Overview
Security is 19% of the CompTIA Tech+ exam and has five objectives: fundamental security concepts and frameworks (confidentiality, integrity, availability, privacy, authentication, authorization, accounting and nonrepudiation), methods to secure devices and security best practices, password best practices, common use cases for encryption, and configuring security settings for a small wireless network.
The perspective is an informed user or small-office technician, not a security analyst. You must recognize a phishing message, choose multifactor authentication correctly, apply least privilege, judge software sources and licenses, set sensible password rules, know when data at rest or in transit needs encryption, and configure a router with a new SSID, a changed default password and WPA2 or WPA3. It draws on the wireless material in Infrastructure, the permissions and browser settings in Applications and Software, and the data value ideas in Data and Database Fundamentals.
How it's tested
Expect a mix of concept identification (which part of the CIA triad or AAA a control supports), scenario judgment (what a user should do with a suspicious email or an invalid certificate warning), and configuration choices for passwords, encryption and a small wireless network. BEST and MOST secure wording is common, so compare options on actual protection rather than familiarity.
-
Classify the control
A control such as a log, a permission, a fingerprint scan or a backup is described, and you name the concept it supports: confidentiality, integrity, availability, authentication, authorization, accounting or nonrepudiation.
-
Spot and respond to a threat
A message, pop-up, download or certificate warning is described, and you identify the threat (often social engineering) and the safe response.
-
Choose the strongest configuration
Options for passwords, encryption or Wi-Fi settings are listed, and you choose the one that gives real protection, such as WPA3 over an open network with a renamed SSID.
A login asks for a password and then a four-digit PIN. Is this multifactor authentication? Ask which category each item belongs to. A password and a PIN are both something you know, so this is single-factor authentication with two steps. Adding a code from an authenticator app, something you have, or a fingerprint, something you are, would make it multifactor.
Objectives 5
Official objectives from the CompTIA outline, in outline order.
6.1 Explain fundamental security concepts and frameworks.CIA triad, privacy, authentication, authorization, accounting and nonrepudiation.
- What it means
- Confidentiality keeps data from unauthorized eyes, integrity keeps it accurate and unaltered, and availability keeps it accessible when needed. Privacy covers how personal data, including PII, is shared on social networks, email, file sharing and messaging, and rules such as GDPR and cookie consent. Authentication (single factor, multifactor, single sign-on) proves identity, authorization (permissions, administrator vs. user accounts, least privilege) grants access, accounting (logs, location tracking, browser history) records activity, and nonrepudiation prevents someone denying an action.
- What to understand
- Authentication answers who you are, authorization answers what you may do, and accounting answers what you did. Multifactor means factors from different categories: something you know, have or are. Least privilege gives each account only the access its job needs, which is why daily work should use a standard user account rather than an administrator account.
- How it shows up
- A control is described, such as a door log, a read-only folder permission or a fingerprint reader, and you name the concept; or a login setup is described and you decide whether it is truly multifactor.
- Common confusion
- Candidates mix up authentication and authorization because both happen at login. Proving identity is authentication; the permissions applied afterwards are authorization.
6.2 Explain methods to secure devices and security best practices.Social engineering, device protections, licensing, software sources, certificates and privacy.
- What it means
- Device security combines user awareness of social engineering and phishing with technical controls: authentication, anti-malware, firewalls, patching and updates, and physical cable or USB locks. Best practices also include using licensed software (open source vs. proprietary; subscription, one-time purchase or perpetual), obtaining software from OEM websites or official app stores rather than untrusted third-party sites, removing unwanted or malicious software, avoiding piracy, heeding invalid certificate warnings, and thinking about privacy when using social networks, messaging and AI tools.
- What to understand
- Phishing relies on urgency, a spoofed sender and a link or attachment; verify through a separate, known channel before acting. Patches close known vulnerabilities, so delaying updates leaves devices exposed. An invalid certificate warning means the site's identity could not be verified, so do not enter credentials.
