Study Hub / Security+ SY0-701 / Domain 1.0
CompTIA Security+ (SY0-701) Domain 1.0: General Security Concepts — Explained
Domain 1.0 is the vocabulary the rest of the exam is written in: the controls organizations use to manage risk, the principles every defense serves, the discipline that keeps change from breaking security, and the cryptography that makes trust technically possible.
1.1 — Security controls: categories and types
Every security control answers two questions: what kind of control is it? (its category) and what is it trying to do? (its type). One control usually has one of each — a firewall, for example, is a technical control of the preventive type.
Categories
- Technical — enforced by systems: firewalls, encryption, antivirus.
- Managerial — enforced by policy: security policies, risk assessments, onboarding procedures.
- Operational — enforced by people and process: security training, incident drills, log reviews.
- Physical — enforced by the real world: locks, guards, fences, badge readers.
Types
- Preventive — stops the incident before it happens. Firewall rules, door locks, encryption.
- Deterrent — discourages the attempt. Warning banners, "smile, you're on camera" signs, visible guards.
- Detective — finds the incident while or after it happens. IDS alerts, log monitoring, audits.
- Corrective — fixes things after detection. Restoring from backup, patching the exploited flaw, quarantining a host.
- Compensating — a backup control used when the primary one can't be applied. Can't patch a legacy server? Isolate it on its own VLAN instead.
- Directive — tells people what to do. Policies, procedures, "acceptable use" documents.
1.2 — Fundamental security concepts
The CIA triad
The three goals behind nearly every security decision:
- Confidentiality — only the right eyes see the data. Encryption, access controls, classification labels.
- Integrity — the data hasn't been altered. Hashing, checksums, digital signatures.
- Availability — the data and systems are there when needed. Backups, redundancy, DDoS protection.
Non-repudiation
Proof that someone did something, so they can't deny it later. Digitally signing a contract gives you non-repudiation: the signature proves who signed and that the document wasn't changed after.
AAA: authentication, authorization, accounting
- Authentication — proving who you are (password, badge, biometrics).
- Authorization — what you're allowed to do once inside (your permissions).
- Accounting — the record of what you did (logs, audit trails).
Gap analysis
Comparing where your security is against where it should be (a framework or regulation), then closing the difference. It's the "you are here" map for a security program.
Zero Trust
"Never trust, always verify." No device or user is trusted just because it's inside the network — every request is authenticated and authorized. Two planes make it work:
- Control plane — makes the decisions (the policy engine and policy administrator evaluate each request).
- Data plane — enforces the decisions (policy enforcement points allow or block the traffic).
Physical security and deception
Physical controls — bollards, fencing, access badges, guards, lighting, sensors — protect the building so nobody needs to hack the network. Deception technology flips the script: honeypots, honeynets, honeyfiles, and honeytokens are fake assets that lure attackers in so you can study them safely away from real systems.
1.3 — Change management
Most outages — and plenty of breaches — are caused by changes, not attackers: an untested firewall rule, a patch applied at noon, a config "improvement" nobody documented. Change management is the discipline that keeps evolution from breaking security.
A proper change process includes:
- Approval process — someone with authority signs off before the change happens.
- Ownership and stakeholders — one person owns the change; everyone affected is identified up front.
- Impact analysis — what could this break? Dependencies, downtime, service restarts, legacy apps that might not survive it.
- Backout plan — exactly how to undo the change if it goes wrong, decided before anything is touched.
- Maintenance window — the change happens in an agreed low-impact time slot, not Friday at 4 PM.
- Documentation and version control — diagrams, policies, and procedures are updated; every version is tracked so you can always see what changed and roll back.
1.4 — Cryptographic solutions: the building blocks
Cryptography is how confidentiality, integrity, and trust become technically real. You need the concepts here; the deep protocol details live in later domains.
- Symmetric encryption — one shared key locks and unlocks. Fast, but both sides must somehow share the key securely first (the key-distribution problem).
- Asymmetric encryption — a mathematically linked key pair: the public key encrypts, the private key decrypts. Slower, but it solves distribution — you can hand your public key to anyone.
