In this chapter

1The CIA Triad & Non-Repudiation

Almost every "what security goal is this?" question on the exam is testing whether you can tell confidentiality, integrity, and non-repudiation apart. They sound similar in casual conversation but protect against completely different failures.

• Confidentiality — keeping data unreadable to unauthorized parties. Encryption at rest is the standard answer whenever a scenario mentions physical theft of a device or drive.
• Integrity — verifying data hasn't been altered. Comparing a downloaded file's hash to the publisher's published hash is the textbook integrity check.
• Availability — the third, unspoken member of the triad: systems and data must be accessible when legitimately needed. Almost every backup and redundancy topic later in this chapter exists purely to protect availability.
• Non-repudiation — proof that someone can't credibly deny having performed a specific action, usually established through digital signatures and cryptographic evidence.

2Access Control Models & Principles

Separate from any specific technology, these are the philosophies that decide who gets access to what, and they show up constantly as "which principle is this?" questions.

• Zero Trust — "never trust, always verify": every access request is authenticated and authorized continuously, regardless of whether it originates inside or outside the traditional network perimeter.
• Role-Based (RBAC) — access granted purely by an assigned role or group.
• Attribute-Based (ABAC) — access granted by combining multiple attributes at once (job title and department and time of day, for example).
• Mandatory Access Control (MAC) — enforces clearance-based restrictions independently of whether the login credentials are otherwise valid — a legitimately authenticated user still can't cross a clearance boundary.
• Least privilege — accounts start with no more access than the role strictly needs, granted deliberately rather than inherited by default.
• Need to know — an additional, narrower filter on top of a role: access to one specific sensitive item (like a merger project) only because it's directly relevant to the current task.
• Separation of duties — splits one critical action across multiple people acting simultaneously (dual approval, two-person integrity at a vault).
• Job rotation — moves a single person through different roles over time, surfacing fraud or errors a person might otherwise hide indefinitely in one seat.

3Authentication Factors & MFA

Three categories, and multi-factor authentication only counts when you combine different categories — not two instances of the same one.

• Something you know — a password, a PIN, a security question.
• Something you have — a registered phone receiving a push notification, a hardware security key.
• Something you are — a biometric trait: fingerprint, iris scan.
• MFA requires a second, independent factor from a different category, so a compromised password alone can't get an attacker in.

4Cryptographic Fundamentals

This is the single most trap-heavy topic in Domain 1: hashing, encryption, and tokenization all "transform data," and the exam relies on you knowing exactly how each one is reversed (or isn't).

• Hashing — one-way; mathematically impossible to reverse back into the original value. This is exactly why passwords are hashed rather than encrypted.
• Encryption — reversible with the correct key. Symmetric encryption (one shared key) is fast and suited to bulk data; asymmetric encryption (public/private key pairs) is slower but ideal for securely exchanging that shared key — the hybrid approach TLS itself uses.
• Tokenization — replaces sensitive data with a random value that has no mathematical relationship to the original; the real value lives in a separate secure vault. There's no formula to reverse it, unlike encryption.
• Obfuscation — makes legitimate code or data harder to read/reverse-engineer without changing what it does (e.g., renaming variables to meaningless strings before release).
• Salting — adds a unique random value to each password before hashing, so identical passwords don't produce identical hashes, defeating precomputed rainbow-table attacks.
• Key stretching — deliberately slows down the hashing computation itself (bcrypt, PBKDF2), making large-scale brute-force cracking impractically expensive.
• Perfect forward secrecy — each session uses temporary, ephemeral keys not derived from the server's long-term private key, so a stolen private key years later still can't decrypt old recorded sessions.
• Homomorphic encryption — allows computation directly on encrypted data, producing an encrypted result, without ever decrypting the data itself.

5PKI & Digital Certificates

Public Key Infrastructure questions almost always reduce to one question: can trust actually be established here, and if not, why not?

• The CSR/CA flow — an administrator generates a Certificate Signing Request containing the public key and identity details (the private key stays local and is never sent); the CA verifies that identity and issues a signed certificate.
• Certificate pinning — an application hardcodes a specific certificate (or its public key), rejecting any other certificate even one issued by a technically valid, trusted CA. This defends against fraudulently issued certificates that pass normal trust checks.
• Revocation (CRL / OCSP) — lets a certificate be instantly invalidated before its natural expiration, since revocation status isn't stored in the certificate itself; the client has to actively check a CRL or query an OCSP responder.
• Code signing, S/MIME, and vendor hash+signature verification — the same trust logic applied to software packages, email, and update packages respectively: cryptographically proving both origin and that nothing was tampered with in transit.

6Key Management & Hardware-Based Cryptography

Where and how keys themselves are generated, stored, and eventually retired — a step up in abstraction from the cryptography itself.

• Key management lifecycle — the umbrella process: generating keys, rotating them on a schedule, and securely destroying old ones once retired.
• Hardware Security Module (HSM) — dedicated, centralized hardware serving many systems, generating/storing/using keys without ever exposing the raw private key outside the device.
• Secure enclave — a protected hardware region isolated within a single device's own processor (typically mobile), doing the same job as an HSM but at device scale rather than centrally.
• Key escrow — securely stores a recoverable copy of a key with documented recovery procedures, so encrypted data can still be accessed years later even if the original administrator has left.
• Cryptographic agility — lets an organization swap out a weakening algorithm for a stronger one without a major system redesign, keeping the strategy resilient as computing power advances.
• Root CA / intermediate CA delegation — the root's highly sensitive private key stays offline and rarely used, while a subordinate CA handles routine day-to-day certificate issuance — limiting the root key's exposure.

7Deception Technology

CompTIA groups these under the umbrella term "disruption technology" — tools whose specific job is to waste an attacker's time and resources, not merely to detect them, though detection is usually a side effect.

