DEV Community: TiltedLunar123

Security+ Port Questions Want the Secure Swap

TiltedLunar123 — Thu, 24 Sep 2026 09:32:44 +0000

Plenty of people create a deck of forty port numbers to memorize and still struggle with the port questions on the SY0-701 exam. The deck works well for its purpose, but the test doesn't usually ask just for the number. Instead, it might mention a protocol that transmits data in plain text and ask what should be used instead, or show a firewall rule and ask what's wrong with it.

That's objective 4.5, where secure protocol selection sits right next to firewall rules. So the thing worth learning is the swap: the insecure protocol, the secure counterpart that replaces it, and which port each one uses.

Learn the pairs, not the list

A simple list treats all numbers equally, which can make them hard to remember. With pairs, each number has a partner that helps explain it. You should know these swaps well.

Telnet uses port 23 and switches to SSH on port 22.
HTTP runs on port 80 and changes to HTTPS on port 443.
FTP operates on ports 20 and 21, and can switch to SFTP on port 22 or FTPS on ports 989 and 990.
LDAP works on port 389 and moves to LDAPS on port 636.
POP3 uses port 110 and changes to POP3S on port 995; similarly, IMAP on port 143 becomes IMAPS on port 993.
SMTP runs on port 25 and can switch to submission on port 587 with STARTTLS, or to SMTPS on port 465 with TLS from the start.
Syslog sends on port 514 and moves to syslog over TLS on port 6514.

Once the pair is the unit, many questions become clear. An admin handling switch management via Telnet should use SSH. A directory lookup that travels across the network in plain text should use LDAPS. You're finishing a pair you already know half of, which is much easier than trying to find one number out of forty.

Two traps where the fix isn't a new port

Most swaps lead to another port, making it simple to think they all do. However, two of the most tested ones don't, and the incorrect answers are built on that misunderstanding.

The first is SNMP. In versions 1 and 2c, community strings travel in plain text over UDP ports 161 and 162. SNMPv3 remedies this by incorporating authentication and encryption, still using those same two ports. So an option to switch SNMP to a secure port is incorrect. The solution lies in upgrading the version.

The second is DNS, with a twist. Traditional DNS on port 53 lacks encryption, meaning anyone along the route can see your queries. DNSSEC, which sounds like it might help, only signs DNS records to detect fake responses; it doesn't encrypt anything, so lookups remain visible. Encrypting the actual query is done by DNS over TLS (DoT) on port 853 or DNS over HTTPS (DoH) on port 443. If a question asks how to prevent others from seeing which sites a user looks up, DoT or DoH is the answer. To stop fake responses, DNSSEC is the solution. Both are part of DNS security but address different issues.

SFTP and FTPS are not the same thing

Both are known as secure FTP, and the exam leans on that confusion. SFTP works within SSH for file transfer and isn't related to the FTP protocol, so it uses port 22, which is also used by SSH and SCP. FTPS is standard FTP encrypted with TLS, and it operates on ports 989 and 990.

That difference raises a real question. In a scenario where the firewall only allows port 22 outbound, SFTP will function but FTPS won't. If the organization desires one open port for remote shell and file transfer, the choice is SSH, as SFTP and SCP use that port too.

Where ports show up in a firewall rule

You'll find port numbers in rule tables, often in a performance-based question. The task here is to look at each rule and figure out if that particular traffic should pass through.

A few rules stand out. An inbound Telnet allow on port 23 from any source is a problem because it's unencrypted. Allowing Remote Desktop Protocol (RDP) on port 3389 from the internet is an issue too, and this one often catches people out. Even though RDP is encrypted, RDP exposed to the internet is a leading entry point for ransomware. Just being encrypted doesn't mean it's safe to expose. The rule table is testing exposure, not only encryption.

How to drill it

Write down the insecure part of each pair first, then add the secure counterpart and its port number. Next, reverse the order. Begin with the secure protocol and explain what it replaced. Finally, say out loud what each secure version adds, whether that's encryption, authentication, or integrity, because that detail is what separates DNSSEC from DoT.

Once that's solid, read ports inside real rules instead of on their own. A free firewall rule question will tell you quickly if the pairs hold up when mixed with source addresses and directions. The full port table, including less common ports, is worth a single pass once the pairs are solid. CompTIA's wording for objective 4.5 is listed in the objectives as well.

When a question mentions a cleartext protocol, start by looking for its paired protocol first. If the question names SNMP or DNS, pause and verify whether the solution involves a newer version of the protocol or an alternative one before proceeding.

The Security+ Log Question Has One Right Source

TiltedLunar123 — Tue, 22 Sep 2026 09:33:41 +0000

Domain 4 is the largest part of SY0-701, and a fair portion of it is one type of question dressed up differently. A short scenario outlines what an analyst needs to figure out, and then four data sources are listed below it, and you pick one. Firewall logs. Endpoint logs. DNS query logs. Vulnerability scan results.

Most study material prepares you for the wrong version of that question. It teaches the log types as a list, detailing the fields each one contains, and quizzes you on what a firewall log includes. The exam rarely tests that. Instead, it asks which source answers the question in the scenario, and the best way to prepare is to learn the mapping from the question to the source rather than the contents of each source.

Three layers, three questions

The layer a source resides at tells you what it can prove, and that's really the key.

The boundary proves reachability. Firewall logs list source and destination IP addresses. They also include port, protocol, and the allow or deny decision, making them quick for spotting denied inbound traffic, port scans, and failed egress. A wall of denies from one internal host is a scanning or beaconing signature. What can a firewall log not tell you? What ran on the machine.

The host proves execution. Endpoint and EDR logs record process creation with the parent-child relationship intact, which is how you see that Word spawned PowerShell. They also track file system and registry changes and link an outbound connection to the exact binary that opened it. When the scenario asks about what ran, or asks you to confirm a parent process, you're dealing with the host.

The application proves what was touched. Application logs connect activity to a user ID and a session ID and a request ID and an API endpoint. That follows one actor's path through the software and shows which records got queried. Nothing at the network boundary can answer that.

