Security+ SY0-701 Domain 1: General Security Concepts

Domain 1 accounts for 12 percent of the SY0-701 exam, but its ideas appear far beyond the questions labeled General Security Concepts. A scenario about an incident, cloud design, access review, or vendor change may still depend on confidentiality, least privilege, control selection, or certificate trust.

The most useful way to study this domain is through comparisons. Know what each concept protects, what evidence it provides, and which nearby term solves a different problem.

Domain 1 map

The official objectives organize General Security Concepts into four areas:

Keep those questions in mind while reviewing the details. They are often more useful than memorizing a long list in isolation.

Security control categories and functions

A control can be classified by category, which describes how it is implemented, and by function, which describes what it is intended to do. Exam questions may ask for either one.

Control categories

The category depends on the implementation being described. A written access policy is managerial. An administrator following the account-review procedure is operational. The identity platform enforcing the approved access is technical.

Control functions

A single control may serve more than one function. A security guard can deter trespass, prevent unauthorized entry, and detect suspicious behavior. The scenario usually reveals the function the question wants. If the camera recording helps investigators discover an event, the emphasis is detective. If the camera is highly visible and intended to discourage an attempt, deterrence is the better fit.

Core security concepts

Confidentiality, integrity, and availability

The CIA triad describes three central security goals:

• Confidentiality limits information to authorized people, systems, and processes. Encryption, access controls, and data classification commonly support it.
• Integrity protects accuracy and guards against unauthorized or undetected change. Hashes, digital signatures, version control, and controlled write access can support it.
• Availability keeps systems and data accessible when authorized users need them. Redundancy, backups, capacity planning, and resilient design support it.

Ask what harm the scenario is trying to prevent. Disclosure points toward confidentiality. Unauthorized modification points toward integrity. An outage or exhausted service points toward availability.

Controls often support more than one goal. Multifactor authentication can reduce unauthorized disclosure and modification. Backups can restore availability and recover known-good data after corruption. Choose the goal emphasized by the facts in the question.

Non-repudiation

Non-repudiation provides evidence that supports attributing an action or message to a specific party. Digital signatures are the usual exam example because the signer uses a private key and others can verify the result with the corresponding public key.

Reliable non-repudiation depends on the surrounding process. Private keys must be protected, identities must be validated, and records must retain integrity. A username in an ordinary editable log offers weaker evidence than a protected signing process tied to a verified identity.

Authentication, authorization, and accounting

AAA separates three access-control activities:

Authentication normally comes before authorization. Accounting records the resulting activity. A user can authenticate successfully and still be denied access because authorization is a separate decision.

Authenticating people may involve passwords, tokens, biometrics, certificates, or combinations of factors. Systems also authenticate to one another through device certificates, service identities, keys, and other machine credentials. Authorization models then translate policy into permissions. A model may base access on roles, attributes, rules, resource ownership, or centrally defined labels.

Gap analysis

A gap analysis compares the current state with a required or desired state. The difference becomes the gap that needs remediation.

For example, an organization may compare its existing controls with a security framework, customer contract, or internal baseline. The analysis can reveal missing multifactor authentication, incomplete logging, outdated procedures, or unclear ownership. It identifies the distance between the two states; a remediation plan determines how to close it.

Zero trust, physical security, and deception

Zero trust

Zero trust treats access as an ongoing decision based on identity, device condition, requested resource, policy, and risk. Network location alone does not create trusted status.

Common zero-trust ideas include:

• Adaptive identity: Authentication and access requirements respond to risk signals such as location, device posture, behavior, and sensitivity of the resource.
• Threat scope reduction: Segmentation and narrow privileges limit how far a compromised identity or device can move.
• Policy-driven access control: Central policy evaluates the request and determines whether access should be granted, denied, or restricted.
• Continuous verification: A session can be reevaluated when conditions change rather than trusted indefinitely after sign-in.

The architecture is often described through a control plane and a data plane:

Zero trust is broader than one product. Identity systems, endpoint posture, segmentation, logging, policy services, and enforcement controls work together.

Physical security controls

Physical controls protect people, facilities, and equipment. Learn what each control is designed to stop or detect:

• Bollards block vehicles from reaching a building or protected area.
• Access control vestibules allow one controlled entry stage before the next door opens.
• Fencing establishes a boundary and channels entry toward monitored points.
• Video surveillance records activity and may also deter it when visible.
• Security guards can verify access, respond to conditions, and apply judgment.
• Access badges identify authorized personnel and can integrate with electronic access systems.
• Lighting improves visibility and reduces concealed approaches.
• Sensors detect conditions such as motion, pressure, sound, or heat.

