CompTIA Security+ General Security Concepts Syllabus

General Security Concepts syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for General Security Concepts in CompTIA Security+, not a summary of it.

1. 1

   Security Controls

   3 topics

   • Control Categories
     • Technical controls
     • Managerial controls
     • Operational controls
     • Physical controls
   • Control Types by Function
     • Preventive and deterrent controls
     • Detective and corrective controls
     • Compensating controls
     • Directive controls
   • Selecting Appropriate Controls for Risk
     • Mapping controls to threats
     • Defense-in-depth layering
2. 2

   Fundamental Security Principles

   5 topics

   • The CIA Triad
     • Confidentiality
     • Integrity
     • Availability
   • Authentication, Authorization, and Accounting (AAA)
     • Authenticating people
     • Authenticating systems
     • Authorization models
     • Accounting and audit trails
   • Non-repudiation
   • Gap Analysis
   • Zero Trust
     • Control plane: adaptive identity, threat scope reduction, policy-driven access
     • Policy decision point and policy engine
     • Data plane: implicit trust zones, subject/system, policy enforcement point
3. 3

   Physical Security

   5 topics

   • Perimeter and Barrier Controls
     • Bollards and fencing
     • Access control vestibules
   • Surveillance and Detection
     • Video surveillance
     • Sensors (infrared, pressure, microwave, ultrasonic)
   • Access Badges and Lighting
   • Security Guards and Visitor Logs
   • Honeypots and Deception Technology
     • Honeypots and honeynets
     • Honeyfiles and honeytokens
4. 4

   Change Management

   3 topics

   • Business Processes Impacting Security
     • Approval process and ownership
     • Stakeholders and impact analysis
     • Test results and backout plans
     • Maintenance windows and standard operating procedures
   • Technical Implications of Change
     • Allow/deny lists and restricted activities
     • Downtime, service/application restarts
     • Legacy applications and dependencies
   • Documentation and Version Control
     • Updating diagrams and policies/procedures
     • Version control
5. 5

   Cryptographic Solutions

   7 topics

   • Public Key Infrastructure (PKI)
     • Public and private keys
     • Key escrow
   • Encryption Levels and Scope
     • Full-disk and partition encryption
     • File, volume, and database encryption
     • Transport/communication and record-level encryption
   • Symmetric and Asymmetric Cryptography
     • Key exchange
     • Algorithm and key length selection
   • Cryptographic Tools
     • Trusted Platform Module (TPM)
     • Hardware Security Module (HSM)
     • Key management systems and secure enclave
   • Obfuscation Techniques
     • Steganography
     • Tokenization
     • Data masking
   • Hashing, Salting, and Digital Signatures
     • Hashing and salting
     • Digital signatures
     • Key stretching and blockchain/open public ledger
   • Certificates
     • Certificate authorities and CRLs/OCSP
     • Certificate signing requests (CSR)
     • Wildcard and self-signed certificates

General Security Concepts flashcards for CompTIA Security+

24 of 57 cards from the General Security Concepts deck — real questions with worked answers.

1. What are the four control categories defined in CompTIA Security+?

   Technical (implemented through technology/systems), Managerial (administrative policies and oversight), Operational (carried out by people day-to-day), and Physical (tangible measures protecting facilities).

2. List the six control types classified by function.

   Preventive, Deterrent, Detective, Corrective, Compensating, and Directive.

3. What is the difference between a preventive control and a deterrent control?

   A preventive control actively stops an incident from occurring (e.g., a firewall, locked door). A deterrent control discourages an attacker from attempting it (e.g., warning signs, visible cameras) but does not physically block them.

4. What is a corrective control, and give an example?

   A corrective control restores systems or limits damage after an incident has occurred. Examples: restoring from backup, applying a patch, or invoking an incident response/disaster recovery plan.

5. What is a compensating control?

   An alternative control put in place when the primary/recommended control cannot be implemented, providing a comparable level of protection (e.g., network segmentation when a legacy system can't be patched).

6. What is a directive control?

   A control that directs, guides, or mandates behavior to achieve compliance, such as policies, standards, acceptable use agreements, and procedures.

7. A camera that records intruders falls under which control type by function?

   Detective (it identifies/records an incident). A visible camera can also act as a deterrent.

8. When selecting appropriate controls for a risk, what key factors should be balanced?

   The value of the asset, the likelihood and impact of the threat, the cost of the control versus the risk reduction it provides, and ensuring the control's cost does not exceed the asset's value (defense in depth/layering).

9. What does the CIA Triad stand for?

   Confidentiality, Integrity, and Availability — the three core principles of information security.

10. Define Confidentiality in the CIA Triad and name a control that supports it.

    Ensuring information is accessible only to authorized parties. Supported by encryption, access controls, and steganography/obfuscation.

11. Define Integrity in the CIA Triad and name a mechanism that verifies it.

    Ensuring data is accurate and unaltered. Verified using hashing, checksums, and digital signatures.

12. Define Availability in the CIA Triad and give an example control.

    Ensuring systems and data are accessible to authorized users when needed. Supported by redundancy, fault tolerance, backups, and load balancing.

13. What does AAA stand for in security, and what does each component do?

    Authentication (verifying identity), Authorization (granting permissions/access rights), and Accounting (logging and tracking user actions and resource usage).

14. What is the difference between authentication and authorization?

    Authentication proves who you are (verifying identity). Authorization determines what you are allowed to do (the resources and actions you may access) after identity is established.

15. What is non-repudiation, and which cryptographic tool provides it?

    Non-repudiation ensures a party cannot deny having performed an action or sent a message. It is provided by digital signatures (and supporting audit logs).

16. What is a gap analysis in security?

    A process of comparing an organization's current security posture against a desired state or required standard (baseline) to identify the differences (gaps) that need remediation.

17. What is the core principle of a Zero Trust architecture?

    "Never trust, always verify" — no user or device is trusted by default, whether inside or outside the network; every access request is authenticated, authorized, and continuously validated.

18. In Zero Trust, what are the Control Plane and the Data Plane?

    The Control Plane defines policies and makes access decisions (Policy Engine, Policy Administrator, adaptive identity, policy-driven access control). The Data Plane enforces those decisions and handles the actual data flow (Policy Enforcement Point, subject/system).

19. In Zero Trust, what is the Policy Decision Point composed of?

    The Policy Engine (evaluates and decides access based on policy) and the Policy Administrator (establishes/terminates the communication path and issues access tokens).

20. What is a Policy Enforcement Point (PEP) in Zero Trust?

    The component that enables, monitors, and terminates connections between a subject and a resource, enforcing the decision made by the Policy Decision Point.

21. What is the difference between implicit trust zones and adaptive identity in Zero Trust?

    Implicit trust zones are areas where traffic is trusted after passing a control point; adaptive identity uses context (location, device, behavior) to dynamically adjust the trust and authentication requirements for each request.

22. Name three types of perimeter and barrier controls used in physical security.

    Fences, bollards (posts blocking vehicle access), gates, walls, and barricades — physical barriers that define and protect the perimeter.

23. What is the purpose of a bollard?

    A short, sturdy vertical post used to control or prevent vehicle access to an area while still allowing pedestrian traffic, protecting buildings and entrances from ramming attacks.

24. What are common surveillance and detection technologies in physical security?

    Cameras/CCTV (often with motion detection and object recognition), motion sensors, infrared/pressure/microwave sensors, and alarm systems.

See more General Security Concepts flashcards →

Planning General Security Concepts for CompTIA Security+

General Security Concepts (CompTIA Security+) FAQ