Domain 112% of scored content
General Security Concepts
The vocabulary the rest of the exam assumes: control types, the CIA triad and zero trust, why change management is a security process, and how cryptography actually protects data.
4 topics
About 14 minutes of reading
- 1.1Types of security controlsA control is anything that reduces risk. The exam sorts controls two ways at once: by category (who or what carries the control out: technical, managerial, operational, physical) and by type (what the control does in time: prevent, deter, detect, correct, compensate, direct). Most questions hand you one control and ask you to place it on both axes.3 min read
- 1.2Fundamental security conceptsThis objective is the foundation the rest of the exam builds on: the CIA triad, non-repudiation, AAA, gap analysis, zero trust with its control and data planes, physical security, and deception technologies such as honeypots.4 min read
- 1.3Change management and securityUnplanned changes cause outages and open holes. Change management makes every change visible, approved, tested, reversible, and documented, which is why the exam treats it as a security process and not just an IT formality.3 min read
- 1.4Cryptographic solutionsCryptography protects confidentiality, integrity, and authenticity, but only when the right tool is used the right way. This objective covers PKI and certificates, symmetric and asymmetric encryption, hashing and salting, digital signatures, key management hardware, and newer ideas such as blockchain.4 min read