The distractor is always the source that might have a clue

Question creators often use nearby sources as wrong answers. The cleanest example is packet capture against flow records. Both are network evidence, both would be in the room during an investigation, and they answer different questions.

Flow records show who talked to whom and how much and for how long. They're cheap to keep and are the backbone of network investigation, which is why they appear safe. Packet capture is the full content of the traffic at one point in the network, and it's the only source that reveals what was actually transferred. So if the scenario asks about data leaving the environment or what a session contained, you want the packet capture, even though the flow record looks relevant.

An alert and a block are different pieces of evidence

Intrusion detection and intrusion prevention are often taught together, with a slash in between. On this objective, the slash matters quite a lot. An IDS log shows an alert. An IPS log shows a block. Both provide a signature ID and the offending packets.

Why does this distinction matter? Because it is evidentiary rather than trivia. If the question is whether the attack hit its target, an IDS entry says the traffic was seen and allowed through, and an IPS entry says the session was stopped. Same signature, opposite conclusion about impact. A question asking about containment would look for the block.

Two sources that describe state rather than activity

Vulnerability scan results and configuration and change data are the other reliable distractor pair, and they fail for one reason. They describe what a system looks like rather than what happened on it. A scan says port 3389 is open and unpatched. It doesn't say anyone connected. Configuration and change records show what the device was set to and when someone made changes, which is useful for proving unauthorized changes but not for reconstructing an intrusion.

Dashboards fit into the same caution. A dashboard summarizes volume so a person can spot patterns, and it's a starting point rather than evidence. Every finding on one gets confirmed against underlying logs before it goes into a report, and an option that offers a dashboard as proof is almost always wrong.

How to drill this

Read the stem's verb first before looking at the options. Who logged in? That's authentication, so it goes to the OS security log, which means Windows Security or auth.log depending on the platform. What ran? That's execution, so it goes to endpoint logging. What was transmitted? That's content, so it's packet capture. What was reachable? That's about the boundary, so it's the firewall. There are only four verbs and they cover a lot.

Then practice the objective as a block rather than scattered through a mixed set, because the sources only separate when you see them side by side. The Domain 4 practice set is filtered to security operations, and objective 4.9 is listed as Use Data Sources to Support an Investigation in the full objectives list if you want CompTIA's own wording. Individual source names sit in the glossary as well.

One final habit. When two options both look defensible, ask which one directly answers the question and which one just contains a clue. That's the split the question was built on. Once you spot it, the four options stop being four.

Every Security+ Control Answer Needs Two Labels

TiltedLunar123 — Sun, 20 Sep 2026 09:37:43 +0000

Objective 1.1 seems to focus on vocabulary. There are four categories and six types to memorize, and then you progress. Then, an exam scenario about a badge reader or a written policy asks which control it is, and half the group picks something the other half has already dismissed.

Why do people disagree on that? Because the question demands two labels, while most study materials present everything as a single list of ten terms.

Two axes, not one list

A control belongs to a category and a type. Categories are about who or what enforces it. There are four:

Technical. A system does it.
Managerial. Someone decides and writes it down.
Operational. People do it as part of their job.
Physical. You can walk into it.

The type is about timing. It's where the control fits relative to the potential problem:

Preventive stops it.
Deterrent makes someone decide not to try.
Detective notices it.
Corrective cleans it up afterward.
Directive tells someone what to do.
Compensating replaces a control that can't be used.

Every control has one label from each side. A fence is physical and deterrent. Encryption at rest is technical and preventive. A quarterly access review is managerial and detective. Practice answering with both words even when the question asks for just one, as the second word often clarifies the first.

The same control can move between boxes

This is where it feels unfair. A security guard is always physical. The type changes with whatever the question says the guard is doing.

A guard standing at the entrance where everyone can see him, in a question about people deciding not to walk in, is a deterrent. A guard checking badges and turning people away is preventive. A guard watching a camera feed and phoning it in is detective.

Nothing about the guard changes; the surrounding sentence does, and that's what's being tested. Cameras and logging work the same way.

Compensating does not mean extra

Compensating is what people grab for when they are unsure, and using it out of uncertainty is usually wrong.

A compensating control exists when a required control can't be used. The need still stands, though the usual way to meet it is blocked, so something else steps in to cover the same risk. Think of a legacy server that can't handle the current patch; it's isolated on its own network segment with stricter firewall rules and enhanced logging, and that setup compensates for the patch that can't be applied.

What about an extra layer on something that already works? That's just another control, and calling it compensating gets the question wrong. If you can't name the missing control or explain why it's missing, choose a different answer.

Directive is the one that gets skipped

A directive control tells someone what to do. An acceptable use policy, a documented procedure for handling customer records, and a sign by the door reading "one person at a time" are all directive.

The key difference is enforcement. A policy saying laptops must be encrypted is directive and managerial, as it's a policy that controls behavior. Full disk encryption pushed by the MDM that users can't disable is preventive, because it's a technical control that stops something before it happens.

Both aim at the same goal. They are different types though, and the exam will hand you both in the same question set.

Reading the question for the right cue

Verbs are key here.

Stops it from happening: preventive.
Makes someone decide not to try: deterrent.
Notices or alerts or reviews: detective.
Restores or rebuilds after the fact: corrective.
Instructs or requires or trains: directive.
Covers a requirement that can't be met the intended way: compensating.

The category is often clear. A device or a firewall rule is technical. A policy or an audit cycle is managerial. Awareness training and a process someone runs by hand are operational. Locks and cameras and fences and guards are physical.

Watch out for the word operational; it trips people up. Does it mean a thing that is being operated? No. Operational means humans running a process. A backup job on a schedule is technical because the system runs it. Someone testing the restore every quarter and signing off is operational.

Practice with pairs

The fix is boring, and it works. When you encounter a control in a practice question or a lesson, say both labels before checking the choices. A badge reader: technical and preventive. A warning banner at login: directive, and technical if the system forces you to click it, managerial if it's just in a handbook.

