Domain 1: General Security Concepts
This domain covers the vocabulary the rest of the exam builds on: what kinds of controls exist, what security is trying to protect, how changes are managed safely, and what cryptography is for. It’s about 12% of SY0-701.
What changes in V8 for this domain: Weight rises to about 16%. CompTIA's V8 summary lists three objectives here (controls, change management, cryptography). Check the full V8 objectives to see where topics like the CIA triad and Zero Trust are covered.
Security controls
Every control can be described two ways: how it’s implemented (its category) and what it’s meant to do (its type or function).
- Categories: technical (enforced by hardware or software, like firewall rules or MFA), managerial (policies, risk assessments, planning), operational (things people do day to day, like awareness training or reviewing logs), and physical (fences, locks, bollards).
- Types: preventive stops something before it happens, detective spots or records it, corrective fixes things afterward, deterrent discourages an attacker from trying, directive tells people what to do, and compensating stands in when the preferred control can’t be used.
A locked door is physical and preventive. A camera is physical and mainly detective. If an old app can’t support MFA, putting it behind a jump host with extra monitoring is a compensating control.
Core security ideas
- CIA triad: confidentiality (only the right people see it), integrity (it isn’t changed without permission), and availability (it works when people need it).
- AAA: authentication proves who you are, authorization decides what you’re allowed to do, and accounting records what you did.
- Non-repudiation: proof that someone really did something, usually through a digital signature, so they can’t credibly deny it.
- Least privilege: give people and systems only the access they actually need.
- Zero Trust: don’t trust anything just because it’s “inside” the network. Check identity, device and context on every request.
Change management
Most outages and plenty of security holes come from changes made in a hurry. A good change process includes an owner, a reason, an impact analysis, approval, a maintenance window, testing, a backout (rollback) plan, and documentation.
- Standard changes are pre-approved, low-risk and repeatable.
- Normal changes go through review and approval.
- Emergency changes get fast-tracked approval, then a review afterward.
Version control helps too: it shows who changed what, and it lets you roll back.
Cryptography basics
- Symmetric encryption (like AES) uses one shared key. It’s fast, so it’s used for bulk data such as full-disk encryption.
- Asymmetric encryption (like RSA or ECC) uses a public/private key pair. It’s used for key exchange and digital signatures.
- Hashing (like SHA-256) makes a one-way fingerprint of data. It isn’t encryption. Use it to check whether something has changed.
- Digital signatures: you sign with your private key and anyone can verify with your public key. That gives integrity, authenticity and non-repudiation.
- PKI: certificates link an identity to a public key. Certificate authorities issue them and revocation lists (CRL/OCSP) cancel them.
- Salting adds random data to each password before hashing, which defeats precomputed “rainbow table” attacks.
Key terms
Try to define each term before you tap it.
Technical
Enforced through hardware or software, such as MFA, EDR, or firewall rules
Managerial
Policies, governance, planning, and risk assessment
Operational
Day-to-day activities carried out by people, such as awareness training or reviewing logs
Physical
Fences, locks, bollards, and physical barriers
Preventive
Blocks an event before it occurs
Detective
Identifies or records an event
Corrective
Restores operations or repairs harm after an event
Compensating
Alternative mitigation when the preferred control cannot be deployed
Directive
Tells people what to do, like a policy or an acceptable use agreement
Deterrent
Discourages an attacker from trying, like warning signs or visible cameras
Confidentiality
Prevent unauthorized disclosure, often with encryption and access control
Integrity
Protect accuracy and detect modification using hashes and signatures
Availability
Keep services usable via redundancy and recovery
Authentication
Verify identity with credentials or factors
Authorization
Decide permitted actions after identity is verified
Accounting
Record user and system activity for audit
Zero Trust
Verify explicitly and minimize implicit trust
Non-repudiation
Provide evidence that a party performed an action, often through digital signatures
Request for change
Formal record of a proposed modification
Impact analysis
Evaluate downtime, dependencies, security effects, and business risk
Approval
Authorized decision before implementation
Rollback plan
Defined way to safely undo a change
Version control
Tracks who changed what and supports reproducibility
Emergency change
Urgent change with expedited review and retrospective
AES
Modern symmetric encryption algorithm
RSA
Asymmetric algorithm used for signatures and certain key-transport uses
ECC
Public-key cryptography with smaller comparable key sizes
SHA-256
Cryptographic hash function; not encryption
Digital signature
Uses private-key signing to support integrity, authenticity, and non-repudiation
PKI
Trust framework using certificates, certificate authorities, and revocation
Key escrow
Protected retention of decryption keys for authorized recovery
Salting
Unique random data added before password hashing to resist precomputed attacks
Quick self-check
5 practice questions in our own words. Pick an answer to see the explanation. Practice only: it doesn't predict exam results.
A team installs a camera so unauthorized entry can be identified and reviewed afterward. What is the camera's main function? Obj. 1.1
Show answer
B. Detective. It records and identifies an event rather than stopping it, so its main job is detective. (A visible camera can also deter, but that is a secondary effect.)
A legacy app cannot support MFA, so the team puts it behind a jump host and adds extra monitoring. What kind of control is this? Obj. 1.1
Show answer
A. Compensating. When the preferred control cannot be used, an alternative that reduces the same risk is a compensating control.
An employee signs in successfully but is blocked from opening payroll records. Which step blocked them? Obj. 1.2
Show answer
B. Authorization. Authentication already proved who they are. Authorization decides what they are allowed to do, and payroll was not on the list.
A production firewall change is approved, but nobody has written down how to undo it if it breaks things. What is missing? Obj. 1.3
Show answer
B. Backout (rollback) plan. A backout or rollback plan is the documented way to safely reverse a change that goes wrong.
You want to confirm a downloaded installer was not altered. What is the most direct way? Obj. 1.4
Show answer
B. Compare its hash to the publisher's published hash. Hashes detect changes. Get the expected hash from a trusted source and compare it with the hash of your copy.
Official exam details, objectives and pricing: CompTIA Security+ (official page) (opens in new tab).
NeonKey isn't affiliated with or endorsed by CompTIA. Security+ is a trademark of CompTIA. No pass guarantees — check CompTIA for current exam details.