General Security Concepts: Complete Security+ SY0-701 Domain 1 Study Guide

Exam Domain: Domain 1.0 — General Security Concepts | Exam Weight: 12% | Read Time: ~25 min

---

What you’ll learn: The CIA triad and why it underpins every security decision. All six security control types and four control categories. The AAA framework, zero trust architecture, non-repudiation, and cryptography basics. By the end you’ll instantly classify any security control and map any attack to the correct CIA component.

---

Why Domain 1 Is the Most Important Domain

Domain 1 is only 12% of the exam — yet failing to master it makes the other 88% significantly harder. Every threat in Domain 2, every architecture in Domain 3, every operation in Domain 4, and every governance framework in Domain 5 reference the language you learn here.

Think of Domain 1 as learning the grammar of a language. The exam’s scenario questions across all five domains assume you already speak this grammar fluently.

Exam Tip: Domain 1 rewards vocabulary precision. Ransomware primarily threatens availability — not confidentiality. A man-in-the-middle attack primarily threatens confidentiality — not integrity. These distinctions appear on every Security+ exam.

---

Section 1: The CIA Triad

The CIA triad is a decision-making framework applied to every control, policy, and incident response action.

Confidentiality

Ensures information is accessible only to authorized parties.

• Controls: Encryption (AES-256, TLS), access control lists, MFA, data classification, RBAC/ABAC, physical security
• Attacks: Eavesdropping, man-in-the-middle, shoulder surfing, dumpster diving, SQL injection (exfil), phishing
• Real example: Healthcare stores patient records in an encrypted database with role-based permissions. Without the key, data is unreadable even if copied. That is confidentiality.

Integrity

Ensures data is accurate, complete, and unaltered by unauthorized parties.

• Controls: Hashing (SHA-256, SHA-3), digital signatures, MACs, file integrity monitoring, version control, input validation
• Attacks: Data tampering, SQL injection (modify/delete), MitM alteration, replay attacks, malware modifying system files

# Verify file integrity with SHA-256
sha256sum downloaded_file.iso
# Compare output to publisher's posted hash
# If different — file was altered in transit

• Real example: A software publisher posts the SHA-256 hash alongside the download. You run sha256sum installer.exe and compare. Match = untampered. That is integrity verification.

Availability

Ensures systems and data are accessible to authorized users when needed.

Controls: Redundancy/RAID, load balancing, backups + DR plans, failover systems, UPS, DDoS mitigation

Attacks: DoS/DDoS, ransomware (data locked), physical destruction, power outages

Common Exam Trap: Ransomware primarily attacks availability — it locks you out of your own data. Some ransomware also exfiltrates data (confidentiality), but the defining characteristic is inaccessibility. The exam tests this distinction frequently.

CIA Attack Mapping Table

Attack	Primary CIA Impact	Why
Ransomware	Availability	Data encrypted, inaccessible
MitM attack	Confidentiality	Data intercepted/disclosed
Data tampering	Integrity	Data modified without auth
DDoS attack	Availability	Service disrupted
SQL injection (exfil)	Confidentiality	Unauthorized disclosure
SQL injection (delete)	Integrity + Availability	Data destroyed
Phishing (cred theft)	Confidentiality	Credentials exposed
Replay attack	Integrity	Legitimate data re-sent maliciously

---

Section 2: Security Controls

Two dimensions to every control:

• Category = HOW it is implemented
• Type = WHAT it does

Control Categories

Category	How Implemented	Examples
Technical	Hardware, software, firmware	Firewall, encryption, AV, IDS, MFA, ACLs
Managerial	Policies, procedures, standards	AUP, risk assessments, background checks
Operational	People and day-to-day procedures	Security guards, training, backup procedures
Physical	Tangible, physical mechanisms	Locks, bollards, CCTV, badge readers, mantraps

Control Types

Preventive — Stops an incident before it happens.

• Technical: Firewall | Managerial: AUP | Operational: ID check | Physical: Door lock

Detective — Identifies incidents in progress or after the fact.

• Technical: IDS | Managerial: Security audit | Operational: Guard reviewing CCTV | Physical: Motion sensor

Corrective — Minimizes impact and restores to normal operation.