Do twenty of these and the question stops feeling like vocabulary. Is that tedious? Very. It is also the whole trick. Go through CompTIA's published exam objectives and work down the list instead of relying on someone else's table.

The drag and match performance-based questions ask you to put controls in the right buckets, too. There's a free one on my site if you want to see the format before exam day.

Your Security+ Expires in Three Years. Here Is What Renews It.

TiltedLunar123 — Fri, 18 Sep 2026 10:35:18 +0000

Passing Security+ is not the end of paperwork. The certification lasts three years, starting from the day you pass. Renewal costs 50 continuing education units (CEUs) and a fee. Fifty is more than it sounds. Plan for it. Here's what counts toward those 50, what doesn't, and the one route that can finish the whole thing in a single activity.

Three ways to renew with no CEUs

CompTIA lists three ways to renew the certification that don't involve submitting any activities. No tallying and no waiting on a reviewer.

The first is a CertMaster CE course. CompTIA calls it the fastest option, and Security+ is one of only three certifications it covers, alongside A+ and Network+. The course fee includes the CE fee, which is not nothing. Holders of the higher certifications can't use this route, so renewing SecurityX is harder than renewing Security+.

The second is passing the newest version of the exam. Sitting the current Security+ again renews it on the spot, which is worth knowing before you book anything else.

The third is earning a higher-level CompTIA certification. It applies to some certifications and not others. Read your own renewal requirements instead of assuming.

Everything else? That means earning CEUs and uploading proof of every one of them.

Fifty units, and the rules that decide them

So what counts? Five kinds of activity:

training and higher education
IT industry participation
non-CompTIA certifications
publishing
related work experience

Three conditions apply to all five. Miss one, and the activity is worthless.

Timing. The activity has to happen within your three-year cycle. Something you did before you certified is useless here.

Relevance. At least half the content must relate to the exam objectives you are renewing against. CompTIA is clear that it looks at both topics and the cognitive level of the material. If you can't point at the objective a course maps to, that's your answer.

Documentation. Every activity needs paper. Paperwork is where most submissions fail, and it fails them at the last step, after the studying and the money are already spent.

The caps are the part people miss

Here's the catch. A live webinar earns one CEU per hour, which sounds good until you read the ceiling. So, how far do webinars get you? Not far at all. They are capped at 10 CEUs for Security+, conferences carry the same cap of 10, and sitting through webinars until the number goes up quietly tops out at a fifth of what you actually need.

There is no such ceiling on a training course. One CEU per hour, up to the full 50, and a college course is worth 10 CEUs for each three to four credit-hour class, so five classes would cover the whole requirement between them. Teaching or mentoring earns one CEU an hour and caps at 20. Creating instructional materials earns two CEUs an hour and also caps at 20. Sitting in a CompTIA exam development workshop as a subject matter expert has no cap and can cover the full 50 on its own.

There is a shortcut for anyone working under the Department of Defense, and it is the single biggest one on this page for the people it applies to. The DoD Cybersecurity Fundamentals and Cyberspace Operations Fundamentals courses are pre-approved and carry 25 CEUs for Security+. That's half the requirement in one submission. Worth checking before you pay for anything.

One certification can do the whole job

Were you going to sit another exam anyway? Then a qualifying non-CompTIA certification is the efficient route. CompTIA publishes an approved list per certification, and for Security+, most entries are worth the full 50. These all sit there at 50, which is really the entire renewal in one activity:

CISSP
CISA and CISM
SSCP
CEH
AWS Certified Security Specialty
the CCNP Security exams

Read the list. The numbers are not uniform. Microsoft Certified: Security Operations Analyst Associate appears at 38 CEUs, not 50. It is a qualifying certification that still leaves you 12 short.

What gets rejected

So what does CompTIA actually want to see? It is specific about proof, and specific in a way that catches people who did the work but lost the renewal on the evidence.

For a certification, submit the certificate or the badge link issued by the certifying body. It has to show your name and the exact name of the certification. The date goes on there too. Training completion certificates, score reports, and emails are not valid submissions for that activity.

For a webinar or a conference session, you need an outline of the content, plus either a completion certificate or the registration email. Your name and the session name have to appear on it, along with the date and the hours. On-demand webinars and YouTube videos count only if you can show proof of registration or completion, which is not something most YouTube watching produces.

The SY0-701 wrinkle

One date changes the arithmetic here. It matters most for anyone certified recently. The English SY0-701 exam retires on June 11, 2027. If your three-year window closes after that, the route of passing the newest version means sitting a different exam from the one you passed, against a different set of exam objectives. Nobody needs to panic about that. It is worth deciding early rather than in the last month, because a retake you planned for is a study project and a retake you didn't is a scramble.

Whichever route you pick, the CE fee applies unless the course price already covers it, and the submission has to be approved before your expiration date rather than on it. Three years feels very long right up until the final quarter of it.

If the exam route is the one you are heading for, the format is worth re-meeting early. Try a free performance-based question before you commit to a date.

A Practice Exam Score Is Not a Security+ Prediction

TiltedLunar123 — Wed, 16 Sep 2026 09:50:13 +0000

Every study group has a simple rule: get 85 percent on your practice exams and you'll pass. Some say 90. Others suggest you'll be fine if you score in the 70s or 80s on one vendor's tests. Where does that number come from?

In August, I took SY0-701 and relied on practice exams, so this isn't against them. The problem is, that rule can't do the job people think it can. The gap between what people think it measures and what it really does measure is where many first-time failures come from.

Two kinds of numbers

A practice test gives you a percentage: 68 out of 80 correct, so 85 percent.

Your Security+ score arrives in a different currency altogether. It's a scaled score, 750 on a scale from 100 to 900, and the lowest score on that scale is well above zero. You can't convert between the two in either direction, because nobody outside CompTIA holds the conversion and there is no fixed one to hold.

When someone tells you 85 percent means you're ready, they're not giving you a measurement, they're giving you a personal correlation with a sample size of one person.

