Security+ | Spatial Board — Study Aid for CompTIA Security+

Tap a tile to flip it. Tiles joined by arrows happen in that order. Tick the circle on a tile once you know it cold — the board shrinks as you learn.

0 of 0 known
newest / preferred Older legacy — know it for "which is deprecated" questions 1.4 exam domain — 1 Concepts · 2 Threats · 3 Architecture · 4 Operations (28%) · 5 Governance

Confidentiality

Symmetric | One shared key, both directions1.4

Generations — oldest to current
Others that show up as answer choices
Rule for the bucket questions: asymmetric is the short list — RSA, ECC, DH family, DSA family. Every other cipher name is symmetric.
Building blocks
Block cipher modes — how AES handles more than one block

Asymmetric | Key exchange — agree on a secret over a hostile wire1.4

Basic → ephemeral → the property you get

Encryption at rest | Protecting data where it sits1.43.3

Data states — where encryption applies
Levels — whole disk down to one field
Where the keys live

Access control | Who gets in, and what they can touch once inside4.6

Models — who decides, least to most restrictive
Principles applied on top of any model

Both — Confidentiality and Integrity

Encrypts and signs | Asymmetric families that do both jobs1.4

The math under the hood — the exam asks this directly

Hybrid | TLS — asymmetric to trade a key, symmetric to move the data1.43.2

Handshake, in order
Versions
IPsec — the same hybrid idea at the network layer (VPNs)

PKI | Public Key Infrastructure1.4

Getting a certificate — in order
Checking a certificate — client side
Certificate types — by what they cover
Certificate types — by how hard the CA checked, or what it's for

Password storage | Never store the password — store something derived from it1.4

What happens to a password before it hits the database

Secure protocols | The S is the secure version. When two options both have an S, the question names the use.4.5

Integrity

Hashing | One-way fingerprint. No key, no reversing.1.4

Generations — oldest to current
The failure mode

Keyed hash | Hash plus a shared secret1.4

How the tag is made

Digital signatures | Hash plus the sender's private key1.4

How a signature works
Signature algorithms — the three the exam wants

Availability

Recovery metrics | Every term is a distance between two events. Click the FAILURE point to flip time ↔ money.3.45.2

Availability — time time → last goodbackup FAILUREclick → cost servicerestored nextFAILURE RPO — Recovery Point Objective how much data can we lose? — looks BACK RTO — Recovery Time Objective how long can we be down? — looks FORWARD MTTR — Mean Time To Repair how long repair ACTUALLY took. RTO is the target; MTTR is the measurement. MTBF — Mean Time Between Failures failure to failure — repairable things (servers, swappable drives) MTTF — Mean Time To Failure in service → first failure. Non-repairable things (a bulb, a fuse, a dead SSD) Availability — money last goodbackup FAILUREclick → time servicerestored nextFAILURE RPO cost = work redone hours of lost data × people × rate. Shrink it: back up more often. RTO cost = downtime hours down × revenue/hr (+ idle staff). Shrink it: hot site, HA, faster restore. SLE = AV × EF — what ONE failure costs RPO cost + RTO cost + repair/replacement = the exposure factor's share of asset value MTBF → ARO = 1 ÷ MTBF (in years) fails every 5 years → ARO 0.2. This is how the time chart feeds the money chart. ALE = SLE × ARO — what this failure costs PER YEAR Spend up to the ALE on a control that prevents it. If the control costs more than the ALE, accept the risk.
The two rules

Risk and operations

Quantitative risk | Putting a dollar figure on a threat5.2

Build left to right — each tile feeds the next
Try it — move the sliders, watch both formulas
$100,000
25%
0.1 (once every 10 years)
SLE = AV × EF
$25,000
100,000 × 0.25
ALE = SLE × ARO
$2,500 / yr
25,000 × 0.1
$2,000

Risk assessment types | When you run the assessment5.2

Secure baselines | Hardening as a three-phase process4.1

Phases — the question names one and asks what belongs in it

Zero Trust | Never trust, always verify — the three moving parts1.2

Control plane decides, data plane enforces

Plans and agreements | Governance paperwork the exam names by acronym5.15.33.4

Plans — which document for which moment
Agreements — who is on each side
Also on the list

Automation and orchestration | Why the exam says to script it — the benefits list, verbatim from 4.74.7

802.1X and wireless | Who gets on the network, and how the air is encrypted once they are4.14.5

802.1X — port-based network access control, wired or wireless. Layer 2, no port number of its own.
EAP methods — strongest to weakest
WPA ladder — how the wireless traffic is encrypted
What WPA3 fixed, and the two modes on every WPA version
Secure office Wi-Fi in 2026 — what "built right" means

Ports | The ones that actually get asked — insecure on the left, its replacement on the right4.5

OSI model | Seven layers, top down — and what the exam hangs on each oneNet+

Please Do Not Throw Sausage Pizza Away (bottom up). Layers 1–4 move data; 5–7 are the application side.
Two things the exam actually tests with the model

Threat actors | Six of them. One anchor word each; the rest follows.2.1

Left to right: most resourced to least. Anchor word first, then the CompTIA attributes verbatim.
The rules that decide the close calls

SY0-701 objectives — what the pills mean

CompTIA publishes the exam as five domains split into numbered objectives. The pill on each card is the objective it serves. Bold rows are covered here; the rest is what the board still needs — mostly Threats and Operations, which is where the exam puts its weight.