• Technical: Backup restore | Managerial: IR plan | Operational: Patch after breach | Physical: Fire extinguisher

Deterrent — Discourages attackers psychologically (does not stop them).

• Technical: Login banner | Managerial: AUP with consequences | Physical: “Under surveillance” sign

Deterrent vs Preventive: A “No Trespassing” sign is deterrent. The fence it stands next to is preventive. The camera is detective. The alarm is corrective (triggers response).

Compensating — Alternative control when primary control cannot be implemented.

• Example: Legacy app can’t support MFA → implement network segmentation + enhanced monitoring instead

Directive — Mandates or instructs specific behavior.

• Technical: Compliance enforcement | Managerial: Mandatory training | Physical: “Exit only” sign

Quick-Reference Classification Table

Control	Category	Type
Firewall	Technical	Preventive
Security audit	Managerial	Detective
CCTV camera	Physical	Detective
Backup restoration	Technical	Corrective
Security guard	Operational	Preventive / Deterrent
Login warning banner	Technical	Deterrent
Bollards outside building	Physical	Preventive
IDS alert	Technical	Detective
Patching after breach	Technical	Corrective
Security awareness training	Operational	Preventive
Biometric scanner	Technical	Preventive
Mantrap	Physical	Preventive
Risk assessment	Managerial	Preventive

---

Section 3: The AAA Framework

AAA controls who gets in, what they can do, and what they did.

Authentication — Who Are You?

Three factor categories:

Factor	What	Examples
Something you know	Knowledge	Password, PIN, passphrase, security question
Something you have	Possession	Smart card, YubiKey, TOTP authenticator app
Something you are	Biometric	Fingerprint, iris scan, facial recognition

MFA requires two or more factors from different categories. Password + PIN is NOT MFA — both are “something you know.”

Authorization — What Can You Do?

RBAC (Role-Based): User → Role → Permissions. Most common enterprise model.

Alice → HR Manager role → [read_payroll, edit_payroll, view_reports]
Bob   → Accountant role  → [read_payroll, view_reports]

ABAC (Attribute-Based): Permissions based on user + resource + environment attributes.

IF user.dept = "Finance"
AND resource.type = "Financial"
AND time = "business_hours"
THEN PERMIT

Least Privilege: Users get minimum permissions needed. Limits breach blast radius.

Accounting — What Did You Do?

# Real Linux auth log entries
Sep 04 14:23:11 server01 sshd: Accepted publickey for alice from 192.168.1.50
Sep 04 14:23:45 server01 sudo: alice → USER=root → COMMAND=/bin/systemctl restart nginx
Sep 04 14:28:30 server01 sshd: Failed password for bob from 10.0.0.25

Accounting logs feed SIEM systems, audit reports, incident investigations, and compliance (PCI-DSS, HIPAA, SOX).

---

Section 4: Non-Repudiation

Non-repudiation ensures an action cannot be denied by the party that performed it. Proof that a specific person performed a specific action at a specific time.

How it’s achieved:

• Digital signatures — cryptographically tied to a specific private key only the signer possesses
• Timestamped audit logs with hash verification
• Certificate-based authentication — each user has a unique certificate

Real example: A digital contract signed with Alice’s private key cannot be repudiated — only her key produces that signature. Mathematical proof of authorship.

---

Section 5: Zero Trust Architecture

Core principle: “Never trust, always verify.”

Traditional security assumed everything inside the perimeter was trustworthy. Zero trust assumes breach — verify nothing by default, whether inside or outside the network.

Three Core Principles

1. Verify Explicitly Authenticate and authorize based on all available data: identity, location, device health, workload, data classification, behavior.

2. Use Least Privilege Just-in-time (JIT) and just-enough-access (JEA). Risk-based adaptive policies.

3. Assume Breach Minimize blast radius. Micro-segment. Encrypt end-to-end. Use analytics for threat detection.

Zero Trust Components

Component	Description
Micro-segmentation	Divides network into small isolated zones — no lateral movement
Continuous validation	Verify trust continuously, not just at login
Device health checks	Verify device compliance before granting access
PAM (Privileged Access Mgmt)	Control and monitor all admin accounts
MFA everywhere	Required for all access, including internal resources

Real example: Google’s BeyondCorp initiative — after the 2009 Operation Aurora breach, Google rebuilt access assuming their perimeter was already compromised. Employees access resources through identity and device health checks, not network location.

