Skip to content

Menu

ExamPassoLog in

CompTIA Security+: General Security Concepts Concepts

Importance ★★★☆☆ · 12% (estimate)

Overview

This chapter covers the basic ideas the rest of Security+ is built on: the goals of security, the kinds of controls that protect systems, how changes are managed safely, and the basics of cryptography. Many questions simply check that you know what a term means and can pick the right one for a short scenario.

The CIA triad names three goals. Confidentiality keeps data secret from people who should not see it, integrity makes sure data is not changed without permission, and availability keeps systems and data ready when needed. Non-repudiation means someone cannot believably deny an action, which digital signatures provide. AAA stands for authentication (proving who you are), authorization (deciding what you may do), and accounting (recording what you did).

Controls are grouped by category (technical, managerial, operational, physical) and by type (preventive, deterrent, detective, corrective, compensating, directive). A warning sign is a deterrent, log review is detective, and a substitute used when the normal control is impossible is compensating. Zero trust means no request is trusted by default: a policy engine decides and a policy enforcement point allows or blocks. Change management uses approvals, testing, and a backout plan to undo a change that goes wrong.

Symmetric encryption such as AES uses one shared key and is fast. Asymmetric encryption such as RSA or ECC uses a key pair: encrypt with the recipient's public key, and sign with your own private key. Hashing is one-way and checks integrity; a salt makes identical passwords hash differently. In PKI, a certificate authority signs certificates, and OCSP checks one certificate's revocation status in real time. A TPM chip on the motherboard stores keys for features such as full-disk encryption.

Key concepts

  • CIA triad

    Confidentiality (keep secret), integrity (keep unchanged), availability (keep usable).

    Memory tipHash check = integrity

  • AAA

    Authentication proves identity, authorization grants permissions, accounting records activity.

    Memory tipWho → what → what was done

  • Control types

    Preventive stops, deterrent discourages, detective finds, corrective fixes, compensating substitutes, directive instructs.

    Memory tipWarning sign = deterrent

  • Zero trust

    Never trust by default; verify every request. The policy engine decides and the policy enforcement point enforces.

    Memory tipEngine decides, PEP enforces

  • Symmetric vs asymmetric

    Symmetric uses one shared key (AES). Asymmetric uses a public and private key pair (RSA, ECC).

    Memory tipAES = symmetric

  • Digital signature

    The sender encrypts a hash of the message with their private key; anyone checks it with the sender's public key. It gives integrity and non-repudiation.

    Memory tipSign with your private key

  • Hashing and salting

    A hash is a one-way, fixed-length fingerprint. A salt is a random value added before hashing passwords.

    Memory tipSalt defeats rainbow tables

Often tested

  • To keep a message secret for Bob, encrypt it with Bob's public key.
  • OCSP checks one certificate in real time; a CRL is a published list.
  • A backout plan explains how to undo a change.
  • Guards, locks, and fences are physical controls.

3 sample questions

Verified practice questions from this unit.

Practice questionReviewedSecurity+ (SY0-701) › General Security Concepts★★★★☆

Question 1. Which part of the CIA triad is protected when only authorized people can read a file?

  1. ① Integrity
  2. ② Availability
  3. ③ Non-repudiation
  4. ④ Confidentiality
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ④ Confidentiality

Key point: Confidentiality = only authorized people can see data

Confidentiality keeps information secret from anyone who is not allowed to see it. Encryption and access controls are common ways to protect it.

Wrong choices

  • Integrity: Integrity means data is not changed without authorization.
  • Availability: Availability means systems and data are there when needed.
  • Non-repudiation: Non-repudiation means someone cannot deny an action they took.
Practice questionReviewedSecurity+ (SY0-701) › General Security Concepts★★★★☆

Question 2. A company stores a hash of each file so it can detect if a file is changed. Which security goal does this support?

  1. ① Authorization
  2. ② Availability
  3. ③ Integrity
  4. ④ Confidentiality
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Integrity

Key point: Hash comparison = integrity check

If even one bit of a file changes, its hash changes. Comparing hashes shows whether data was altered, which protects integrity.

Wrong choices

  • Availability: Hashes do not keep systems running.
  • Confidentiality: A hash does not hide the file's contents.
  • Authorization: Authorization decides what a user may do.
Practice questionReviewedSecurity+ (SY0-701) › General Security Concepts★★★★☆

Question 3. In AAA, which step answers the question "What is this user allowed to do?"

  1. ① Authentication
  2. ② Accounting
  3. ③ Authorization
  4. ④ Auditing
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Authorization

Key point: AAA: authenticate → authorize → account

AAA stands for authentication (prove who you are), authorization (decide what you may do), and accounting (record what you did).

Wrong choices

  • Authentication: Authentication proves who the user is.
  • Accounting: Accounting records what the user did.
  • Auditing: Auditing reviews records later; it does not grant permissions.
Practice 5 questions from this unit →

AI-written · Verified · Written by AI. Only units that passed a separate AI check (re-reading facts and numbers) are published. Tell us if you find a mistake.