Security+ topic 1.1
Security Concepts and Controls
Every security decision protects confidentiality (only authorized people can read data), integrity (data is not changed without permission), or availability (systems are there when needed). AAA describes access: authentication proves who you are, authorization decides what you may do, and accounting records what you did, which also supports non-repudiation. Good designs use defense in depth (many imperfect layers instead of one wall), least privilege, and zero trust, where no user or device is trusted just for being inside the network. Controls are sorted two ways. By category: technical, managerial, operational, and physical. By type, meaning what the control does to a threat: preventive, deterrent, detective, corrective, compensating, and directive. On the exam, read what the control is doing in the scenario.
Security Concepts and Controls vocabulary
- CIA triad: Confidentiality, integrity, and availability: the three goals of security.
- Non-repudiation: Proof that a specific person took an action, so they cannot deny it later.
- Defense in depth: Layering many controls so that when one fails, another still stops the attacker.
- Zero trust: A model where no user or device is trusted by default, and every request is verified.
- Compensating control: An alternative used when the normal control cannot be put in place.
- Detective control: Finds an incident while or after it happens, such as an IDS alert or a log review.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
After a break-in, a company installs signs at every entrance that say the building is monitored by cameras 24 hours a day.
1. Which of the following control types do the signs represent?
- (A) Corrective
- (B) Deterrent
- (C) Compensating
- (D) Detective
Show answer
(B) Deterrent Signs discourage an attacker from trying. They do not stop, detect, or fix anything, so they are deterrent.
2. A legacy system cannot support MFA, so the security team places it on an isolated network segment and monitors every connection to it. Which of the following best describes this control?
- (A) Directive
- (B) Preventive
- (C) Compensating
- (D) Managerial
Show answer
(C) Compensating The segment and monitoring stand in for the control that cannot be used (MFA), which makes them compensating.
3. A security analyst reviews firewall logs every morning to look for unusual connections. Which of the following control types is the analyst performing?
- (A) Detective
- (B) Preventive
- (C) Deterrent
- (D) Corrective
Show answer
(A) Detective Reviewing logs finds problems that already happened, which is detective.
An attacker changes the dollar amounts in a payroll file without being noticed.
4. Which part of the CIA triad was violated?
- (A) Confidentiality
- (B) Availability
- (C) Integrity
- (D) Non-repudiation
Show answer
(C) Integrity Unauthorized changes to data break integrity.
5. A manager denies sending an email that approved a large purchase. Which of the following would best prove that the manager sent it?
- (A) Encrypting the email with AES
- (B) A digital signature on the email
- (C) Storing the email in a backup
- (D) Sending the email over a VPN
Show answer
(B) A digital signature on the email A digital signature created with the manager's private key provides non-repudiation.
6. A user on the office network is still asked to verify their identity and device health before reaching the payroll app. Which of the following security models is this?
- (A) Perimeter security
- (B) Zero trust
- (C) Implicit trust
- (D) Discretionary access control
Show answer
(B) Zero trust Zero trust verifies every request, even from inside the network.