CompTIA Security+ General Security Concepts Syllabus

What is the difference between implicit trust zones and adaptive identity in Zero Trust?

Implicit trust zones are areas where traffic is trusted after passing a control point; adaptive identity uses context (location, device, behavior) to dynamically adjust the trust and authentication requirements for each request.

Name three types of perimeter and barrier controls used in physical security.

Fences, bollards (posts blocking vehicle access), gates, walls, and barricades — physical barriers that define and protect the perimeter.

What is the purpose of a bollard?

A short, sturdy vertical post used to control or prevent vehicle access to an area while still allowing pedestrian traffic, protecting buildings and entrances from ramming attacks.

What are common surveillance and detection technologies in physical security?

Cameras/CCTV (often with motion detection and object recognition), motion sensors, infrared/pressure/microwave sensors, and alarm systems.

What is a key advantage of using a security guard over purely electronic surveillance?

Guards provide human judgment, can adapt to unexpected situations, respond physically, deter intruders, and verify identities — flexibility that automated systems lack. They can also be a single point of failure and are subject to social engineering.

What are access badges and how do they enhance security?

Physical cards (often RFID/proximity or smart cards) that authenticate identity and control entry to facilities or areas, integrating with access control systems and logging entries.

How does lighting function as a security control?

Lighting is a deterrent and detective control that illuminates areas to discourage intruders, improve camera/guard visibility, and reduce hiding places around a facility.

What is the purpose of a visitor log?

A record (paper or electronic) of non-employees entering a facility, capturing identity, time in/out, purpose, and host — supporting accountability, auditing, and incident investigation.

What is an access control vestibule (mantrap)?

A physical space with two interlocking doors where only one can open at a time, preventing tailgating/piggybacking by allowing one authenticated person through at a time.

What is a honeypot?

A decoy system designed to look like a legitimate target to attract attackers, allowing defenders to observe attacker behavior and divert them away from real assets.

What is the difference between a honeypot, a honeynet, and a honeyfile?

A honeypot is a single decoy system; a honeynet is a network of multiple honeypots simulating a real network; a honeyfile is a decoy file (bait) that triggers an alert when accessed.

What is a honeytoken?

A piece of fake data (e.g., a fake credential, record, or API key) planted to detect unauthorized access or data theft when it is used or accessed.

How can business processes impact security when implementing change?

Changes to business processes can introduce vulnerabilities, affect workflows and dependencies, require updated approvals, and may have downtime, legacy application, or restart implications that must be assessed before implementation.

What are common technical implications of a change that must be considered?

Allow/deny list updates, restricted activities, downtime, service/application restarts, legacy application impacts, and dependencies between systems.

Why is a backout (rollback) plan important in change management?

It provides a tested way to revert a change if it fails or causes problems, restoring the system to its prior working state and minimizing downtime.

What is the role of documentation and version control in change management?

Documentation records what was changed, why, and how; version control tracks revisions to configurations, code, and diagrams over time, enabling rollback, auditing, accountability, and reproducibility.

What is Public Key Infrastructure (PKI)?

The framework of hardware, software, policies, and procedures used to create, manage, distribute, store, and revoke digital certificates and public/private key pairs.

What are the main components of PKI?

Certificate Authority (CA), Registration Authority (RA), digital certificates, public and private keys, Certificate Revocation List (CRL)/OCSP, and a certificate repository.

What is key escrow in PKI?

A practice where a trusted third party securely stores a copy of cryptographic keys so they can be recovered if lost or required by authorized parties (e.g., for legal or recovery purposes).

What are the common levels/scopes at which encryption can be applied?

Full-disk, partition, volume, file, database, and record-level encryption — as well as transport/communication encryption (data in transit) versus data at rest.

What is the key difference between symmetric and asymmetric encryption?

Symmetric uses a single shared secret key for both encryption and decryption (fast, scaling/key-distribution challenges). Asymmetric uses a public/private key pair (slower, but solves key distribution and enables digital signatures).

Name two common symmetric encryption algorithms and a typical AES key size.

AES (128, 192, or 256-bit keys) and 3DES (also ChaCha20, Blowfish, Twofish). AES-256 is a common strong standard.

Name two common asymmetric algorithms.

RSA and ECC (Elliptic Curve Cryptography); also Diffie-Hellman (key exchange) and DSA.

Why is ECC preferred over RSA in resource-constrained environments?

ECC provides equivalent security to RSA with much smaller key sizes, requiring less computational power, memory, and bandwidth — ideal for mobile and IoT devices.

How are symmetric and asymmetric cryptography commonly combined (hybrid encryption)?

Asymmetric encryption is used to securely exchange a symmetric session key, then the faster symmetric key encrypts the bulk data — combining secure key distribution with performance.

What is a Trusted Platform Module (TPM)?

A dedicated hardware chip on a device's motherboard that securely stores cryptographic keys, performs cryptographic operations, and supports functions like full-disk encryption and secure boot.

What is the difference between a TPM and an HSM?

A TPM is a chip built into an individual device for that device's keys; an HSM (Hardware Security Module) is a dedicated, often removable/network appliance for high-volume, enterprise-scale key generation, storage, and cryptographic processing.

What is obfuscation, and name three techniques?

Obfuscation hides the true meaning of data/code to make it hard to understand. Techniques: steganography (hiding data within other files/media), tokenization (replacing data with non-sensitive tokens), and data masking (obscuring portions of data).

What is the difference between tokenization and encryption?

Encryption mathematically transforms data using a key and is reversible with that key. Tokenization replaces sensitive data with a random non-sensitive token, with the mapping stored separately in a secure vault — the token has no mathematical relationship to the original.

What is hashing, and name two common hashing algorithms?

Hashing is a one-way function that converts input into a fixed-length unique digest to verify integrity (it cannot be reversed). Common algorithms: SHA-256 (SHA-2 family) and SHA-3; MD5 and SHA-1 are now considered insecure.

What is salting and what attack does it defend against?

Salting adds a random value to a password before hashing so identical passwords produce different hashes. It defends against precomputed rainbow table attacks and makes brute-forcing harder.

How does a digital signature work and what three assurances does it provide?

The sender hashes the message and encrypts the hash with their private key; the recipient decrypts it with the sender's public key and compares hashes. It provides integrity, authentication, and non-repudiation.

What is the difference between a CRL and OCSP?

A Certificate Revocation List (CRL) is a periodically published list of revoked certificates that clients download. OCSP (Online Certificate Status Protocol) lets a client query a responder in real time for the status of a single certificate, reducing latency and bandwidth.

What is a wildcard certificate?

A certificate that secures a domain and all of its first-level subdomains using a single certificate (e.g., *.example.com covers mail.example.com, www.example.com).

What is a Certificate Signing Request (CSR)?

A request generated by an applicant (containing the public key and identifying information) and sent to a Certificate Authority to apply for a digital certificate. The private key is kept secret by the applicant.

What is the difference between a root certificate and a self-signed certificate?

A root certificate is the trust anchor at the top of a CA's chain, used to sign other certificates. A self-signed certificate is signed with its own private key (not a trusted CA), so it isn't automatically trusted by clients.

What is certificate pinning?

A technique where an application is hard-coded to accept only a specific certificate or public key for a host, preventing acceptance of fraudulent certificates issued by a compromised or rogue CA.