• Honeytoken — a single, small piece of fake data (like a planted credential) seeded to trigger an alert the moment it's used.
• Honeyfile — a single fake, tempting-looking document (e.g., passwords_backup.xlsx) with no legitimate purpose; any access to it is inherently suspicious.
• Honeypot — an entire decoy system, not just one item, designed to look valuable and attract an attacker's attention.
• Honeynet — multiple interconnected decoy systems, wasting an attacker's time and automated tools navigating a fully fake environment.

8Physical Security Controls

A cluster of "match the control to the exact threat" questions — the exam almost always names a very specific physical threat, and only one option actually addresses it.

• Mantrap (access control vestibule) — one door must fully close before the next opens, physically preventing tailgating.
• Microwave sensor — detects movement across a large open area without needing any physical barrier, ideal for open perimeters.
• Bollards — short, sturdy posts specifically built to stop a vehicle from ramming through an entrance.
• Glass break sensor — detects the specific sound/vibration signature of breaking glass, for ground-floor windows.
• Cable lock — a physical device securing a laptop to a desk, preventing simple grab-and-go theft.

9Control Categories & Functional Types

The two-axis system that runs through the entire exam: what kind of control is it (technical / administrative / physical), and what does it actually do (preventive / detective / deterrent / directive / corrective / compensating)?

• Directive — tells people what they must do via policy (e.g., "report incidents within one hour"). It instructs behavior; it doesn't detect or technically enforce anything.
• Detective — identifies and records that something happened, after the fact (a badge log, a camera recording). It doesn't stop the event.
• Deterrent — discourages unauthorized behavior through visible presence or psychological effect (a guard station, a warning banner) without technically stopping a determined attacker.
• Preventive — physically or technically blocks the action before it can happen (a locked mantrap door, a required multi-approval process).

10Data States, Classification & Disposal

The same confidentiality goal, applied to data at three different points in its life — plus the housekeeping that has to happen before and after.

• Data classification — labeling data (Public / Internal / Confidential / Restricted) so protection can be matched to actual sensitivity rather than treating everything identically.
• Data at rest — stored data (on a disk or in a database), protected primarily by encryption at rest.
• Data in transit — data actively moving across a network (e.g., between a browser and a server), protected primarily by TLS.
• Data in use — data actively being processed in memory or by the CPU, protected by mechanisms like a secure enclave that encrypts it even during active computation.
• Data inventory — a complete catalog of all the information an organization stores, the foundational exercise that has to happen before classification or protection policy can be applied at all.
• Secure disposal / media sanitization — physically shredding documents or wiping decommissioned drives so data can't be recovered after disposal.

11Resilience, Backups & Redundancy

Availability's toolbox: how organizations keep running (or come back quickly) when something fails.

• Hot site — a live, fully synchronized backup facility that can take over instantly with zero data loss.
• Warm site — some infrastructure is ready, but additional setup and synchronization time is needed before full takeover — slower than hot, faster than cold.
• Geographic dispersion — a fully redundant, geographically distant copy kept in near-real-time sync, so a regional disaster can't take out both copies at once.
• Full + differential backup — a full backup on a fixed schedule (e.g., every Sunday), with each subsequent backup capturing everything changed since that last full backup — not since the previous day.
• Incremental backup — captures only what changed since the previous backup of any kind, resulting in smaller daily backups but a longer restore chain.
• Recovery Point Objective (RPO) — the maximum acceptable amount of data loss, measured in time ("we can lose up to 1 hour of data").
• Full redundancy / no single point of failure — redundant power, network paths, and servers all active simultaneously, so any one component's failure doesn't bring the whole system down.

12Governance: Change Management, Policies & Playbooks

The paperwork side of security — but paperwork the exam expects you to be able to name precisely.

• Change management — documenting a proposed change, getting formal approval, and preparing a rollback plan before touching production systems.
• Emergency change management — the same idea, but with a faster path and specific approval authority defined in advance for urgent situations.
• Acceptable Use Policy (AUP) — defines how company resources (like laptops) may and may not be used, including prohibiting unauthorized software.
• Playbook — a set of steps for a specific known event type, including conditional branches based on findings ("if X, do Y; if Z, do W").
• Preparation (incident response phase) — defining escalation paths, contact lists, and severity classifications before any incident occurs.
• Incident severity classification framework — documented, consistent criteria distinguishing a "critical" incident from a "low" one, so different analysts classify the same way.

13Cloud, Federation, Identity & Vendor Governance

Who's responsible for what once systems, identities, and vendors span multiple organizations.

• Shared responsibility model (SaaS) — the provider manages underlying infrastructure and hardware; the customer retains responsibility for managing user access and classifying their own data within the application.
• Contractual responsibility matrix — a formal, written agreement mapping exactly which security responsibilities belong to each party, specific to the service model used (IaaS / PaaS / SaaS).
• Federation — authenticating using an existing account from a trusted third-party identity provider, extending trust across organizational boundaries.
• Network Access Control (NAC) — checks a device's posture (patch level, antivirus status) before admitting it onto the network.
• MDM with remote wipe — remotely revokes a lost device's access and erases corporate data without needing physical recovery.
• Conditional access policy — automatically suspends or restricts access based on defined conditions, such as failing a device compliance check.
• Vendor/tool vetting process — formally evaluates whether a new technology is safe to introduce before any employee starts using it.
• Onboarding verification gates & offboarding equipment checklist — the same governance principle (verify before a status change) applied at opposite ends of employment: background checks must clear before sensitive access is granted; equipment must be returned before the final paycheck.
• CVE — a standardized, public reference number for a specific, publicly disclosed vulnerability, distinct from any company's internal patch-tracking ID.