1 Security Fundamentals and Exam Strategy

Security goals and foundations

Information security protects information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Its central goals are the CIA triad: confidentiality, integrity, and availability.

• Confidentiality means information is available only to authorized people, processes, or devices. Encryption and access controls support it.

• Integrity means information remains accurate, complete, and protected from unauthorized change. Hashes, digital signatures, and change controls help protect it.

• Availability means authorized users can access information and services when needed. Backups, redundancy, and recovery planning support it.

Security also supports authenticity, or confidence that an identity or data source is genuine, and non-repudiation, which is evidence that helps prevent a party from plausibly denying an action, such as a digitally signed transaction.

Identity, access, and accountability

AAA describes three related activities. Authentication verifies identity; authorization determines what an authenticated identity may do; and accounting records activity. For example, a user signs in with a security key, receives read-only access to a file share, and has access events logged.

Zero Trust means access is evaluated using policy and context rather than granted simply because a user or device is inside a network boundary. Apply least privilege and verify each access request.

Threats, weaknesses, and risk

A threat is a potential cause of harm, while a vulnerability is a weakness that could be exploited. An exploit is a method or code that takes advantage of a weakness. Risk is the possibility and impact of loss when a threat can exploit a vulnerability. An asset is something of value that needs protection.

A security control is a safeguard or countermeasure used to manage risk and protect information or systems. Controls are selected to address assessed risk, rather than merely to accumulate tools.

Security control categories and functions

Classify security controls along two separate dimensions: category describes what kind of safeguard a control is, while function describes what it does.

Control categories

• Technical: implemented through technology, such as encryption, firewalls, or multifactor authentication.

• Managerial: governance and oversight, such as risk assessments and security policies.

• Operational: people-driven processes, such as staff training, incident handling, and backup procedures.

• Physical: safeguards for facilities and equipment, such as locks, guards, and barriers.

Control functions

• Preventive: blocks an unwanted event, such as a firewall rule denying unauthorized traffic.

• Deterrent: discourages an attempt, such as a warning sign or visible guard.

• Detective: identifies or records activity, such as an alarm or audit log.

• Corrective: restores a secure or working state, such as removing malware and restoring a clean backup.

• Compensating: provides an alternative safeguard when the preferred control is impractical.

• Directive: tells people what is required, such as a policy or procedure.

A control can fit more than one function. For example, a door-access system may prevent unauthorized entry and record entry attempts.

Risk assessment and treatment

Risk management is a continuing cycle: identify assets and threats, assess likelihood and impact, choose a response, implement controls, and monitor whether the remaining risk is acceptable. Inherent risk is considered before controls; residual risk remains after controls are applied. Risk owners should document decisions and revisit them when systems, threats, or business needs change.

Common risk responses are:

1. Mitigate by reducing likelihood or impact with controls.

2. Transfer some financial consequences, for example through insurance or a contract. Responsibility for managing the risk may still remain.

3. Avoid the risky activity.

4. Accept the risk through an authorized decision when it is within tolerance.

Quantitative estimates can help compare options:

For example, if a $\$100{,}000$ asset could lose $20\%$ of its value in an incident, its SLE is $\$20{,}000$. If that event is estimated to occur $0.5$ times per year, its ALE is $\$10{,}000$. These are estimates for comparing options, not precise predictions. Qualitative assessments may instead rank likelihood and impact as low, medium, or high.

Security+ exam scope and preparation

Use CompTIA’s objectives for the exam code you intend to take as the authoritative scope checklist. The SY0-701 objectives describe a maximum of 90 multiple-choice and performance-based questions in 90 minutes. Their published domain weights are:

• General Security Concepts: $12\%$

• Threats, Vulnerabilities, and Mitigations: $22\%$

• Security Architecture: $18\%$

• Security Operations: $28\%$

• Security Program Management and Oversight: $20\%$

These weights describe blueprint emphasis, not a guaranteed question count on an individual exam. Verify the current exam code and objectives with CompTIA before scheduling because exam versions and details can change.

A disciplined preparation method

1. Map knowledge to the objectives. Mark each item as confident, uncertain, or not yet understood. Focus study on gaps rather than repeatedly reviewing familiar material.

2. Learn distinctions and apply them. Practice distinguishing authentication from authorization, a vulnerability from a threat, and a control’s category from its function. For each concept, explain what it protects and when it is appropriate.

3. Use scenario practice. Identify the stated goal, affected asset, and constraint before choosing an answer. Prefer the control or action that best addresses the scenario, not a technically plausible but unrelated option.

4. Review every miss. Record why an answer was wrong, what clue was overlooked, and what principle supports the correct choice. Revisit the topic and try a fresh question.

5. Practice performance-based tasks and pacing. Work through configuration, matching, and sequencing exercises, not just recall questions. During the exam, keep moving when stuck, use available review tools, and return to flagged items if time permits. Follow the exam’s on-screen instructions.

Treat practice tests as diagnostic tools, not predictions of a score. A strong readiness signal is being able to explain the reasoning behind a choice and apply it to a new scenario.