Know the sensor clues:

• Infrared sensors detect heat or changes in infrared energy.
• Pressure sensors detect weight or force on a surface.
• Microwave sensors emit energy and detect movement through reflected changes.
• Ultrasonic sensors use high-frequency sound and measure reflected movement.

A question about stopping a vehicle calls for a different control from a question about detecting a person after hours. Start with the physical event being addressed.

Deception and disruption technology

Deception resources attract or expose suspicious activity without offering real production value:

• A honeypot imitates a system or service.
• A honeynet provides a group or network of decoy systems.
• A honeyfile is a decoy file that should not be accessed during normal work.
• A honeytoken is a decoy credential, record, API key, or other data element whose use creates a high-confidence alert.

These controls can improve detection and reveal attacker behavior. They require isolation, monitoring, and careful design so the decoy cannot become a useful path into production.

Change management and security

Changes can improve security and still create outages, broken dependencies, logging gaps, or unexpected access. Change management provides a repeatable way to evaluate, approve, test, document, and recover from those changes.

Business and process requirements

A sound change process commonly addresses:

• Approval: The appropriate authority accepts the change and its risk.
• Ownership: One person or team is accountable for planning and execution.
• Stakeholders: Affected technical and business groups receive input or notice.
• Impact analysis: The team identifies systems, users, data, and services that may be affected.
• Test results: Evidence shows how the change behaved before production deployment.
• Backout plan: The team has a practical path to restore the prior state.
• Maintenance window: Work is scheduled when disruption can be managed.
• Standard operating procedure: Repeatable steps reduce improvisation and missed tasks.

The sequence matters. Approval based on incomplete impact information is weak approval. A backout plan written after a failed deployment is incident documentation.

Technical implications

A change may affect:

• Allow lists and deny lists
• Restricted activities and permissions
• Planned downtime
• Service or application restarts
• Legacy applications
• Upstream and downstream dependencies

Suppose a firewall rule is tightened to block an exposed service. The security goal is sound, but the change can still break monitoring, an application dependency, or a partner connection. Testing and impact analysis expose those consequences before the maintenance window.

Documentation and version control

After implementation, documentation should match the environment. Updating diagrams, policies, procedures, inventories, and support instructions keeps the written record aligned with the deployed change.

Version control records who changed a configuration or document, what changed, and when. It also supports review and rollback. The useful record includes the context behind the decision along with the final file.

Cryptography, keys, and PKI

Cryptographic questions become easier when you identify the security result first. Confidentiality, integrity, authenticity, and trust validation use related tools, but they are not interchangeable.

Encryption, hashing, signatures, and obfuscation

Symmetric and asymmetric cryptography

Symmetric encryption uses the same secret key for encryption and decryption. It is efficient for protecting large amounts of data, but the parties need a secure way to share and protect the key.

Asymmetric cryptography uses a public and private key pair. Information encrypted for a recipient with the recipient's public key can be decrypted with that recipient's private key. A digital signature reverses the purpose: the signer uses a private key, and others verify the signature with the public key.

Real protocols often combine both approaches. Asymmetric methods authenticate or establish shared key material, while symmetric encryption protects the ongoing session efficiently. Key exchange is the process that lets parties establish or share the key material needed for secure communication.

Encryption can be applied at different levels. Full-disk encryption protects an entire storage device, while partition, volume, file, database, and record-level encryption narrow the protected scope. Transport or communication encryption protects data moving between systems. The right level depends on what data must remain protected and when authorized software needs to use it.

Algorithm choice and key length both affect security. A longer key is meaningful only within an appropriate algorithm and implementation. Configuration, random-number quality, key storage, and protocol use also matter.

Obfuscation, steganography, tokenization, and masking

Obfuscation makes information harder to interpret without claiming the assurance of strong encryption. Related techniques serve different purposes:

• Steganography conceals the existence of information by placing it inside another medium, such as data hidden within an image or audio file.
• Tokenization replaces sensitive data with a substitute token. A protected mapping or token service connects the token to the original value when authorized.
• Data masking hides or alters selected portions of data so it can be displayed or used with reduced exposure, such as showing only the last four digits of an account number.

These methods may reduce exposure or conceal information, but the implementation and threat determine how much protection they provide.

Salting and key stretching

A salt is unique random data added before hashing a password. It prevents identical passwords from automatically producing identical stored hashes and makes precomputed lookup tables less useful.

Key stretching deliberately increases the work required to derive or test a key, often through repeated computation or memory-hard processing. It slows legitimate verification slightly and makes large-scale password guessing more expensive.

The salt does not need to remain secret. Its value comes from uniqueness. The password or derived secret still requires protection.