- Hashing — a one-way fingerprint of data. You can't reverse a hash back into the original, so it's perfect for proving integrity: hash a file now, hash it later, compare.
- Salting — random data mixed into a password before hashing, so identical passwords produce different hashes (defeats rainbow tables).
- Digital signatures — a hash encrypted with the sender's private key. Anyone can verify it with the public key, proving the message is unaltered and who sent it — integrity, authenticity, and non-repudiation in one.
- PKI and certificates — public key infrastructure is the trust system that ties it together: certificate authorities vouch for identities, certificates bind a public key to an owner, and revocation lists (CRLs) handle the ones that can't be trusted anymore.
The must-memorize table: control types
If you take one table from this page, take this one. Given a scenario, name the control type by what it's trying to do:
| Type | Goal | Example |
|---|---|---|
| Preventive | Stop it before it happens | Firewall deny rule, door lock, disk encryption |
| Deterrent | Discourage the attempt | "Monitored by cameras" sign, warning banner, visible guard |
| Detective | Find it during or after | IDS alert, SIEM log review, security audit |
| Corrective | Fix it after detection | Restore from backup, patch the flaw, quarantine the host |
| Compensating | Backup control when the primary can't apply | Isolating an unpatchable legacy server on its own VLAN |
| Directive | Tell people what to do | Acceptable-use policy, security procedure |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A company installs a mantrap at the data-center entrance and posts "This area is under video surveillance" signs at every door. Which control TYPES are these?
- A. Preventive and detective
- B. Preventive and deterrent
- C. Detective and corrective
- D. Physical and operational
Show answer & reasoning
B. The mantrap prevents tailgating — it physically stops unauthorized entry, so it's preventive. The signs don't stop anyone; they discourage the attempt, which is the definition of deterrent. Watch out for D: "physical" and "operational" are control categories, not types — the question asked for types.
2. Ransomware encrypts a hospital's patient-record system. Staff can no longer open any charts, and the attackers threaten to publish the data. Which leg of the CIA triad is hit FIRST?
- A. Confidentiality — the attackers can read the records
- B. Integrity — the records have been altered
- C. Availability — staff cannot access the records
- D. Non-repudiation — the hospital can't prove what happened
Show answer & reasoning
C. The immediate damage is that legitimate users can't reach the system — that's availability. Confidentiality is threatened too (the leak threat), but the question asks what breaks first: the moment encryption lands, access is gone. Note the records weren't altered in transit (not an integrity hit), and non-repudiation isn't part of the CIA triad at all.
3. An administrator wants to push a firewall rule change on Friday at 4 PM with no ticket and no review. Which change-management element is the most critical missing piece?
- A. A maintenance window
- B. An approval process
- C. Updated network diagrams
- D. A longer password policy
Show answer & reasoning
B. Without an approval process, nobody with authority has evaluated the risk — the change is rogue by definition. A maintenance window (A) matters, but even a perfectly timed unapproved change is still unapproved. Documentation (C) comes after the change is properly authorized. The approval gate is what makes the rest of the process exist.
4. Two analysts need to exchange sensitive files. They agree on a single shared passphrase that both encrypts and decrypts the files. What kind of encryption is this, and what is its biggest practical weakness?
- A. Asymmetric — the private key could be factored
- B. Symmetric — the shared key must be exchanged securely first
- C. Hashing — the passphrase cannot be reversed
- D. Steganography — the files are hidden, not encrypted
Show answer & reasoning
B. One shared key for both directions is the definition of symmetric encryption. Its classic weakness is key distribution: the key itself has to travel between the analysts, and anyone who intercepts that exchange owns everything. Asymmetric encryption (A) was invented largely to solve this exact problem. Hashing (C) isn't encryption at all — it's one-way.
This was one domain. The simulator drills all five.
The ByteBar Practice Exam Simulator drills every Security+ domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The complete Security+ study guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on EtsyOr warm up free: take the 15-question Security+ quiz