Whose questions were they?

Under that, there's a harder problem. A practice test scores you against a particular set of questions, so what it really shows is how you did on that set.

Two vendors covering the same objectives can be very different in difficulty, and neither of them is calibrated against the thing you are actually going to sit. One might write items with a clear right answer and three distractors, while another might make you choose between two defensible answers based on a scenario. Score 85 on the first and 65 on the second, and you've found something about the vendors, not yourself.

The exam has its own difficulty level, set by a process none of those authors are part of.

The number that improves for the wrong reason

Here's the one that trips people up. You take a test and score 70. You study. You take it again and score 88, so 18 points better.

Some of that improvement is real. Some is because you've seen the questions before. That part is not progress.

Recognizing a question you've seen before is a different skill from working out an answer you have never encountered anywhere, and the exam only ever tests the second of those. A rising score on something you keep retaking is partly about remembering the questions. Each pass shifts more of the score into recall and less into actual competence.

For the score to matter, the material has to be new every time.

The thing most tests leave out

Nearly all practice tests are multiple choice. SY0-701 mixes multiple choice with performance-based questions, and those are tasks. You're given an interface and asked to do something in it. Drilling with four-option questions doesn't train for that, which is why so many say the multiple choice was fine but the simulations weren't. Ask yourself which half you drilled. Where your preparation is a stack of practice tests, the skill you have drilled least is the one most likely to cost you time on the day.

What the score is good for

Practice tests aren't a waste. They're still one of the better things to spend money on. They're a diagnostic tool rather than a crystal ball. Three jobs, all of them useful.

The per-objective breakdown is the real prize, because a result telling you cryptography is sitting at 50 percent stays useful no matter what the overall score said, and unlike the headline number it points at something you can go and repair.

Timing is the one people often ignore. If you can't finish a set within the time you gave yourself, you've surfaced a problem that will still be there on exam day, long after the score is forgotten.

Question shape is the quiet one. Getting comfortable with scenarios where two answers both seem right is real preparation, and it's the main argument for doing practice questions.

A better readiness test

Want to replace 85 percent and I'm ready? Try this.

Download CompTIA's exam objectives from the Security+ page behind an email form, not a payment. Work through them line by line, saying out loud what each one means and where you would actually use it, before you let yourself look anything up or check a single answer.

The lines where you stall are your study list. That test has no scaling, no vendor difficulty, and no seen-question problem because you're not being scored against someone else's writing. You're checking if you can explain the concepts.

When the stalls end, book it.

A scheduled delete is a different program from the one you watch

TiltedLunar123 — Tue, 15 Sep 2026 09:43:41 +0000

A cleanup you watch is a different program from a cleanup on a schedule. Same query. Same mailbox. What changes is that nobody is there when the second one runs.

I added scheduled runs to my Gmail cleaner. Most of that work turned out to have nothing to do with deleting mail.

Somebody was catching your bad matches and you never noticed

Run a bulk delete by hand and you watch the count land. Two thousand four hundred, fine. Nineteen thousand, and your hand comes off the mouse before you finish reading the number.

That pause is a safety control. Nobody wrote it down. It is not in the code anywhere, and it vanishes the moment a run happens at 4am on a Tuesday while the one person who would have flinched at that number is asleep.

So the first question for a scheduled job is not how to schedule it, it is what the job should do when a result looks wrong. Remember what "looks wrong" used to mean. A human squinting at a number.

So what replaces the squint?

Daily does not mean daily

Browser extensions get no cron daemon. An alarm fires while the browser is running, so your daily job really runs the next time somebody opens Chrome. Work Monday to Friday, shut the laptop on Saturday, and your daily job runs five times a week.

Now the interesting part. Three runs were missed. Does the job catch up?

Say it does. A rule that quietly matches a few hundred messages a day now fires against three days at once, and the run that stayed small every time anyone watched it becomes the biggest this mailbox has seen. Say it does not. The mailbox drifts and the tool looks broken.

Neither answer is free, and picking one is the actual design decision hiding inside a checkbox that says "run this daily". Skipping is the safer default, and it has to be visible, because silent skipping is how somebody ends up believing a cleanup ran all month when it never did.

A schedule turns the query into the whole product

An interactive run repairs its own mistakes. You see 19,000, you narrow the filter, you go again. A bad first draft never survives.

A scheduled run gets no second draft. The query you wrote on Sunday executes against a mailbox that keeps changing under it for months. Somebody subscribes to a newsletter matching your sender pattern. A vendor switches the From address on receipts you meant to keep. The rule did not change. Its blast radius did.

Which rules survive that? Ones that state their exclusions rather than only their matches. An unattended rule is worth exactly what its exceptions are worth, and those exceptions belong inside the query instead of in the operator's head. At 4am there is no operator.

Cap the run, then tell somebody

What makes an unattended delete survivable? Two things.

First, a per-run ceiling, so a rule that suddenly matches ten times its usual volume hits the ceiling instead of the mailbox. You do not add a cap because you expect the spike, you add it because the entire premise of scheduling is that you are not watching.

Second, a record you read afterwards: the query, the number of messages actually acted on rather than matched, the time it ran, whatever it skipped and why. A scheduled feature with no report is a rumour that your inbox is being cleaned.

What I actually shipped

The extension is Bulk Delete Gmail Emails, also called Gmail One-Click Cleaner: Chrome Web Store listing.

Per that listing it runs scheduled cleanups daily, weekly or monthly. A run can be live. It can also be a review pass, or a dry run that touches nothing.

Those modes are doing the work described above. A dry run answers the "how wrong is this rule" question before the rule is ever trusted alone. Review keeps a person in the loop for the first few passes, which is where you find the exception you forgot about.

There is a recovery log too, with one-click restore for roughly thirty days. That is the backstop for a run nobody watched, and it ticks along on the same clock Gmail's own Trash uses.

The limit, said plainly

A recovery log is a thirty-day window rather than a backup. If a scheduled rule has been quietly eating something you wanted for five weeks, the log cannot help you. Neither can Gmail.

