Study General Security Concepts for Security+ (SY0-701)

This chapter sets the vocabulary and decision patterns that the rest of Security+ keeps reusing. CompTIA is not asking for a list of definitions here. It is testing whether you can classify a control correctly, recognize what a secure design principle is trying to protect, understand why formal change management matters, and choose the right cryptographic building block for the job.

CIA: Confidentiality, integrity, and availability, the core security objectives Security+ keeps returning to.

AAA: Authentication, authorization, and accounting.

PKI: Public key infrastructure, the certificate and trust-chain system behind many identity and encryption scenarios.

Current weight in the objectives

CompTIA currently weights this domain at 12% of the Security+ exam. It is the lightest domain, but it creates many of the distinctions that support stronger performance later.

Work this domain in order

Start with 1.1 Security Controls, then move to 1.2 Security Principles & Zero Trust, 1.3 Change Management, and 1.4 Cryptographic Solutions.

Fast routing inside this chapter

Common Security+ traps

• treating a control category like a product category
• confusing confidentiality with integrity
• talking about change implementation without discussing testing, approval, or rollback
• mixing up encryption, hashing, and digital signatures

Where this domain shows up later

This is the lightest domain by weight, but it leaks into almost every other chapter:

• zero trust and least-privilege logic reappear in identity, segmentation, and cloud questions
• change management shows up whenever a safer rollout or rollback path matters
• cryptography vocabulary appears again in secure access, privacy, data protection, and recovery questions

If you keep missing later scenario questions because two answers both sound “secure,” come back here and tighten the principles before you do more mixed practice.

If the terms in this chapter still feel blurry, use the glossary before moving forward. Many later misses start as basic vocabulary confusion here.

In this section

• Compare Security Controls for Security+ (SY0-701)
  Learn how Security+ classifies technical, managerial, operational, physical, preventive, detective, corrective, compensating, deterrent, and directive controls.
• Explain Security Principles and Zero Trust for Security+ (SY0-701)
  Understand CIA, AAA, non-repudiation, zero trust, and deception technology well enough to apply them correctly in Security+ scenarios.
• Use Change Management Safely for Security+ (SY0-701)
  Understand approval, testing, rollback, documentation, and version-control decisions for the Security+ change-management objectives.
• Use Cryptographic Solutions for Security+ (SY0-701)
  Understand PKI, encryption, hashing, digital signatures, obfuscation, and certificate workflows for the cryptography objectives on Security+.