- How it shows up
- A user receives an urgent email asking them to confirm a password, sees a browser certificate warning on a banking site, or wants free software from a download portal, and you choose the safest response.
- Common confusion
- Candidates think open source means unlicensed or free to use any way. Open source software still carries a license that sets terms of use and redistribution.
6.3 Explain password best practices.Length, complexity, history, expiration, reuse, managers, resets and default credentials.
- What it means
- Good password practice covers length, complexity, password history (blocking reuse of recent passwords), expiration policies, never reusing passwords across sites, using a password manager, keeping passwords private, verifying identity during reset processes, changing default usernames and passwords, and enabling passwords on devices that ship without them.
- What to understand
- Length adds the most strength, which is why long passphrases are recommended. Reusing a password means one breached site exposes every account that shares it. A password manager makes unique, long passwords practical, and default credentials on routers, cameras and IoT devices are publicly documented, so they must be changed at setup.
- How it shows up
- A scenario asks which policy most improves security, why one site's breach compromised a user's other accounts, or what to do first after installing a new device.
- Common confusion
- Candidates assume forced frequent expiration is the strongest control. Length and uniqueness protect more, and frequent forced changes tend to produce weak, predictable passwords.
6.4 Identify common use cases for encryption.Plaintext vs. ciphertext, data at rest and data in transit.
- What it means
- Encryption turns readable plaintext into unreadable ciphertext that only a key holder can decrypt. Data at rest is protected with file-level encryption, full-disk encryption and mobile device encryption; data in transit is protected with encrypted email, HTTPS for web traffic, a VPN for network connections, and encrypted mobile application traffic.
- What to understand
- Match the protection to the state of the data: a stolen laptop needs disk encryption, public Wi-Fi needs HTTPS or a VPN, and sending a sensitive attachment needs email encryption. Encryption protects confidentiality; it does not stop data from being deleted.
- How it shows up
- A scenario describes a lost phone, an employee on hotel Wi-Fi, or a site login page, and asks which encryption use case applies.
- Common confusion
- Candidates think HTTPS protects files stored on the server or laptop. HTTPS protects data while it travels; stored data needs encryption at rest.
6.5 Given a scenario, configure security settings for a small wireless network.Change the SSID and default password; choose open, PSK, WPA, WPA2 or WPA3.
- What it means
- Securing a small wireless network means changing the default SSID, changing the router's default administrator password, and choosing a security mode: open (no encryption), pre-shared key (one passphrase for all users), WPA, WPA2 or WPA3.
- What to understand
- WPA3 is the strongest option, WPA2 with AES is the acceptable minimum where devices lack WPA3, and the original WPA is outdated. Open networks send traffic unencrypted over the air. Renaming the SSID avoids revealing the router model but does not encrypt anything, so it must be combined with WPA2 or WPA3 and a changed admin password.
- How it shows up
- A scenario describes a newly installed router or a neighbor using the office Wi-Fi, and asks which combination of settings to apply.
- Common confusion
- Candidates treat changing the SSID as a security control on its own. It only changes the network's name; encryption and the admin password provide the protection.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
CIA triad
Confidentiality restricts who can see data, integrity ensures it is not altered without authorization, and availability ensures authorized users can reach it when needed.
- Remember
- Encryption supports confidentiality, hashing and signatures support integrity, and backups and redundancy support availability.
- Tested as
- Classification questions ask which part of the triad a control or attack affects.
- Trap
- Labeling a backup as a confidentiality control instead of availability.
-
Authentication, authorization, accounting (AAA)
Authentication verifies identity, authorization determines what that identity may access, and accounting records what was done.
- Remember
- Login proves who; permissions decide what; logs show what happened.
- Tested as
- A recurring concept-matching question across the domain.
- Trap
- Calling file permissions authentication.
-
Multifactor authentication
Combining factors from different categories: something you know (password, PIN), something you have (phone, token) and something you are (fingerprint, face).
- Remember
- Two items from the same category, such as a password and a PIN, are still single factor.
