Quick reference
AZ-104220-1202SC-300
PowerShell is regular in a way that makes it guessable: every cmdlet is a verb and a noun. Learning the verbs and the discovery cmdlets is worth more than memorising any particular command.
AZ-900CLF-C02SY0-701
The service model decides where the line falls between what the provider manages and what you do. Exam questions almost always test that line rather than the definitions.
AZ-104AZ-700AZ-500
Most Azure networking questions are one of two shapes: why is this traffic blocked, or which connectivity option fits these requirements. The NSG rule table answers the first and the connectivity table answers the second.
AZ-104AZ-500SC-300
Two systems are easy to confuse and both appear in the same questions. RBAC controls who may do something. Policy controls what may exist. A question that says a compliant user cannot create a resource is usually a policy question.
AZ-900AZ-104
Azure Fundamentals rewards recognizing which service solves which problem. This maps the AZ-900 core services to their categories.
AZ-104AZ-900
The Azure CLI and Azure PowerShell commands AZ-104 asks you to read and pick between, plus the resource types those commands create. Written for the Azure Administrator exam and useful revision after AZ-900.
SC-300SC-900
The Entra ID vocabulary SC-300 and SC-900 test, from tenant objects to Conditional Access controls and governance features. SC-900 candidates need the first three tables; SC-300 needs all seven.
SAA-C03ANS-C01SOA-C03
The security group against network ACL table is the single most tested comparison in AWS networking, because the stateful and stateless difference explains most blocked-traffic scenarios.
CLF-C02SAA-C03SCS-C03
Two things carry most AWS security questions: what the shared responsibility model puts on your side of the line, and how IAM resolves a request when several policies apply. The evaluation table is the one that decides exam answers.
CLF-C02SAA-C03SOA-C03
Storage questions give you an access pattern and ask for the cheapest class that meets it. Compute questions give you a workload shape and ask for the cheapest purchasing model. Both are lookup problems once the tables are memorised.
CLF-C02SAA-C03
CLF-C02 lives on 'which service would you use for X?' questions. This is the core service vocabulary, grouped by category.
220-1201220-1202
Two A+ Core 1 topics that are pure recall. The laser imaging process is asked in order almost every exam cycle, and the fault table is the shape most printer questions take.
220-1201XK0-005KCNA
The comparison that gets tested is what a container shares with the host and what a virtual machine does not. Everything else follows from that one difference.
220-1201SY0-701XK0-005
RAID levels and backup types both come down to a trade between speed, capacity and how much you can lose. The tables state each one so a scenario can be matched to it.
220-1202N10-009220-1201
CompTIA tests the order directly. A question gives you a scenario mid-way through and asks what to do next, and the answer is whichever step comes next in this list, not whichever action would fix it fastest.
N10-009SY0-701220-1201
DNS appears in networking questions as a record type and in security questions as email authentication. Both sets are here, because SPF, DKIM and DMARC are all TXT records and the exam expects you to know what each one asserts.
CS0-003PT0-003SY0-701
ATT&CK organises what attackers do into tactics, which are goals, and techniques, which are the ways of reaching them. Exam questions give you an observed behaviour and ask which tactic it belongs to.
CS0-003PT0-003SY0-701
Exam questions describe a task and ask which tool does it. The grouping below is by task rather than by name, because that is how the question arrives.
CS0-003SC-200SY0-701
Analysis questions hand you a log line and ask what happened. Knowing which event ID means what, and which file to look in, is most of the work.
SY0-701CISSPCS0-003
The quantitative formulas are the only maths on Security+ and they appear most years. The worked example runs one scenario through every formula so the relationships are visible.
XK0-005EX200CKA
The commands that come up in exam scenarios, grouped by what you are trying to do. The permissions table is the one worth memorising, because octal notation appears in questions that are not otherwise about permissions.
N10-009200-301SY0-701
Layer questions are usually device questions or troubleshooting questions in disguise. Knowing which layer a device operates at tells you what it can and cannot see, which is what the question is really asking.
N10-009220-1201200-301
Distance and speed are what these questions turn on. A scenario gives you a run length and a required speed, and the answer is whichever standard covers both.
N10-009220-1201SY0-701
Two things get tested: which 802.11 standard fits a speed and band requirement, and which security protocol to use. The channel table matters because non-overlapping channels are a recurring troubleshooting answer.
SY0-701CISSPSC-300
Four models, and exam questions separate them by one question: who decides who gets in. The authentication factor tables underneath are the other half, because multifactor questions turn on whether two factors are actually different types.
SY0-701CS0-003SC-200
Order is what these questions test. The phases run in one sequence, evidence is collected most volatile first, and getting either backwards is the wrong answer even when every individual step is right.
SY0-701CISSPSC-900
Questions here turn on which document applies to the situation described. A framework is voluntary guidance, a regulation carries legal force, and an audit report is evidence about a third party.
SY0-701CS0-003SC-900
CompTIA publishes an acronym list with the SY0-701 objectives and then writes questions that use the short form without expanding it. These are grouped by subject rather than alphabetically, because that is how they come up.
SY0-701CS0-003PT0-003
Exam questions rarely name an attack. They describe one and ask what it was. Each row here carries the detail that separates it from the attack next to it, which is the part the question turns on.
SY0-701SC-900CISSP
What each algorithm is for, and which of the three properties it gives you. Most cryptography questions are answered by knowing whether the scenario needs confidentiality, integrity, or authenticity.
SY0-701N10-009220-1201
The well-known ports you must recognize for CompTIA Network+, Security+, and A+. Insecure protocols are paired with their encrypted replacements, a favorite exam theme.
220-1201
The hardware facts A+ Core 1 (220-1201) loves to test: memory and storage generations, RAID levels, connectors, and the imaging process order.
220-1202
The command line tools A+ Core 2 (220-1202) expects you to recognize on sight, with the switches that get tested. Windows commands first, then the Linux and macOS commands from objective 1.9.
220-1202
Symptom to cause to first action, for the Windows problems A+ Core 2 (220-1202) puts in front of you. Covers boot failures, the repair tools, malware removal order, and the security settings on objective 2.2.
200-301N10-009350-401
IPv6 questions are usually recognition rather than calculation: which type of address is this, and what is the shortened form. Both tables below answer that directly.
200-301N10-009350-401
A router picks the longest prefix match first, then the lowest administrative distance, then the lowest metric. Most routing questions are that sequence applied to a table.
200-301N10-009350-401
Switching questions come in two shapes: a configuration that does not work, and a topology asking which port blocks. The command tables answer the first and the spanning tree tables answer the second.
200-301N10-009
Subnetting under time pressure is the CCNA skill. Memorize this table and the block-size trick, and subnet questions become seconds, not minutes.
CISSPSY0-701
CISSP is a management exam written for someone who thinks like a risk owner rather than an engineer. The weightings decide where study time goes, and the models table covers the recognition questions.
CKACKADKCNA
The CKA and CKAD are performance exams under a clock, so speed matters more than breadth. These are the commands that come up, plus the order to debug a pod that will not start.
Nothing here asks for an email. Open a sheet, print it, and the paper carries its title and the page it came from, so it still says what it is a week later on your desk.