wildcard certificate?

A certificate that covers every subdomain at one level of a domain. *.example.com matches www.example.com but not example.com itself or a.b.example.com.

What this set covers

Exam

SY0-701. Objectives domains: General Security Concepts, Threats Vulnerabilities and Mitigations, Security Architecture, Security Operations, Security Program Management and Oversight.

Best used for

Locking in definitions and telling similar attacks and controls apart.

Not covered

Performance-based scenarios, the full acronym list, vendor tools, and detailed architecture and governance topics. Use the official objectives to fill gaps.

Independence

Written independently. Not affiliated with or endorsed by CompTIA.

How to study this set

Security+ rewards telling similar concepts apart under a scenario. Treat every card as a compare-and-contrast.

1
Day 1
Read the control categories and types first. Give a real example of each from memory.
2
Days 2-7
Review attacks in pairs (phishing vs vishing, virus vs worm). For each, say the one sentence that tells them apart.
3
Week 2
Do the cryptography cards, then explain aloud which key encrypts and which key decrypts in each scenario.
4
Final week
Drill only missed cards and pair each with a scenario sentence ("an attacker emails a fake invoice" = BEC).

Spaced repetition schedules each card to come back just before you would forget it, so reviews get shorter as your recall gets stronger. Cards you miss come back sooner.

Common mistakes to avoid

Mixing up hashing and encryption

Hashing is one-way for integrity; encryption is reversible with a key. A salted hash is still not encryption.

Confusing control categories with control types

Technical, managerial, operational and physical describe what the control is; preventive, detective and so on describe what it does.

Treating similar attacks as the same

Password spraying, brute force and credential replay are different. Match the scenario detail to the right one.

Studying the wrong exam version

SY0-701 differs from earlier Security+ exams, and a newer version is expected. Use materials that match the code on your exam.

Make your own from your notes

A starter set is a head start, not your whole course. Your class notes, slides and textbook are what your teacher actually tests, so turn them into cards too.

Make "A vs B" cards for look-alikes, putting both terms on the front and the key difference on the back.
Use short scenario fronts ("a fake invoice from a spoofed executive") with the attack name as the answer.
One acronym per card; add what it protects against, not only the expansion.
Avoid copying whole objective bullets; turn each bullet into a question.

Generate cards from a topic or notes Turn a PDF into flashcards

Security+ flashcards: questions

Is this deck for SY0-701?

Yes. The topic names were checked against a copy of the SY0-701 objectives document. CompTIA is expected to launch a newer Security+ version (V8) around November 2026, so confirm the exam code you plan to take on CompTIA's site.

What is the difference between a control category and a control type?

Categories (technical, managerial, operational, physical) describe how the control is implemented. Types (preventive, deterrent, detective, corrective, compensating, directive) describe its purpose.

Do I need to know the acronyms?

CompTIA publishes an acronym list with the objectives and says candidates should know them. Use the list in the official document, and add the ones you miss to your own cards.

Does this deck cover architecture and governance?

Only lightly. This starter set emphasizes concepts, threats and cryptography, so add your own cards for the domains you find hardest.

Sources and review

These cards are an independent study aid, not official exam content, and are not affiliated with or endorsed by any exam body or publisher. They were written by hand and checked against the sources below on 2026-10-17. Always confirm details with your course materials and the current official documents.

CompTIA Security+ SY0-701 Exam Objectives (document version 5.0, hosted copy) — Topic names and domain list were checked here. It is a third-party hosted copy of the CompTIA objectives document; other cards are standard course content.
CompTIA Security+ certification page — Official overview; lists the current (V7) and upcoming (V8) versions.

Need a bigger deck than the starter set?

Pro lets you build full decks from your notes and PDFs and import whole chapters. The starter set above stays free.

See what Pro includes