- Tested as
- Login-scenario questions about whether MFA is truly in place.
- Trap
- Accepting a password plus a security question as multifactor.
-
Single sign-on
One authentication gives access to multiple connected applications without logging in to each separately.
- Remember
- SSO improves convenience and reduces password fatigue, but one compromised login exposes every linked app, so pair it with MFA.
- Tested as
- Appears alongside single factor and multifactor in objective 6.1.
- Trap
- Confusing SSO with password reuse across unrelated sites.
-
Least privilege
Each account receives only the permissions needed for its tasks, and administrative rights are used only when required.
- Remember
- Daily work belongs in a standard user account, which limits what malware can do.
- Tested as
- Authorization scenarios and account-type choices.
- Trap
- Granting administrator rights to solve a single access problem.
-
Nonrepudiation
Assurance that someone cannot credibly deny having performed an action, typically through digital signatures and tamper-resistant logs.
- Remember
- It proves who did something, after the fact.
- Tested as
- Identification within security concepts and frameworks.
- Trap
- Confusing it with authentication, which proves identity at the moment of access.
-
PII and GDPR
Personally identifiable information, such as names, addresses and ID numbers, identifies an individual; the EU's GDPR regulates how organizations collect, use and protect personal data, which is why sites ask for cookie consent.
- Remember
- Share PII only when necessary, and recognize cookie consent banners as a privacy requirement.
- Tested as
- Privacy questions across social media, email, file sharing and messaging.
- Trap
- Assuming privacy rules apply only to financial data.
-
Phishing and social engineering
Manipulating people into revealing information or taking unsafe actions, commonly through urgent emails with spoofed senders and malicious links or attachments.
- Remember
- Verify requests through a separate, known contact method; never use the link or number in the suspicious message.
- Tested as
- The most common threat scenario in objective 6.2.
- Trap
- Trusting a message because it shows a familiar logo or display name.
-
Software licensing
Open source code can be viewed and modified under its license, proprietary software restricts source access and use, and licenses may be subscriptions, one-time purchases or perpetual rights to a version.
- Remember
- Every license, open source included, sets terms; product keys and serial numbers prove a valid purchase.
- Tested as
- Licensing and piracy questions in device best practices.
- Trap
- Assuming a subscription grants continued use after payments stop.
-
Certificates
A digital certificate lets the browser confirm a site's identity and set up an encrypted HTTPS connection.
- Remember
- An invalid or expired certificate warning means identity is unverified, so do not enter credentials.
- Tested as
- Safe-browsing scenarios with browser warnings.
- Trap
- Clicking through the warning because the site looks familiar.
-
Password length and reuse
Each added character multiplies the number of guesses an attacker needs, and unique passwords stop one breach from exposing other accounts.
- Remember
- Prefer long passphrases and a password manager over short complex passwords reused across sites.
- Tested as
- Policy questions in objective 6.3.
- Trap
- Choosing frequent forced expiration as the single best improvement.
-
Data at rest vs. in transit
Data at rest sits on storage and is protected by file, disk or device encryption; data in transit moves across networks and is protected by HTTPS, VPNs and encrypted email.
- Remember
- Stolen device: at rest. Public Wi-Fi: in transit.
- Tested as
- Every encryption use-case question begins by deciding the data's state.
- Trap
- Choosing a VPN to protect files on a stolen laptop.
-
WPA2 vs. WPA3
WPA2 uses AES encryption and remains widely used; WPA3 adds stronger protection for passphrase-based networks against offline password guessing.
- Remember
- Choose WPA3 when every device supports it; otherwise WPA2 with AES; never open or original WPA for a private network.
- Tested as
- The core decision in objective 6.5 scenarios.
