Security+ Commonly Confused Terms Cheat Sheet: 40 Pairs and Their Differences
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Security+ often puts two similar ideas into one question and asks which fits. This cheat sheet lines up about 40 of the pairs that cause the most mix-ups, such as IDS versus IPS, RTO versus RPO and hashing versus encryption, with a one-line difference for each and a four-step method for telling pairs apart. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
How to Use This Cheat Sheet
Security+ often places two similar ideas in the same question and asks which one fits. This sheet lines up the pairs that cause the most mix-ups with a one-line difference for each. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
Threats, Testing and Detection
| Term | Versus | The difference |
|---|---|---|
| IDS | IPS | IDS detects and alerts. IPS sits inline and can block |
| Vulnerability scan | Penetration test | A scan finds known weaknesses automatically. A pentest tries to exploit them to show real impact |
| Threat | Vulnerability | A threat is something that could cause harm. A vulnerability is a weakness it could exploit. Risk combines the two with impact |
| False positive | False negative | False positive is an alert for something that is not a problem. False negative is a real problem that was missed |
| Authentication | Authorization | Authentication proves who you are. Authorization decides what you may do |
| Virus | Worm | A virus needs a host file and user action. A worm spreads on its own across networks |
| DoS | DDoS | DoS comes from one source. DDoS comes from many, often a botnet |
| Phishing | Spear phishing, whaling, smishing, vishing | Phishing is broad email fraud. Spear phishing targets a person, whaling targets executives, smishing uses SMS, vishing uses voice calls |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Cryptography and Data
| Term | Versus | The difference |
|---|---|---|
| Symmetric | Asymmetric | Symmetric uses one shared key and is fast. Asymmetric uses a key pair and is slower |
| Hashing | Encryption | Hashing is one-way with no key. Encryption is reversible with a key |
| Encoding | Encryption | Encoding changes format and is not secret. Encryption protects confidentiality |
| Tokenization | Masking | Tokenization swaps data for a surrogate stored in a vault. Masking hides part of the value |
| Data at rest | In transit and in use | At rest is stored, in transit is moving across a network, in use is being processed in memory |
| SAML | OAuth and OpenID Connect | SAML is federated sign-in using XML assertions. OAuth delegates access. OpenID Connect adds identity on top of OAuth |
Security Controls
| Term | Versus | The difference |
|---|---|---|
| Preventive | Detective | Preventive stops an event, like a firewall. Detective identifies it, like a log review or alarm |
| Corrective | Compensating | Corrective fixes after an event, like restoring from backup. Compensating substitutes when the normal control is not possible |
| Deterrent | Directive | Deterrent discourages, like a warning sign. Directive instructs, like a policy |
| Technical | Managerial, operational, physical | Technical uses technology. Managerial is policy and risk. Operational is people-run processes. Physical is tangible protection |
| Honeypot | Honeynet, honeyfile, honeytoken | A honeypot is a decoy system. A honeynet is a network of them. A honeyfile and a honeytoken are decoy data or credentials that alert when used |
| DLP | CASB | DLP prevents sensitive data leaving. A CASB enforces policy between users and cloud services |
Risk, Recovery and Backup
| Term | Versus | The difference |
|---|---|---|
| RTO | RPO | RTO is maximum downtime. RPO is maximum data loss in time |
| MTTR | MTBF | MTTR is average time to repair. MTBF is average time between failures |
| Hot site | Warm and cold site | Hot is ready to run with current data. Warm has equipment but needs data and setup. Cold is space only |
| Full backup | Incremental and differential | Full copies everything. Incremental copies changes since the last backup of any kind. Differential copies changes since the last full |
| Qualitative risk | Quantitative risk | Qualitative uses ratings like high or low. Quantitative uses numbers like SLE, ARO and ALE |
| Risk acceptance | Mitigation, transfer, avoidance | Accept the risk, reduce it, shift it such as with insurance, or stop the risky activity |
Assessment and Tools
| Term | Versus | The difference |
|---|---|---|
| Known environment | Unknown environment | Known gives the tester full knowledge, formerly white box. Unknown gives none, formerly black box. Partially known is in between |
| Authenticated scan | Unauthenticated scan | Authenticated scans log in for deeper results. Unauthenticated scans see only what an outsider sees |
| SIEM | SOAR and XDR | SIEM collects and correlates logs. SOAR automates response. XDR extends endpoint detection across more sources |
| WAF | NGFW | A WAF protects web applications at layer 7. An NGFW is a general firewall with application awareness |
| Split tunnel | Full tunnel | Split tunnel sends only some traffic through the VPN. Full tunnel sends all of it |
| Fail-open | Fail-closed | Fail-open allows access when a control fails, favoring availability. Fail-closed blocks, favoring security |
A Method for Telling Pairs Apart
When two answers look alike, use the same steps each time.
Find the verb in the question
Words such as detect, prevent, recover, block or alert usually point to one side of a pair.
Name what the scenario is missing
If a system alerts but does not block, the answer is probably detective, not preventive.
Check the time frame
Before an event suggests preventive, during suggests detective, and after suggests corrective or recovery.
Eliminate by definition
Write the one-line difference for each option and cross out the ones that do not match the scenario.
Practice Them
Try these in context with our ten Security+ practice questions, see where each concept sits in the objectives explained, and build flashcards for the pairs you miss. DD Academy tracks which objectives you miss and brings them back with spaced review, free to start on iPhone and the web.
The bottom line
Learn the one-line difference for each pair, apply the four-step method to scenario questions, and drill the pairs you miss with practice questions and flashcards until the distinction is automatic.
Frequently asked questions
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan automatically finds known weaknesses. A penetration test is a manual, goal-driven attempt to exploit weaknesses to show real impact. Scans are broad and frequent, pentests are deeper and scheduled.
What is the difference between preventive and detective controls?
Preventive controls stop an event before it happens, such as a firewall or access control. Detective controls identify an event as or after it happens, such as logs, alerts or an intrusion detection system.
What is the difference between a threat, vulnerability and risk?
A threat is something that could cause harm, a vulnerability is a weakness that could be exploited, and risk is the likelihood and impact of a threat exploiting a vulnerability.
What is the difference between incremental and differential backups?
An incremental backup copies data changed since the last backup of any type, so restores need the last full plus every incremental. A differential copies data changed since the last full backup, so a restore needs the last full plus the latest differential.
What is the difference between hashing and encryption?
Encryption is reversible with the right key and protects confidentiality. Hashing is one-way, has no key and produces a fixed-size digest used for integrity and password storage.
What is the difference between RTO and RPO?
The recovery time objective is the maximum acceptable downtime. The recovery point objective is the maximum acceptable amount of data loss, measured in time since the last good copy.
What is the difference between a honeypot and a honeytoken?
A honeypot is a decoy system built to attract attackers. A honeytoken is a decoy credential or data record, such as a fake API key, that triggers an alert whenever it is used.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