Which is the argument for aiming a schedule only at mail you have already decided against. Promotional mail from senders you unsubscribed from months ago. Notifications out of a system you left. Categories where the worst case is a shrug.

The exciting version of this feature is a rule that learns what you ignore and clears it for you. I did not build that one, and I am not going to. Unattended and clever make a bad pair when the failure mode is somebody's mail.

The Security+ PBQs Are a Time Problem First

TiltedLunar123 — Sun, 13 Sep 2026 10:14:58 +0000

Every SY0-701 story has the same shape. Someone walks in prepared, meets a performance-based question early, and then spends the rest of the exam behind the clock. The version I read this week ended in a pass. The line was still in it: ran out of time to re-review anything.

The issue is arithmetic. The arithmetic is published.

The number CompTIA gives you

CompTIA's own exam details page for Security+ says a maximum of 90 questions in 90 minutes, a mix of multiple choice and performance-based, passing at 750 on a scale that runs from 100 to 900.

So, one minute per question. That is an average and not a budget. A performance-based question (PBQ) is a small piece of work with several steps, and one of those steps is reading an interface you may never have seen before.

Meet one early and treat it like any other question, and six or seven minutes can go by without you noticing. Do that twice, and you have borrowed a quarter of an hour from questions that would have taken only twenty seconds each.

A question you never reached scores zero

The scoring is scaled, so you cannot sit there working out how many you need. What you can do is notice that a question you never reached scores zero. So does one you skipped in a panic on the way past.

That makes the decision very simple.

The cheap marks go first.

Flag it and walk away

Here is the habit worth building before exam day, because you will not invent it under pressure.

When a PBQ appears, give it one read. Is the shape of the answer obvious? If not, flag it and move on. Work the multiple choice to the end of the exam, banking everything you are sure of. Then come back with two things you did not have on the first pass: the leftover minutes, and an exact count of how many tasks are waiting for them.

Now you can spend. Ten minutes and one task waiting is a very different problem from ten minutes and three, and only that second pass tells you which one you are in.

Most of the delay is the interface

What eats the clock is usually the interface. The dragging and the dropdowns. Working out where this particular question even wants you to click.

That cost is avoidable, and free. PBQs come in a handful of recognizable shapes, and each one has a rhythm you can pick up in an afternoon at your own desk with nothing riding on it, which is a far better place to meet a new interface than a testing center with a countdown running in the corner of the screen.

Drag one list onto another
Fill in a configuration
Sort items into buckets
Click the right spot on a diagram
Put a sequence of steps in order

Never done one? This free firewall PBQ takes a few minutes and needs no account. It is the same kind of task. Do it badly once at home, where it costs nothing. Full disclosure: I built that one.

The firewall task, since that is the one people dread

The configuration PBQ has a reputation it mostly does not deserve, because the rules that decide it are short.

A firewall rule list is read from the top down and the first matching rule wins. Nothing below a match gets consulted. That is it. Two things follow from that one sentence, and between them they account for most of what a configuration task is actually able to test you on.

A specific rule has to sit above the general rule that would otherwise swallow it. Permit one host to a port, then deny the whole subnet to that port, and the host still gets through. Reverse the two lines and it does not.

Anything you did not explicitly permit is denied at the bottom. So what are these tasks really checking? The order of the permits sitting above that line.

After that it is ports, and the set that turns up is small.

443 for HTTPS
22 for SSH
3389 for RDP
53 for DNS
445 for SMB

CompTIA's published exam objectives name the protocols that matter under each domain, which is a better list to work from than a printout of every port ever assigned.

The last ten minutes

Decide now what you will do with the last ten minutes. Ten minutes is enough to finish one task properly, or to half-finish three.

Take the flagged PBQ you understood best and complete it. Then the next one. An item you left untouched because you were busy being thorough somewhere else is the most expensive thing on the exam, and it is the one part of the score that is entirely under your control.

None of this replaces knowing the material. It is what stops you from being unable to show the material you already know, which is a much more annoying way to fail.

The Security+ Acronyms That Get Confused With Each Other

TiltedLunar123 — Thu, 10 Sep 2026 09:48:36 +0000

The acronym appendix at the back of the SY0-701 objectives lists more than three hundred entries. People often suggest memorizing it, and every study group has someone printing it out. That advice misreads what the exam does with acronyms.

SY0-701 rarely tests what an acronym means. Instead, it gives you a short scenario and four options, two of which are acronyms from the same area, and asks which one fits the scenario. Knowing that RPO expands to recovery point objective doesn't help much on that question. Understanding that RPO measures lost data while RTO measures lost time gets you the answer in about four seconds.

So, the useful way to study is by cluster rather than alphabetically. A cluster is a small group of acronyms sitting close enough together that a question writer can build a believable wrong answer out of one of them. How many are there? Maybe fifteen in the whole exam. Here are five of the most common ones, with the objective each sits under, so you can read the source material.

The four recovery numbers

Objective 5.2 covers all four under business impact analysis; RPO and RTO also appear in 3.4 with resilience and recovery. Two of them are business targets. The other two are post-event observations. That split is the whole cluster. Learn it and the four stop blurring.

RPO looks backward. How much data can you afford to lose? That makes it about backup frequency. RTO looks forward. How long can you afford to be down? Which is a claim about recovery capability, not about backups. MTTR is the average repair time. MTBF is the time between failures.

The stem usually gives it away. Read it twice. A sentence about hourly snapshots points at RPO, and one about a four-hour outage window points at RTO. If the sentence describes something that already happened rather than a business decision, you are in MTTR and MTBF territory.

Federation, and why one of these is not authentication

Objective 4.6 puts SAML, OAuth and OIDC on one line with Kerberos, LDAP and RADIUS. The trap is that people learn the first three as single sign-on protocols and then mix them up under pressure. All three are very commonly confused.

SAML and OIDC both carry identity. They answer who this person is. OAuth on its own does something else. It answers what an application is allowed to reach (authorization), and it was built to let an app touch your data without handing over your password. OIDC sits on top of OAuth 2.0 and adds the identity layer that OAuth left out.

