Domain 1 accounts for 16 percent of SY0-801. V8 combines security-control classifications and foundational concepts into objective 1.1, keeps change management as a scenario objective, and retains cryptography as a decision-heavy foundation.
1. Domain 1 map
| Objective | Focus | Useful question |
|---|---|---|
| 1.1 | Security concepts and controls | What security property or control purpose does the scenario need? |
| 1.2 | Change management | How can the change be authorized, tested, recovered, and documented safely? |
| 1.3 | Cryptographic solutions | Does the requirement involve confidentiality, integrity, authentication, trust, or key management? |
2. Security concepts and controls
Confidentiality, integrity, and availability
- Confidentiality limits information to authorized access. Encryption, access control, and classification support it.
- Integrity protects accuracy and detects or prevents unauthorized change. Hashes, signatures, controlled write access, and version control can support it.
- Availability keeps systems and data usable when needed. Redundancy, capacity planning, backups, clustering, and recovery design support it.
A control can support more than one property. Choose the property emphasized by the harm in the scenario.
Authentication, authorization, and accounting
Authentication answers who or what is requesting access. Authorization answers what that identity may do. Accounting records activity for monitoring, review, and investigation.
Do not let a successful login imply correct authorization. A user can prove identity and still receive too much access.
Non-repudiation
Non-repudiation relies on evidence that supports attribution. Digital signatures are the common example because a protected private key creates a verifiable signature. The surrounding identity, key-protection, logging, and trust process still matters.
A plain hash can detect change but does not identify who created the data. Encryption can protect confidentiality without establishing who sent the message.
Control categories and functions
| Category | Typical implementation |
|---|---|
| Technical | Technology that enforces or supports security, such as access controls, firewalls, and endpoint protections. |
| Managerial | Governance, policy, risk decisions, planning, and oversight. |
| Operational | People and recurring processes, such as account review, incident procedures, and awareness activities. |
| Physical | Protection of facilities, equipment, and physical access. |
Control functions describe the intended job:
- Preventive: blocks an unwanted action.
- Detective: reveals or records activity.
- Corrective: restores or improves the state after a problem.
- Deterrent: discourages an attempt.
- Directive: tells people what is required.
- Compensating: provides alternate protection when the preferred control is unavailable.
Read the purpose in the scenario. A visible camera may be deterrent. Recorded footage used to discover an event is detective.
3. Zero Trust, least privilege, and layered protection
Zero Trust is not a product or a single authentication step. It treats access as a policy decision based on identity, resource, context, and current conditions.
Useful principles include:
- authenticate and authorize before granting access
- apply least privilege
- make decisions as specifically as practical
- consider device health and other context
- protect resources rather than assuming a trusted network location
- monitor activity and reevaluate access as conditions change
Least privilege limits access to what the task requires. Need to know narrows access to information required for the role or activity. Defense in depth layers protections so one failure does not expose the entire system.
A network location can contribute context, but “inside the network” should not become automatic trust.
4. Change management
Objective 1.2 is scenario-based. Expect to choose the action that reduces security and availability risk without bypassing ownership or approval.
A controlled change should establish:
- What is changing and why.
- Who owns and approves it. A Change Advisory Board (CAB) may review higher-risk changes.
- Dependencies and impact. Identify downstream services, identities, certificates, firewall rules, data flows, monitoring, and recovery requirements.
- Testing. Validate the change in an appropriate environment before production when possible.
- Timing. Use maintenance windows and communication when downtime or user disruption is possible.
- Recovery. A backout plan returns to the previous state. A fail-forward plan fixes or advances from the new state when rollback is unsafe or impractical.
- Implementation and validation. Confirm both the requested function and the expected security controls.
- Documentation and version control. Record what changed, who approved it, and which configuration is authoritative.
Backout vs. fail-forward
A backout reverses the change. A fail-forward approach moves ahead to a corrected state.
Choose based on what is safe and technically possible. A database schema migration may make a simple rollback dangerous after new data has been written. A configuration change with a known-good previous version may be easy to revert.
Emergency changes
Urgency can shorten the approval path, but it should not erase accountability. Emergency changes still need authorization, documentation, validation, and follow-up review.
5. Cryptography and public key infrastructure (PKI)
Start with the security requirement.
| Method | Primary use | Key clue |
|---|---|---|
| Symmetric encryption | Confidentiality with a shared secret | Fast bulk encryption, but the secret must be shared safely. |
| Asymmetric encryption | Public/private key operations | Useful for key establishment and identity-related operations, with higher computational cost. |
| Hashing | Fixed-length digest for integrity-related uses | One-way transformation, not encryption. |
| Digital signature | Integrity and signer verification | Signer uses a private key; verifier uses the corresponding public key. |
| Salt | Defends stored password hashes against precomputed attacks | Unique random value stored with the password hash. |
Key exchange and hybrid use
Modern protocols often combine asymmetric methods for authentication or key establishment with symmetric encryption for the data session. Do not assume “asymmetric” means all application data is encrypted directly with a public-key algorithm.
Certificates and trust
A digital certificate binds identity information to a public key through a certification authority (CA) and a chain of trust.
Check:
- subject or service identity
- issuer
- validity period
- intended key use
- signature and chain validation
- revocation information when applicable
A valid signature on a certificate does not make every hostname valid for that certificate. Service identity matching still matters.
Revocation
Certificate revocation communicates that a certificate should no longer be trusted before its normal expiration. Certificate revocation lists (CRLs) and Online Certificate Status Protocol (OCSP) mechanisms support status checking in different ways.
Key protection
Protect private and symmetric keys according to their value and use. Key-management decisions include generation, distribution, storage, rotation, backup where appropriate, revocation, recovery, and destruction.
6. Common Domain 1 traps
Calling every access problem authentication
If identity is known but permissions are wrong, the problem is authorization.
Treating a hash as proof of sender identity
An ordinary unkeyed hash can detect change when compared with a trusted value. It does not prove who created the data.
Assuming Zero Trust means “block everything”
Zero Trust means explicit, policy-driven access decisions and continuous evaluation. It still permits legitimate work.
Choosing rollback without checking whether rollback is safe
Some changes require fail-forward recovery because the previous state can no longer accept the new data or dependencies.
7. Domain 1 review checklist
Confirm that you can:
- classify a control by category and function
- separate confidentiality, integrity, availability, authentication, authorization, accounting, and non-repudiation
- explain least privilege, defense in depth, and Zero Trust without reducing them to slogans
- identify CAB, stakeholder, testing, dependency, maintenance-window, backout, fail-forward, and documentation concerns in a change
- choose symmetric encryption, asymmetric operations, hashing, digital signatures, or salting for the correct purpose
- explain certificate trust, service identity, revocation, and private-key protection