Flashcards vs practice exams: what actually sticks

I could recite every port number on the Security+ list and still bomb a timed practice exam. It happened. The terms were in my head, but the questions were not asking for terms. They were asking for judgment, and those are different skills.

I am studying for Security+ SY0-701 and eJPT right now. Not certified yet, still in it. Here is what I have figured out about when flashcards work, when practice exams work, and when each one quietly wastes your time.

Flashcards are for raw recall, nothing else

Flashcards do one thing well: they force you to pull a fact out of your head instead of recognizing it on a page. That pull is what makes it stick. Rereading a study guide feels productive and mostly is not.

What actually belongs on flashcards:

• Port numbers. 22, 53, 443, 3389. There is no concept here, just memory.
• Acronym soup. RADIUS vs TACACS+, hashing vs encryption, what AAA stands for.
• Command flags for eJPT. nmap options, basic Linux tools I do not use every day.

The spacing matters more than the cards. If I see a card once, it is gone in three days. If it comes back tomorrow, then in three days, then in a week, it stays. That is spaced repetition. It is boring and it works.

Where flashcards fail: anything that requires applying two ideas at once. A card can teach me what a firewall rule is. It cannot teach me to read six rules in order and figure out why traffic is still getting through. I had hundreds of cards down cold and my first full-length practice exam was still ugly. Recall is not judgment.

Practice exams are for stamina and question style

Security+ gives you 90 minutes for up to 90 questions, including performance-based ones. That is a pace problem, not just a knowledge problem. The first time I sat a full-length practice exam, my accuracy dropped hard in the last 20 questions. Not because I got dumber. Because I got tired and started skimming.

Practice exams train three things flashcards cannot:

• Stamina. Focusing for 90 straight minutes is a skill, and you only build it by doing it.
• Question style. CompTIA loves "BEST" and "FIRST" questions where two answers are technically right. You learn to spot the trap by seeing the trap.
• Honest weak spots. My flashcard stats said I knew cryptography. My exam scores said I knew definitions and could not pick the right algorithm for a scenario.

Where practice exams fail: too early and too often. Take the same question bank three times and you stop learning security and start memorizing answer keys. Your score climbs, your knowledge does not. That is the false confidence that gets people to fail the real thing. It is the same trap as a dog groomer judging their marketing by how much their friends like the logo. The number you are measuring is not the thing you care about.

Worth saying plainly: eJPT is hands-on in a lab, so flashcards help even less there. Cards got me the commands. Only working through actual practice boxes got me the workflow.

The streak that keeps me honest

My real problem was never method. It was consistency. I would study four hours on a Saturday and then not touch anything for five days, which for memory is close to worthless.

What fixed it was a daily minimum so small I could not excuse my way out of it: one question a day, tracked with a streak. Some days that is all I do, 40 seconds on my phone in a parking lot. Most days one question turns into ten minutes of cards, because starting is the hard part.

I will be honest about the limit here: a streak measures showing up, not learning. I have kept mine alive with a half-awake guess at 11 pm, and that day taught me nothing. The streak is a floor, not a study plan. But a floor beats zero, and zero was my old pattern.

My split now looks like this: cards almost daily in dead time, one full timed practice exam per week, and a same-day review of every miss. The misses become new cards. The loop feeds itself.

Use both, in that order

Flashcards first, until the vocabulary stops slowing you down. Practice exams second, spaced out, full length, timed. Neither replaces the other. Cards without exams gave me trivia. Exams without cards would have been guessing with extra steps.

I wanted this exact loop on my phone, so I built it into my own app: Security+ SY0-701 and eJPT flashcards, quizzes, and a daily question with streaks, plus a Pomodoro timer for the longer sessions. It is Aldo's Toolkit, free on both stores, no ads, no tracking, everything runs on your device. If you are grinding for the same exams I am, grab it at /app and keep me company on the streak.