- Trap
- Treating a renamed or hidden SSID as a substitute for encryption.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Authentication vs. authorization vs. accounting vs. nonrepudiation
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Authentication | Verifying an identity | Answers who are you | Calling permissions authentication |
| Authorization | Granting access based on identity | Answers what may you do | Giving admin rights where a permission change is enough |
| Accounting | Recording activity in logs and history | Answers what did you do | Thinking logs prevent actions rather than record them |
| Nonrepudiation | Proof that an action cannot be denied | Ties an action to an identity afterward | Treating it as identical to authentication |
Single factor vs. multifactor vs. single sign-on
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Single factor | One or more proofs from the same category | Password plus PIN is still one factor | Counting steps instead of categories |
| Multifactor | Proofs from two or more categories: know, have, are | A stolen password alone is not enough | Accepting two knowledge items as MFA |
| Single sign-on | One login unlocks many connected apps | About convenience across systems, not factor count | Assuming SSO is inherently multifactor |
Encryption at rest vs. in transit
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| At rest: file level | Individual files or folders encrypted | Protects selected sensitive files | Assuming it protects the rest of the drive |
| At rest: disk level and mobile device | Whole drive or device encrypted | Protects everything if the device is lost or stolen | Thinking it protects data sent over the network |
| In transit: HTTPS | Encrypts traffic between browser and website | Protects one site's session | Believing it proves the site is trustworthy |
| In transit: VPN | Encrypted tunnel for all traffic to a trusted endpoint | Protects every app on untrusted networks | Using it to protect files stored on a device |
Open vs. WPA vs. WPA2 vs. WPA3
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Open | No password and no over-the-air encryption | Anyone nearby can join and capture traffic | Thinking a hidden or renamed SSID makes it safe |
| WPA | Original Wi-Fi Protected Access | Outdated and weak by current standards | Choosing it because it is better than open |
| WPA2 | AES-based protection, widely supported | Acceptable minimum for older devices | Overlooking WPA3 when every device supports it |
| WPA3 | Current standard with stronger passphrase protection | The strongest option listed | Assuming every older client can connect to it |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Two knowledge items called MFA
- What candidates pick
- Multifactor for a login that asks for a password and then a security question or PIN.
- Why it looks right
- There are two separate prompts, so it feels like two factors.
- Why it's wrong
- Both items are something you know; multifactor requires different categories, such as a password plus an authenticator code or fingerprint.
Clue to watch for List each prompt and its category; if all are knowledge, it is single factor.
-
Renaming the SSID as protection
- What candidates pick
- Changing or hiding the SSID to stop neighbors using the Wi-Fi.
- Why it looks right
- Changing the SSID is listed as a security step and is easy to do.
- Why it's wrong
- The SSID is only the network's name; without WPA2 or WPA3 and a strong passphrase, traffic is open to anyone in range.
Clue to watch for The scenario asks for the setting that stops unauthorized access or protects traffic.
-
Wrong data state for encryption
- What candidates pick
- A VPN or HTTPS to protect files on a laptop that might be stolen.
- Why it looks right
- VPN and HTTPS are well-known encryption tools.
- Why it's wrong
- They protect data in transit; a stolen device needs encryption at rest, such as full-disk encryption.
Clue to watch for Words such as lost, stolen or stored point to data at rest.
-
Trusting the familiar sender
- What candidates pick
- Clicking a password-reset link in an urgent email that shows the company's logo.
- Why it looks right
- The branding and display name look legitimate, and the message warns of account lockout.
- Why it's wrong
- Logos and display names are easy to spoof; urgency plus a credential request is a phishing pattern, so verify through a known channel.
Clue to watch for Urgency, an unexpected request for credentials, or a link whose address does not match the company domain.
-
Expiration over length
- What candidates pick
- Requiring password changes every 30 days as the best single improvement.
- Why it looks right
- Frequent changes feel proactive, and many workplaces have used them.
- Why it's wrong
- Short expiration cycles push users toward predictable variations; longer unique passphrases and a password manager raise strength more.
Clue to watch for The options include longer minimum length, unique passwords or a password manager.
-
Third-party download portal
- What candidates pick
- A free download site offering a paid application, or a utility bundled with extras.