So, a stem describing a third-party app getting limited access to an account points at OAuth, even when the word login appears somewhere in the sentence. A browser redirected to a corporate identity provider, coming back with an assertion? SAML.

The agreement alphabet

Objective 5.3 covers third-party risk, and this might be the least loved cluster; it feels like paperwork rather than security. It is also the one where every option in the question is a real document and only one of them fits the sentence you were given. Read the sentence, not the options.

An SLA carries numbers: uptime and response time, with a penalty for missing the number. An MOU only records that two parties intend to work together, and it is generally not built to be enforced. An MSA sets the terms of a long relationship, while the SOW underneath it says what this particular job is and when it is due. An NDA is about confidentiality and nothing else. A BPA governs a partnership where both parties carry real risk if it goes wrong.

Severity is not priority

CVSS, EPSS and KEV all sit in 4.3. CVSS rates how bad a vulnerability would be if exploited. EPSS estimates how likely exploitation is. KEV is a catalog of vulnerabilities already being exploited in the wild.

Any question that gives you a patch queue and asks what to fix first checks whether you spotted that a severity score alone doesn't set the order. A high CVSS on something nobody is exploiting can wait. A medium that appears on the KEV list goes first.

Four ways to test code

Also in 4.3. This is the cleanest cluster of the five. SAST reads source without running it. DAST attacks the running application and sees nothing of the source. IAST instruments the running application to see both. SCA ignores your code entirely and looks at what it depends on.

The discriminator is almost always in the first clause of the stem. Third-party library with a known vulnerability? That is SCA. No source available means DAST, and a scan that runs before the build has been deployed anywhere is SAST.

How to actually drill this

Reviewing a cluster by reading it is the trap. That is the whole warning. A comparison table feels productive, and what it trains is recognition, an easier skill than the one being tested.

The version that works is slower and more annoying. For each pair in a cluster, write one sentence that only one of the two can answer. Then cover the labels and read your own sentences back. If you wrote a sentence that both acronyms could satisfy, you found the exact gap the question writer is going to aim at, and you found it at your desk instead of in the testing center.

A last word on that appendix. Treat it as a scope boundary; some entries appear only once, in one sub-bullet of one objective. The clusters are where the questions live, and the fastest way to find the rest is to read CompTIA's published exam objectives and look for lines where three or four related acronyms are grouped together. If you would rather practice this the way the exam asks it, there is a free performance-based question here that needs no account. Full disclosure: I built that one.

Gmail's Trash gives back your emails, not your undo

TiltedLunar123 — Tue, 08 Sep 2026 09:40:10 +0000

Deleting mail in bulk is easy. You run a search and hit delete on what comes back, over and over; the whole loop is about forty lines of code.

Undoing this operation turns out to be trickier, and I made a misstep initially because I thought Gmail's Trash folder was already my undo button.

It isn't.

Trash gives back the emails, not the operation

Trash just holds emails for 30 days. So technically nothing is lost, since the messages are still there waiting to be restored.

The issue lies with what you're trying to restore. If you run a cleanup that touches four thousand conversations through twelve different searches, your Trash ends up holding all of them mixed in with whatever you deleted last Tuesday and the thread you dropped on purpose this morning. Nothing marks where one run ends and another begins.

You can restore an email. Can you restore that run? No. And users usually want more than one message back; they want their last five minutes undone.

That gap is the actual feature, because Gmail has no concept of the batch you just ran.

What the log needs to record

The exact search query used
A list of ids actually acted on, not those matched
A timestamp for when the run happened
The point at which restoring stops working

The third and fourth items might seem redundant, but they're crucial. The timestamp is when it happened; the expiry is when the promise runs out, and those two are only the same thing if you assume the retention window never changes.

The distinction between "matched" and "acted on" matters because a run that dies mid-way results in different sets of matched and deleted emails. A log based solely on intent could offer to restore mail that wasn't removed, creating confusion or worse, teaching users the undo button is unreliable.

It has to live on the machine

The extension makes no network calls; it's a deliberate design choice, and it means there is no server-side place to keep a log. The data is stored locally in browser storage, which comes with its own challenges.

The first limit is size. Storing ids for tens of thousands of messages across multiple runs isn't free, and there is no point keeping an entry past the window where it can still do something.

The second one bit me. chrome.storage.local.set replaces the value at a key instead of merging into it, so writing the log for run two silently loses run one. Testing never caught it, because you almost always test the most recent action and that one is always correct. I found it while checking something else entirely.

So the write path has to read the key first and merge into it. Obvious, once you have lost data that way.

Expiry has to be visible

An undo entry outside the retention window is worse than no entry at all; it advertises a capability that won't work at the exact moment somebody needs it. So the log shows when each entry stops working, and anything past that point comes off the list.

It reads like a small detail next to the deletion engine. It is the difference between a guarantee and a suggestion.

The cheaper half is not deleting

All of this is about recovery. The better move is not needing it.

Dry runs are the key here: same query, same counts, nothing actually deleted. Most of the value of an undo system is captured by showing someone the number before they commit to it. The classic disaster isn't deleting the right things and changing your mind; it's thinking a search meant something else.

The same logic applies to protecting starred and important mail automatically. That protection belongs inside the query you count with, not applied as a filter after fetching results. If you exclude items after fetching, the number shown to the user came from a different set than the one the delete call sees, and any retry path can quietly act on the wrong list. The count and the action have to be reading the same thing.

The limit, stated plainly

None of this is a backup. Once Gmail's window closes, a recovery log is just a list of ids for mail that no longer exists. It's a 30 day guarantee, and it should be described as exactly that rather than dressed up as safety.

If you want the tool, it's Gmail One-Click Cleaner on the Chrome Web Store. It runs locally and its source is on GitHub; bulk cleanup is free.

The engine took a weekend. The undo took considerably longer, and it's the part I would keep.