---

Section 6: Change Management as a Security Control

Unauthorized changes are a major source of vulnerabilities and outages. Change management is classified as a Managerial / Preventive control.

Why it matters:

• Unauthorized changes introduce vulnerabilities
• Untracked changes complicate incident investigation
• Untested changes cause outages (availability impact)

Change Advisory Board (CAB): Reviews and approves significant changes before implementation.

Key concepts:

• Every change needs a documented rollback plan
• Change freeze periods: no changes during high-risk times (e.g. holiday season for retail)
• Emergency change process: Expedited approval for critical security patches

---

Section 7: Cryptography Fundamentals

Symmetric Encryption

One key encrypts and decrypts. Fast — used for bulk data.

Plaintext → [Same Key] → Ciphertext → [Same Key] → Plaintext

Algorithm	Key Size	Status
AES-128	128-bit	Secure — standard
AES-256	256-bit	Secure — government grade
ChaCha20	256-bit	Secure — mobile optimized
3DES	168-bit effective	Legacy, being phased out
DES	56-bit	Broken — never use
RC4	Variable	Broken — never use

Use for: Disk encryption, file encryption, VPN bulk data transfer.

Asymmetric Encryption

Two linked keys — public and private. What one encrypts, only the other can decrypt. Solves the key distribution problem.

Alice encrypts with Bob's PUBLIC key → Ciphertext
Bob decrypts with his PRIVATE key   → Plaintext

Algorithm	Key Size	Use Case
RSA	2048-4096 bit	Key exchange, digital signatures
ECC	256-384 bit	Mobile, TLS, smaller key = same security
Diffie-Hellman	Variable	Key exchange only
DSA	2048-bit	Digital signatures only

Use for: TLS handshake, key exchange, digital signatures.

Hybrid Encryption — How TLS Works

Asymmetric to exchange a symmetric key, then symmetric for bulk transfer.

1. Browser connects to bank.com
2. Server sends PUBLIC key (RSA/ECC certificate)
3. Browser generates random SESSION key (AES-256)
4. Browser encrypts session key with server's PUBLIC key
5. Server decrypts session key with its PRIVATE key
6. All data transferred using fast AES-256

Hashing

One-way — converts any data to a fixed-length output. Cannot be reversed.

# SHA-256 hash examples
"password"  → 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
"Password"  → 0be1bfb7f3c98e1e1ea10dfe7a54abe2ef9f98f5c24a44e93c0e1cc6a3ffbef6
# One character change = completely different hash (Avalanche Effect)

Algorithm	Output	Status
SHA-256	256-bit	Secure — use this
SHA-3	224-512 bit	Secure — newest standard
bcrypt	Variable	Secure — for password storage
MD5	128-bit	Broken — collision attacks
SHA-1	160-bit	Deprecated — avoid

Salting

Adding a random value to data before hashing. Defeats rainbow table attacks.

Without salt: "password" → always same hash → rainbow table can crack
With salt:    "password" + "xK9#mQ" → unique hash every time

Digital Signatures

Provide Integrity + Non-repudiation + Authentication.

Signing:
1. Hash the document: SHA-256(document) = [hash]
2. Encrypt hash with PRIVATE key = Digital Signature
3. Send document + signature

Verifying:
1. Decrypt signature with PUBLIC key = [hash]
2. Hash received document = [new hash]
3. If equal → document unaltered + sender verified

Key difference: Digital signatures use PRIVATE key to sign, PUBLIC key to verify — opposite of encryption.

PKI — Public Key Infrastructure

Component	Function
Root CA	Self-signed, offline, trust anchor
Intermediate CA	Online, issues end-entity certificates
Digital Certificate	Binds public key to identity
CRL	Periodic list of revoked certificates
OCSP	Real-time certificate revocation check

Trust chain: Root CA signs Intermediate CA → Intermediate CA signs server/user certs → Browser trusts chain back to Root CA.

---