- Why it looks right
- It is quick and saves money.
- Why it's wrong
- Unofficial sources can bundle malware or pirated copies; OEM websites and official app stores provide genuine, licensed software.
Clue to watch for The source is not the vendor or an official store, or the offer is free for normally paid software.
-
Administrator account for daily use
- What candidates pick
- Giving a user a local administrator account so they never need help installing software.
- Why it looks right
- It removes friction and support calls.
- Why it's wrong
- It violates least privilege; anything the user runs, including malware, inherits full control of the system.
Clue to watch for The user's job does not require system changes, or the question asks for the MOST secure account setup.
Answer framework
Use these steps for Security questions, from concept matching to wireless configuration.
- Identify what the question protects or classifies: identity, access, records, data stored on a device, data moving across a network, or the wireless network itself.
- Map the control to its concept: CIA triad element, authentication, authorization, accounting or nonrepudiation, or the correct data state for encryption.
- For threats, look for social engineering signals such as urgency, unexpected credential requests, spoofed senders, unofficial downloads and certificate warnings.
- For configurations, prefer the strongest listed option that devices support: multifactor, long unique passwords, WPA3 and changed defaults.
- Reject answers that only look secure, such as renaming an SSID, adding a second password or granting administrator rights.
Practice question
Want more like this? The CompTIA Tech+ practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with security concepts and frameworks, because every other objective uses their vocabulary. Build a one-page grid of the CIA triad and AAA with two real examples each, and drill the three authentication factor categories until you can classify any login method instantly.
Next, cover device security and best practices, the broadest objective. Group it into threats (phishing, malicious content), technical protections (anti-malware, firewall, patching, locks) and software hygiene (licensing, sources, removal, certificates). Commonly underestimated areas are licensing types and the response to an invalid certificate warning.
Then study password best practices and encryption together. For encryption, decide for each scenario whether the data is at rest or in transit before choosing a tool. For passwords, focus on length, uniqueness, managers and changing default credentials.
Finish with wireless security, revisiting Infrastructure's Wi-Fi material first, then ranking open, WPA, WPA2 and WPA3. Afterwards, practice BEST and MOST secure questions, eliminating options that only appear secure, and take a full-length practice exam, since security reasoning also surfaces in scenarios across other domains.
FAQ
How much of the Tech+ exam is Security?
Security is 19%, the second-largest domain after Infrastructure, roughly 13 questions if applied to the 70-question maximum. The count is a planning estimate, since CompTIA publishes only percentages.
Is Tech+ Security as deep as Security+?
No. Tech+ tests security from an informed end user's perspective: concepts, safe habits, passwords, encryption use cases and home or small-office Wi-Fi. Security+ goes much deeper into threats, architecture and operations.
What counts as multifactor authentication?
Using factors from at least two different categories: something you know, something you have and something you are. A password plus a PIN is still single factor.
Which wireless security mode should I choose on the exam?
WPA3 when the devices support it, and WPA2 when they do not. Open networks and the original WPA are not appropriate for a private network, and changing the SSID never replaces encryption.
What is the difference between data at rest and data in transit?
Data at rest is stored on a drive or device and is protected by file, disk or mobile device encryption. Data in transit moves across a network and is protected by HTTPS, VPNs and encrypted email or apps.
Do I need to know specific laws such as GDPR in detail?
GDPR is named in the objectives as a privacy example. Know that it governs personal data and drives practices such as cookie consent, rather than its articles or penalties.
How does Security connect to the other Tech+ domains?
It secures the wireless network from Infrastructure, extends permissions and browser safety from Applications and Software, and protects the critical data and backups described in Data and Database Fundamentals.
Other IT Fundamentals & Hardware certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 6 knowledge
You have covered the CIA triad and AAA, phishing and device protections, password practice, encryption use cases and Wi-Fi security settings. Test whether you can choose the option that truly protects, not the one that only looks secure.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA Tech+ AI tutor Get any concept explained your way