Shadow IT is on the Security+ threat actor list, and there is no attacker in it

TiltedLunar123 — Mon, 07 Sep 2026 09:43:33 +0000

Shadow IT sits on the Security+ threat actor list, right there next to nation-states and organized crime. There is no attacker in it. Nobody is breaking in. It is the finance team paying for a file sharing tool on a company card because the approved one takes four days to grant access.

That placement confused me for a while. Once it clicked, a whole category of exam questions got easier, so it is worth explaining.

What the objectives actually name

Pull up CompTIA's Security+ page and read objective 2.1. The threat actors it lists are nation-states, unskilled attackers, hacktivists, insider threats, organized crime, and shadow IT. Motivations get named separately, things like data exfiltration, espionage and financial gain among others.

Two lists. Most people skim straight past that. The exam treats the actor and the motive as separate axes, and most of the questions that feel unfair are questions where you read one and answered the other.

The list is sorted by capability, not by villainy

Shadow IT belongs there because the list sorts threats by what they can do to you and how much warning you get, which is a very different job from ranking them by how villainous they are.

Ask three things about whoever is in the scenario.

How much money and time do they have? A nation-state has effectively unlimited resources and can wait a year. Organized crime is well funded and impatient, because it needs a return. An unskilled attacker has neither.

How capable are they? This is not the same question. Resources buy tools; sophistication is whether they can build something new. A nation-state writes its own malware and burns a zero day when it needs to. Somebody unskilled is running a tool that another person wrote, and does not necessarily know what it does.

Are they inside or outside? Inside changes everything, because internal actors skip the whole first phase. They already have a badge, an account, and a reason to be there.

Run shadow IT through those three and it makes sense. Internal, no hostile intent, minimal sophistication, and yet there is real exposure sitting behind it: company data in a service nobody vetted, and no logging that your team can reach. A security team cannot protect infrastructure it does not know exists. So the slot is earned on capability grounds rather than on intent.

The stem usually hands you the motive

Here is the pattern worth internalizing. Exam questions rarely say "a hacktivist did this." They describe what happened and what the attacker seemed to want, and you work backwards.

Data quietly copied out over months with no ransom demand and no disruption? Long dwell time and no money motive points at espionage, and espionage points at whoever can afford to be patient. Systems encrypted with a payment demand? That is financial gain, and that is organized crime. A public defacement timed to a news story, where the attacker wants you to know? That is philosophical or political, and it is the loudest actor on the list. Nobody quiet does that.

So the useful question is what this person wanted, and who tends to want that, rather than which of four labels you happen to recognize.

There is a corollary that matters just as much. Two actors can run the exact same technique. Phishing is evidence of nobody in particular, because everyone phishes. What separates them is who got targeted and what happened after the attacker got in.

One wording check before you trust your notes

The current objectives say unskilled attacker. Plenty of study material still says script kiddie.

On its own that is harmless, and the terms mean the same thing. It is worth noticing anyway, because it dates the material you are holding. If the wording lines up with an older version of the exam, check the rest of it before you rely on it, since SY0-701 has been the live version since November 2023 and CompTIA now prints a retirement date of June 11 2027 for the English exam.

Where reading stops helping

You can learn all of this from an article, mine included. What none of it prepares you for is the format that gives people the most trouble on the day.

The performance-based questions are not written like this. They drop you into a task and expect you to produce something from a blank state, so you are ordering a rule set or walking a log until the answer falls out. Recognizing a threat actor from a paragraph is a very different skill from operating an interface under time pressure, and studying the first one harder does not do much for the second.

That is the gap I kept hitting, and it is why I ended up building a firewall PBQ you can just do, free and without an account, so people can find out how the format feels before exam day rather than during it. Full disclosure, that one is mine.

For the reading side, Professor Messer's SY0-701 series is free and covers the whole blueprint. Jason Dion's practice exams are the usual next step when you want to be tested rather than taught. And the objectives PDF is free from CompTIA and is the only real checklist, since every question traces back to a numbered line in it.

Threat actors are cheap points once you stop memorizing six labels and start asking what the person wanted and what they could afford. Two questions. They resolve most of the domain.

CompTIA replaced the Security+ retirement estimate with a date, and it is June 11 2027

TiltedLunar123 — Sat, 05 Sep 2026 17:01:46 +0000

Every CompTIA exam page carries a line called Retirement, sitting in the Exam details block under the launch date and the question count. For most exams it reads the same way: "usually three years after launch," followed by an estimated year in brackets. It is a planning figure, not a promise, and CompTIA says so in the wording.

Security+ does not say that any more.

The SY0-701 page now reads: Retirement: English - June 11, 2027; Japanese, Portuguese, Spanish, and Thai - August 13, 2027. No "usually," no "estimated," no brackets. A date.

That is a small edit to one line on one page, and it is worth more than it looks.

Estimate versus date

The old wording put SY0-701's estimated retirement at 2026, which is this year. If you read that in the spring you would reasonably have concluded the exam was about to disappear and either rushed a booking or quietly decided it was not worth starting. Neither reaction was warranted, because an estimate derived from "three years after a November 2023 launch" is arithmetic, not scheduling.

The published date is a different kind of object. You can put it in a calendar. You can build a study plan backwards from it. You can tell a manager who is deciding whether to fund a voucher next quarter exactly how long the current version is good for.

For comparison, as of today the other two exams in the same family have not changed:

Network+ N10-009, launched June 20 2024, still reads "usually three years after launch (estimated 2027)."
A+ V15, series 220-1201 and 220-1202, Core 1 launched March 25 2025, still reads estimated 2028.

So Security+ is currently the only one of the three you can plan against precisely. If you are sequencing certifications, that is genuinely useful: the one with the firm date is the one whose window you can treat as real.

The retirement line is about the exam, not about you

This trips people up constantly, and the wording invites it.

A retirement date applies to the exam version. It says when you can stop being able to sit SY0-701. It says nothing about a certification you already hold. If you pass SY0-701 tomorrow, you hold Security+ for three years from your pass date, and a new version launching in 2027 does not shorten that by a day. Your renewal clock and the exam's retirement clock are unrelated objects that happen to be measured in the same units.