Key storage and management

Protecting the algorithm while exposing private keys would defeat the design. Common key-protection tools include:

• Trusted Platform Module (TPM): Hardware-backed key storage and platform measurements tied to a device.
• Hardware Security Module (HSM): Dedicated hardware for secure key generation, storage, and cryptographic operations.
• Key Management System (KMS): Central service for creating, storing, rotating, authorizing, and auditing keys.
• Secure enclave: Isolated execution and storage area that protects sensitive operations from the rest of the system.
• Key escrow: Controlled retention of key material so authorized recovery is possible under defined conditions.

Choose based on the scenario. A TPM commonly protects device-bound keys. An HSM is suited to high-value centralized signing or certificate-authority operations. A KMS coordinates lifecycle and access across applications and services.

PKI and certificate trust

Public key infrastructure connects identities with public keys through certificates and trust relationships.

A typical certificate process includes:

1. A subject generates or receives a public and private key pair.
2. A certificate signing request (CSR) contains the public key and identifying information.
3. A certificate authority (CA) validates the request according to its process.
4. The CA signs the certificate.
5. Clients validate the certificate chain back to a trusted root.

Important certificate terms:

• Certificate authority: Issues and signs certificates.
• Root of trust: A trusted root certificate or anchor used to validate a chain.
• Certificate signing request: A request containing a public key and certificate details for CA approval.
• Self-signed certificate: Signed by its own private key and trusted only when the recipient explicitly accepts it.
• Third-party certificate: Issued by an external CA whose root may already be trusted by clients.
• Wildcard certificate: Covers multiple hosts at one domain level, such as *.example.com.
• Certificate revocation list (CRL): A published list of revoked certificate serial numbers.
• Online Certificate Status Protocol (OCSP): A request-and-response method for checking certificate status.

A valid signature proves the certificate was signed by the listed issuer. Full trust also depends on the chain, dates, hostname or identity match, allowed key use, and revocation status.

Blockchain and public ledgers

A blockchain links records through cryptographic hashes and distributes the ledger according to its design. Changing earlier data can become evident because later links no longer match.

An open public ledger allows broad visibility and participation under the rules of the network. Public visibility does not make every record accurate before it is entered. The security properties come from the cryptographic linking, consensus model, validation rules, and distributed copies.

Common Domain 1 exam traps

Choosing a control by its name instead of its purpose

A camera can be detective or deterrent. A guard can be preventive, detective, or deterrent. Use the outcome described in the scenario.

Confusing authentication with authorization

Successful sign-in establishes identity. Permission to read, change, or administer a resource is an authorization decision.

Treating zero trust as a single appliance

Zero trust is an access model supported by identity, policy, device posture, segmentation, monitoring, and enforcement. A product may provide part of the system.

Skipping the backout plan

Testing reduces uncertainty. It does not guarantee every production dependency will behave as expected. A backout plan gives the team a defined recovery path.

Using encryption when the question asks who signed something

Encryption protects confidentiality. A digital signature supports integrity and attribution. Some protocols use both, so identify the requested result.

Assuming a certificate means a site or person is trustworthy in every sense

A certificate binds a public key to an identity according to the issuer's validation process. It does not evaluate every action, claim, file, or business practice associated with that identity.

Forgetting key management

Strong algorithms still depend on protected private keys, controlled access, rotation, backup or escrow where appropriate, and revocation when trust is lost.

Domain 1 review checklist

Before moving on, check whether you can do the following without relying on answer choices:

• Classify a control as technical, managerial, operational, or physical.
• Identify preventive, deterrent, detective, corrective, compensating, and directive functions from a scenario.
• Apply confidentiality, integrity, and availability to realistic events.
• Separate authentication, authorization, and accounting.
• Explain non-repudiation and the conditions that make the evidence useful.
• Describe a gap analysis and the two states it compares.
• Explain the roles of the zero-trust policy engine, policy administrator, and policy enforcement point.
• Match physical barriers and sensors to the event they address.
• Distinguish honeypots, honeynets, honeyfiles, and honeytokens.
• Put approval, impact analysis, testing, implementation, rollback, and documentation into a defensible change process.
• Compare encryption, hashing, digital signatures, salting, key stretching, and obfuscation.
• Explain when a TPM, HSM, KMS, secure enclave, or key escrow is useful.
• Trace certificate trust from a leaf certificate through an issuing CA to a trusted root.
• Compare CRL and OCSP certificate-status checking.

Official references

This guide follows the General Security Concepts topics listed in the official SY0-701 exam objectives. Use the current objectives as the final checklist because exam policies and published materials can change.

• CompTIA Security+ certification page
• CompTIA Security+ SY0-701 exam objectives PDF