1.0General Security Concepts12% of the exam
1.1Compare and contrast security control categories and typesnot on the board yet
1.2Fundamental security concepts — CIA, non-repudiation, AAA, Zero Trust, physical, deceptionon the board → Risk & Operations
1.3Change management processes and their security impactnot on the board yet
1.4Cryptographic solutions — PKI, encryption, hashing, salting, signatures, certificateson the board → Confidentiality
2.0Threats, Vulnerabilities, and Mitigations22% of the exam
2.1Threat actors and motivationson the board → Risk & Operations
2.2Threat vectors and attack surfacesnot on the board yet
2.3Types of vulnerabilitiesnot on the board yet
2.4Indicators of malicious activitynot on the board yet
2.5Mitigation techniques used to secure the enterprisenot on the board yet
3.0Security Architecture18% of the exam
3.1Security implications of architecture models — cloud, IoT, ICS, virtualizationnot on the board yet
3.2Security principles to secure enterprise infrastructure — firewalls, VPN/IPsec, NAC, segmentationon the board → Both C + I
3.3Concepts and strategies to protect data — types, states, encryption methodson the board → Confidentiality
3.4Resilience and recovery — HA, backups, sites, testingon the board → Availability
4.0Security Operations28% of the exam
4.1Common security techniques — baselines, hardening, wireless settings, mobileon the board → Risk & Operations
4.2Asset management — acquisition, inventory, disposalnot on the board yet
4.3Vulnerability management — scanning, CVSS, remediationnot on the board yet
4.4Alerting and monitoring — SIEM, SNMP, NetFlownot on the board yet
4.5Modify enterprise capabilities — firewall rules, IDS/IPS, secure protocols, NAC, email securityon the board → Both C + I
4.6Identity and access management — access control models, MFA, least privilegeon the board → Confidentiality
4.7Automation and orchestrationon the board → Risk & Operations
4.8Incident response activitiesnot on the board yet
4.9Data sources to support an investigation — logsnot on the board yet
5.0Security Program Management and Oversight20% of the exam
5.1Security governance — policies, standards, procedures, planson the board → Risk & Operations
5.2Risk management — assessment types, SLE/ALE, BIAon the board → Risk & Operations
5.3Third-party risk — vendor assessment, agreementson the board → Risk & Operations
5.4Security compliance — reporting, privacynot on the board yet
5.5Audits and assessments — penetration testingnot on the board yet
5.6Security awareness practicesnot on the board yet

Source: CompTIA Security+ SY0-701 exam objectives. Check every term on this board against that PDF; it is the only authority.

Practice — produce the word, no options

You had it.

Not it yet — try again.

Look it up on the board →

Multiple choice lets you recognize the answer; the exam is easier if you can produce it. Type and press Enter. Nothing is revealed until you get it — try as many times as you like; when it goes green, the explanation opens and Enter moves on. Stuck? "Look it up" jumps to the tab where the tile lives. Nothing is scored.

Resources

Get a library card first. Most public libraries give cardholders free access to LinkedIn Learning and Udemy (through Gale Presents: Udemy) — the same Security+ courses people pay for. In Los Angeles that's LAPL or LA County Library; check your own library's "e-resources" or "digital learning" page. It's free and it takes ten minutes.

Practice questions

Where the misses on this board came from. Use topic quizzes to find the leak, mixed tests to check retention.

  • ExamCompass — free SY0-701 practice tests, plus quizzes by exam topic and acronym quizzes. Start here.
  • Jason Dion practice exams (Udemy) — harder than the real exam; 80%+ here means you're ready. Free through many libraries.

Courses

Official

  • CompTIA Security+ — download the exam objectives PDF and check every term on this board against it.
  • Pearson VUE — scheduling and score reports (sign-in redirects through login.comptia.org; that's normal).
  • NIST CSRC glossary — when two study guides disagree on a definition, this is the tie-breaker.

How to use this board

  • Take a topic quiz first. Bring the misses here and find the tile — read the exam tell on the back.
  • Tick a tile as known only after you've gotten it right on a quiz, not after reading it. The board should shrink because of evidence.
  • Read the last clause of every exam question twice. CompTIA hides the deciding word at the end.
  • Write the two risk formulas on your scratch paper before question one: SLE = AV × EF, ALE = SLE × ARO.