CompTIA Security+ (SY0-701): General Security Concepts
Table of Contents
Click Here to Return To the CompTIA Security+ Course Page
General Security Concepts is 12% of the CompTIA Security+ SY0-701 exam. This module covers security controls, core principles, change management, cryptography, PKI, and Zero Trust. These fundamentals appear throughout the exam, so build a solid base here.
Every other domain builds on these ideas. You classify controls, protect the three pillars of security, verify identity, and encrypt data. This module gives you the vocabulary and the mental models the rest of the course assumes.
Security Controls
You classify controls by category and by function.
| Category | Example |
|---|---|
| Technical | Firewall, encryption, MFA |
| Managerial | Policies, risk assessments |
| Operational | Security training, guards |
| Physical | Locks, fences, cameras |
Controls also have a function:
| Function | Purpose |
|---|---|
| Preventive | Aims to prevent or reduce the likelihood of an event (firewall) |
| Detective | Identifies an event (IDS) |
| Corrective | Fixes after an event (backup restore) |
| Deterrent | Discourages an attacker (warning sign) |
| Compensating | An alternative used in place of a required baseline control when it gives comparable protection |
| Directive | Guides behavior (policy) |
Fundamental Security Concepts
You protect the CIA triad:
- Confidentiality keeps data secret from unauthorized access.
- Integrity guards against unauthorized modification or destruction.
- Availability keeps data and systems accessible.
Non-repudiation uses evidence such as digital signatures to support a claim about who approved an action. The claim also depends on a trusted binding between the signer and key, key control, and reliable records. AAA is the access trio:
| Term | Meaning |
|---|---|
| Authentication | Prove who you are |
| Authorization | What you are allowed to do |
| Accounting | Record what you did |
Zero Trust assumes no implicit trust. It splits into a control plane (policy decisions) and a data plane (policy enforcement), and verifies every request.
Change Management
You control change so security and uptime stay intact.
- Approval process routes changes through a change board.
- Impact analysis assesses what a change could break.
- Backout plans restore the prior state if a change fails.
- Maintenance windows schedule change for low-impact times.
- Version control tracks configuration and code over time.
Unreviewed changes create avoidable availability and security risk.
Cryptographic Solutions
You protect data with the right cryptographic tool.
| Tool | Provides |
|---|---|
| Symmetric encryption (AES) | Fast confidentiality, one shared key |
| Asymmetric encryption (RSA, ECC) | Key exchange, two keys |
| Hashing (SHA-256) | Integrity, one-way fingerprint |
| Digital signature | Integrity and evidence of control of a signing key. Named identity depends on trusted key binding. |
| HMAC | Integrity with a shared key |
Salting adds random data to a hash to defeat rainbow tables. Key stretching slows brute force. A TPM and HSM store keys in hardware. Learn the practical side in how to get hashes of files on Linux .
Public Key Infrastructure (PKI)
You manage trust with certificates.
- A Certificate Authority (CA) issues and signs certificates.
- A Registration Authority (RA) verifies identity before issuance.
- A Certificate Revocation List (CRL) and OCSP report revoked certificates.
- Key escrow stores keys for recovery.
| Certificate type | Use |
|---|---|
| Wildcard | A common *.example.com certificate covers one label, such as app.example.com, but not example.com or deep.app.example.com |
| SAN | Multiple specific domains |
| Root | Top of the trust chain |
| Self-signed | Signed by its own key. Trust depends on explicit verification and installation, regardless of use location. |
Authentication and Access
You verify identity with multiple factors.
MFA combines independent factor types, usually something you know, have, or are. Location and behavior can add signals, but do not automatically count as an independent factor. SSO lets one login reach many apps, often with federation through SAML or OpenID Connect. Strong, unique passwords remain the baseline, covered in how to create strong passwords .
Practice: Protect a Library Export
Use this fictional case throughout the course. Harbor Library exports a member list each Friday. An employee places members.csv on a shared laptop. A contractor needs the final count but not names. The laptop is sometimes offline. Do not use real member data.
- Copy these two lines into a local file named
members.csv:id,nameand101,Example Person. Compute its SHA-256 digest withshasum -a 256 members.csvon macOS,sha256sum members.csvon Linux, orGet-FileHash .\members.csv -Algorithm SHA256in PowerShell. Change one character and hash again. Record both digests. A different digest detects a change; it does not identify the editor or encrypt the file. - Write a control matrix with one preventive, detective, and corrective control. Example: restrict the export folder by role, alert on unexpected reads, and restore a tested clean copy. State each control’s category and function. One control might serve multiple functions.
- Choose what to send the contractor. Send a count-only report through an approved channel. Do not send the named export. Explain why encryption alone would not remove the contractor’s unnecessary access.
- Draft a change record for changing that folder’s access rule. Include owner, reason, expected users, approval, test, rollback, and evidence. Test an authorized read and a denied read with synthetic accounts if you have a disposable lab. Otherwise mark the tests unrun.
- For a signed report, distinguish the file hash from a digital signature. A signature supports integrity and control of the signing key. Attribution to a named person depends on identity proofing, key custody, and trusted records. For a certificate, check name, validity, chain, and revocation status. A
*.example.comwildcard generally coversapp.example.com, notdeep.app.example.com.
Your evidence is two hash results, a three-row control matrix, a change record, and a brief access decision. Pass when you explain why hashing, signing, encryption, and authorization solve different problems without claiming that a hash proves authorship.
Reference: CompTIA SY0-701 exam objectives and NIST digital identity guidelines .
Worked checkpoint and score key
The exercise file has an exact answer if you create it with python3 -c 'from pathlib import Path; Path("members.csv").write_bytes(b"id,name\n101,Example Person\n")'. Its SHA-256 is fdb1b48e72ca3af8cc562c6cca3632f7f5abd9152a4f9ee896bd4a3745130d74. Change Person to Pers0n without changing any other byte and the digest is f06ed90fbb846882df38e4502dedf78055ad23f4339d2ce3cd99589a893ef153. A macOS or Linux hash command prints the digest and filename. PowerShell Get-FileHash prints a row with SHA256, the digest, and a path. Editor-added line endings or a final blank line change the digest, so inspect the bytes if your answer differs.
| Control | Category | Function | Owner | Test |
|---|---|---|---|---|
| Folder role rule allows records staff only | Technical | Preventive | Records lead | Staff read succeeds; contractor read denied |
| Export read alert | Technical | Detective | Security analyst | Synthetic unexpected read raises an alert |
| Isolated backup restore | Operational | Corrective | Backup owner | Recovered file matches expected digest |
Example change record: CHG-04, owner Records lead, scope export folder, reason contractor receives count only, approval Library IT lead, test staff allowed and contractor denied, rollback restore previous rule, evidence screenshot and timestamp. These are proposed tests, not observed results. Use disposable synthetic accounts staff-test and contractor-test if you run them. Do not claim a denial passed without a saved response.
Award one point each for distinct digests, correct control categories and functions, least-privilege decision, complete change and rollback record, and honest test state. Pass at 5 of 5. A hash mismatch requires a byte-level recheck before you move on.
Next Steps
Continue with Threats, Vulnerabilities, and Mitigations and Security Architecture . Operationalize these concepts in Security Operations . Return to the CompTIA Security+ Course and review tips for passing CompTIA exams .
