CompTIA Security+ (SY0-700) — Ultimate
Exam Cheat Sheet & Pass-Guide
(2026 Edition)
High-Yield Review, Essential Port Tables, GRC
Frameworks & Exam Scenario Traps.
1
,Section 1: Essential Port Numbers & Protocols (Must-
Know Cheat Sheet)
The exam almost never asks "what port is SSH?" directly.
It describes a scenario and expects you to back into the
port/protocol. That's why the "Exam Keyword Trigger"
column matters more than the number itself.
Transpor Exam Keyword
Port Protocol
t Trigger
"Secure remote CLI
access to a
Linux/network device,"
22 SSH TCP
"replaced Telnet,"
"encrypted terminal
session"
"Unencrypted file
21 FTP TCP transfer," "cleartext
credentials sniffed"
FTP Two-port question —
20/21 (data/control TCP data channel (20) vs
) control channel (21)
"Legacy remote
23 Telnet TCP access," "cleartext
management," always
2
, Transpor Exam Keyword
Port Protocol
t Trigger
the wrong answer
choice for "secure"
"Sending email," "mail
25 SMTP TCP relay," "spam relay
attack"
UDP for lookups (<512
TCP/UD bytes), TCP for zone
53 DNS
P transfers — classic
trick question
"Automatic IP
67/68 DHCP UDP assignment," "rogue
DHCP server attack"
"No authentication,"
69 TFTP UDP "config file transfer to
switches/routers"
"Unencrypted web
80 HTTP TCP
traffic"
"Encrypted web
443 HTTPS TCP traffic," "TLS-wrapped
session"
3
, Transpor Exam Keyword
Port Protocol
t Trigger
"Directory services
389 LDAP TCP query," "unencrypted
authentication to AD"
"Secure directory
636 LDAPS TCP services," "LDAP over
SSL/TLS"
"Ticket-granting,"
"mutual
TCP/UD
88 Kerberos authentication," "time-
P
sensitive auth failure"
(clock skew!)
"AAA," "encrypts only
1812/181 the password,"
RADIUS UDP
3 "network device
authentication"
"Cisco-only AAA,"
49 TACACS+ TCP "encrypts the entire
packet" (vs RADIUS)
4
Exam Cheat Sheet & Pass-Guide
(2026 Edition)
High-Yield Review, Essential Port Tables, GRC
Frameworks & Exam Scenario Traps.
1
,Section 1: Essential Port Numbers & Protocols (Must-
Know Cheat Sheet)
The exam almost never asks "what port is SSH?" directly.
It describes a scenario and expects you to back into the
port/protocol. That's why the "Exam Keyword Trigger"
column matters more than the number itself.
Transpor Exam Keyword
Port Protocol
t Trigger
"Secure remote CLI
access to a
Linux/network device,"
22 SSH TCP
"replaced Telnet,"
"encrypted terminal
session"
"Unencrypted file
21 FTP TCP transfer," "cleartext
credentials sniffed"
FTP Two-port question —
20/21 (data/control TCP data channel (20) vs
) control channel (21)
"Legacy remote
23 Telnet TCP access," "cleartext
management," always
2
, Transpor Exam Keyword
Port Protocol
t Trigger
the wrong answer
choice for "secure"
"Sending email," "mail
25 SMTP TCP relay," "spam relay
attack"
UDP for lookups (<512
TCP/UD bytes), TCP for zone
53 DNS
P transfers — classic
trick question
"Automatic IP
67/68 DHCP UDP assignment," "rogue
DHCP server attack"
"No authentication,"
69 TFTP UDP "config file transfer to
switches/routers"
"Unencrypted web
80 HTTP TCP
traffic"
"Encrypted web
443 HTTPS TCP traffic," "TLS-wrapped
session"
3
, Transpor Exam Keyword
Port Protocol
t Trigger
"Directory services
389 LDAP TCP query," "unencrypted
authentication to AD"
"Secure directory
636 LDAPS TCP services," "LDAP over
SSL/TLS"
"Ticket-granting,"
"mutual
TCP/UD
88 Kerberos authentication," "time-
P
sensitive auth failure"
(clock skew!)
"AAA," "encrypts only
1812/181 the password,"
RADIUS UDP
3 "network device
authentication"
"Cisco-only AAA,"
49 TACACS+ TCP "encrypts the entire
packet" (vs RADIUS)
4
