CompTIA Security+ SY0-701 · Free study guide

Objective 1.2 — Apply foundational security principles

Security design starts by naming the property at risk. Confidentiality limits unauthorized disclosure, integrity protects correctness and authorized change, and availability keeps services and data usable when required. A safeguard can support several properties, but a scenario normally emphasizes one. A database hash check primarily exposes unauthorized modification; redundant capacity primarily supports availability.

Authentication, authorization, and accounting (AAA) answer three different questions: Who or what is the subject? What may it do? What evidence records the activity? Authentication can apply to people, services, workloads, and devices. Authorization should follow verified identity and business policy. Accounting supplies logs and attribution, but logs only help when time, retention, integrity, and review are trustworthy.

Trust must be earned continuously

Zero Trust does not mean “trust nobody” or “remove the network.” It means access is evaluated explicitly using identity, device, resource, context, and policy rather than inherited from network location. The control plane holds policy decisions: an administrator defines policy, an engine evaluates signals, and a decision is produced. The data plane contains subjects, systems, implicit trust zones that should be reduced, and policy-enforcement points that allow or deny the requested action.

A remote employee with valid credentials may still be denied a sensitive application when the device is unmanaged or the request is anomalous. Conversely, an approved service identity can receive a narrowly scoped connection without placing an entire subnet in a trusted zone.

Evidence and accountability

Non-repudiation provides strong evidence that a subject performed an action. Digital signatures can bind a private-key operation to a message when identity proofing, key custody, trust, and audit records are sound. A plain hash detects change but does not prove who created the hash.

A gap analysis compares the current state with a required or target state. It should produce owned actions, not merely a list of missing products. Physical controls—fencing, lighting, guards, badges, cameras, sensors, and access-control vestibules—may close gaps that software cannot.

Deception controls provide early warning. A honeypot is a decoy system, a honeynet is a decoy environment, a honeyfile is a monitored document, and a honeytoken is a fake secret or record. Legitimate users should have no reason to touch them, so interaction can be high-value evidence. They are detection mechanisms, not substitutes for patching or access control.

Decision rule: identify the security property, separate identity from permission and evidence, then place enforcement as close as practical to the protected resource.