The practical version: passing early does not cost you anything, and waiting does not buy you anything except a longer wait.

What to actually do with this

Check what version your material is written for. SY0-601 retired a while ago and its content is still in circulation, sold in bundles and posted in study groups, because nothing forces a seller to take it down. The two versions overlap enough to look interchangeable and diverge in the places that decide marks. If a course, a question bank or a PDF does not say 701 somewhere visible, assume it is not.

Do not confuse the retirement date with the last day to book. The outgoing version normally stays bookable for a period after its replacement appears, and CompTIA has published a date rather than a countdown. Treat June 11 2027 as the outside edge of the window, not as a deadline you are racing.

Plan against the objectives, not the calendar. The exam is a maximum of 90 questions in 90 minutes, the passing score is 750 on a scale that runs from 100 to 900, and the five domains are weighted General security concepts 12%, Threats vulnerabilities and mitigations 22%, Security architecture 18%, Security operations 28%, Security program management and oversight 20%. Security operations is more than a quarter of the exam on its own. If you are short on time, that is where the time goes, and no retirement date changes that arithmetic.

The part the date does not help with

Knowing when the exam retires tells you nothing about the thing most people actually lose marks on, which is the performance-based questions.

They sit near the front, they are slower per mark than anything else on the paper, and they ask you to produce rather than recognise. Multiple choice hands you four options and lets recognition do the work. A PBQ hands you an empty firewall table or a set of tiles with nothing to compare against, and recognition has nothing to grab. That gap does not close by rereading, and it does not close by watching video.

Professor Messer's SY0-701 series is free and good on the concepts, and Jason Dion's practice exams will find your weak spots. Neither gives you many real simulations, which is the honest gap in the free material. I built one that runs in a browser with no account, for exactly this: a firewall PBQ you can just do.

Full disclosure, that site is mine. I sat SY0-701 on August 22 this year and passed, studying on it. Because of that, both plans are 50% off with the code PASSED50 through September 6.

All of the exam facts above come from the CompTIA exam pages themselves, which is where I would check again before planning anything on them. Pages move, and this one just did.

Your Gmail cleanup tool found nothing because your mailbox is the wrong shape

TiltedLunar123 — Fri, 04 Sep 2026 09:29:46 +0000

Most inbox cleanup tools ship with the same three searches: promotions, big attachments, anything older than a year. Run one against a mailbox holding 60,000 messages and you can still get a report that says 142 promotional emails and four large attachments. Nothing is broken. The tool asked three questions your mailbox does not answer.

I ran into this building a Gmail cleanup extension, and it took me an embarrassingly long time to see it as a design problem instead of a bug.

Category searches get written before anyone sees your mail

category:promotions, larger:10M, older_than:1y. Those are guesses about what clutter looks like, made by someone who has never seen your inbox. They are good guesses for one kind of mailbox: shopper, newsletter reader, ten years of Black Friday mail.

Plenty of mailboxes are not that. A working mailbox is often tens of thousands of small, ordinary, individually reasonable messages from a few dozen automated senders. Build notifications. Ticket updates. Bank alerts. Delivery notices. School portals. None of it is promotional, none of it is large, and a lot of it arrived last month, so it fails all three searches at once.

category:promotions has a second problem stacked on top. The Promotions tab is a classifier's opinion, not a property of the message. Gmail decides. Anything it decides wrong is invisible to a rule built on that category, and you never notice the miss, because a miss looks exactly like a clean mailbox.

Enumerate senders instead

The question that works on every mailbox shape is not "what category is this" but "who keeps sending me things".

Sender lists survive the shape problem because they assume nothing. A mailbox of 40,000 build notifications and a mailbox of 40,000 retail promos both reduce to a short list of names, and the list is shorter than people expect. Most mailboxes are dominated by a few dozen senders. You can hold that list in your head. You cannot hold 40,000 messages in your head, which is most of why the pile feels unmanageable.

Doing it by hand in Gmail:

Sample. Open a few searches that cut across your mail in different directions rather than by category: older_than:2y, is:unread, after:2026/01/01. Read the sender column, not the subjects.
Count each name that keeps coming up: from:notifications@example.com. Gmail gives you the real total for that search.
Sort your list by that number and work top down.

Step 2 is the one that matters and the one tools get wrong. A page of Gmail results is 50 rows. If something counts what it can see on the page, it is reporting a page, not a mailbox. The number has to come from Gmail's own answer to the from: search.

The trap on the way out

Once you have a ranked list you will want to act on it, and this is where a count quietly stops meaning what you think it means.

Say a row says 4,812 from one sender. You have also, sensibly, told your tool never to touch anything starred, or anything with "invoice" in it. So the run deletes 4,390 and you spend ten minutes wondering where the other 422 went.

Nothing went wrong. The count and the button were measured through different filters. If a row shows you a number, that number has to be measured through the same filters the button applies, or it is describing a mailbox you are not about to modify. The same rule holds by hand: put your exclusions in the search you count with, not only in the delete you run afterwards. from:x -is:starred -invoice is the honest count.

Two things worth keeping

Deleting is not the end of it. A sender that filled your mailbox once will do it again, so whatever you decide about a sender wants to keep applying rather than being a one-off sweep.

And check in:spam from: separately when you audit a sender. Mail that Gmail routed to Spam does not appear in an ordinary from: search at all, so a sender can look like they stopped when they only moved. Be careful what you delete in there, too. Spam has no 30 day Trash window.

I built the sampling and the per-sender counting into the extension because doing it by hand across a few dozen senders is tedious and easy to get wrong. The census and the counts are free and read only. Clearing the senders you tick is the paid part, and it only ever touches senders you ticked yourself. Full disclosure, it is mine: https://chromewebstore.google.com/detail/bmcfpljakkpcbinhgiahncpcbhmihgpc

The by-hand version above works fine without any of that, and it is the part worth taking away either way.