Overview
General Security Concepts is the smallest Security+ domain at 12%, but it establishes the vocabulary and principles the entire exam assumes. It has four objectives. Security control types covers the categories, technical, managerial, operational and physical, and functions, preventive, deterrent, detective, corrective, compensating and directive. Fundamental concepts covers the CIA triad, authentication, authorization and accounting, zero trust, physical security, and deception technologies. Change management covers the importance of structured change processes and their security impact. Cryptographic solutions covers encryption, public key infrastructure, hashing, digital signatures, certificates and key management.
Though small, this domain is foundational: its concepts, especially the control categories and functions, zero trust, and the cryptography basics, recur throughout the threats, architecture, operations and governance domains. The exam rewards precise understanding of these concepts, since they frame how every later topic is reasoned about.
How it's tested
Security+ questions are scenario-based and vendor-neutral, often including performance-based questions. In this domain they describe a situation and ask which control type or function, security concept, change process or cryptographic solution applies. Read the scenario for the precise concept it illustrates, since the categories are easily confused.
-
Control type or function
A control is described, and you classify it by category (technical, managerial, operational, physical) and function (preventive, detective and others).
-
Security concept
A principle is described, and you identify the CIA element, zero trust, or AAA concept.
-
Cryptographic solution
A protection need is described, and you choose encryption, hashing, digital signatures or PKI.
A security camera is placed at an entrance. Classifying it requires both dimensions: by category it is a physical control, and by function it is primarily deterrent (discouraging intruders) and detective (recording activity). The exam often tests both the category and the function, so recognizing that one control can be classified on two axes, and choosing the function the scenario emphasizes, is the reasoning expected.
Domains 4
Official domains from the CompTIA outline, in outline order.
1.1 Compare and contrast various types of security controlsControl categories and functions.
- What it means
- This covers the categories of security controls, technical, managerial, operational and physical, and the functional types, preventive, deterrent, detective, corrective, compensating and directive, and how a given control is classified on both dimensions.
- What to understand
- Controls are classified two ways: by category (technical implemented in technology, managerial through policy, operational by people and process, physical in the real world) and by function (what they do, such as prevent, deter, detect or correct). A single control can have both a category and a function, and the exam tests both. Knowing these classifications precisely is foundational.
- How it shows up
- A control is described, and you must classify it by category and function.
- Common confusion
- Confusing control categories with control functions; category is where the control lives, while function is what it does.
1.2 Summarize fundamental security conceptsCIA triad, AAA, zero trust, physical security and deception.
- What it means
- This covers fundamental concepts: the confidentiality, integrity and availability triad, non-repudiation, authentication, authorization and accounting, the zero trust model with its control and data planes, physical security, and deception and disruption technologies such as honeypots.
- What to understand
- The CIA triad frames security goals, AAA governs access and accountability, and zero trust assumes no implicit trust, verifying every request and separating the control plane that makes decisions from the data plane that enforces them. Deception technologies like honeypots lure and study attackers. These concepts are tested throughout.
- How it shows up
- A principle or goal is described, and you must identify the CIA element, AAA concept, or zero trust idea.
- Common confusion
- Confusing authentication with authorization, or the CIA elements with one another.
1.3 Explain the importance of change management processes and the impact to securityStructured change processes and their security impact.
- What it means
- This covers the importance of change management: approval processes, ownership, stakeholders, impact analysis, test results, backout plans, maintenance windows, and the technical implications such as allow and deny lists, restarts, dependencies and documentation.
- What to understand
- Structured change management ensures changes are reviewed, approved, tested and reversible, reducing the risk that a change introduces vulnerabilities or outages. Poorly managed change is itself a security risk. Understanding the process elements and why they matter to security is the expectation, not deep technical steps.
- How it shows up
- A change scenario is described, and you must identify the change management element or its security impact.
- Common confusion
- Underestimating change management as a security control, or confusing its process elements such as backout plans and impact analysis.
1.4 Explain the importance of using appropriate cryptographic solutionsEncryption, PKI, hashing, digital signatures and key management.
- What it means
- This covers cryptographic solutions: public key infrastructure, symmetric and asymmetric encryption, encryption levels (full-disk, file, database and more), hashing, digital signatures, certificates, key exchange, key management and escrow, salting, and concepts such as blockchain.
- What to understand
- Cryptography protects confidentiality through encryption, integrity through hashing, and authenticity and non-repudiation through digital signatures, with PKI managing keys and certificates. Symmetric uses one shared key while asymmetric uses a public and private key pair. Choosing the right cryptographic tool for the goal, and understanding key management, is the core skill.
- How it shows up
- A protection goal is described, and you must choose encryption, hashing, a digital signature or a PKI element.
- Common confusion
- Confusing hashing (integrity) with encryption (confidentiality), or symmetric with asymmetric encryption.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Control categories
Technical, managerial, operational, physical.
- Remember
- Category is where a control lives.
- Tested as
- Control questions.
- Trap
- Confusing with functions.
-
Control functions
Preventive, deterrent, detective, corrective, compensating, directive.
- Remember
- Function is what a control does.
- Tested as
- Control questions.
- Trap
- Confusing with categories.
-
CIA triad
Confidentiality, integrity, availability.
- Remember
- The three core security goals.
- Tested as
- Foundational questions.
- Trap
- Confusing the three elements.
-
Authentication vs. authorization
Verifying identity versus granting access.
- Remember
- Part of AAA with accounting.
- Tested as
- Access questions.
- Trap
- Confusing the two.
-
Zero trust
No implicit trust; verify every request.
- Remember
- Separates control and data planes.
- Tested as
- Architecture concept questions.
- Trap
- Treating the network as trusted.
-
Non-repudiation
Proof that an action cannot be denied.
- Remember
- Provided by digital signatures.
- Tested as
- Cryptography questions.
- Trap
- Confusing with confidentiality.
-
Symmetric vs. asymmetric encryption
One shared key versus a public/private key pair.
- Remember
- Asymmetric enables key exchange and signatures.
- Tested as
- Cryptography questions.
- Trap
- Confusing the two.
-
Hashing
A one-way function producing a fixed digest.
- Remember
- Protects integrity, not confidentiality.
- Tested as
- Cryptography questions.
- Trap
- Confusing with encryption.
-
Public key infrastructure
Manages keys and certificates.
- Remember
- Binds identities to public keys.
- Tested as
- Cryptography questions.
- Trap
- Overlooking certificate and key management.
-
Digital signatures
Sign with a private key to prove authenticity and integrity.
- Remember
- Provide non-repudiation.
- Tested as
- Cryptography questions.
- Trap
- Confusing signing with encrypting.
-
Change management
Structured, approved, reversible change.
- Remember
- Poor change control is a security risk.
- Tested as
- Process questions.
- Trap
- Underestimating its security role.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Control category vs. control function
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Category | Technical, managerial, operational, physical | Where the control lives | Confusing with function |
| Function | Preventive, detective, corrective and others | What the control does | Confusing with category |
Symmetric vs. asymmetric encryption
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Symmetric | One shared secret key | Fast, key distribution is hard | Confusing with asymmetric |
| Asymmetric | Public and private key pair | Enables key exchange and signatures | Confusing with symmetric |
Encryption vs. hashing
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Encryption | Reversible with a key | Protects confidentiality | Confusing with hashing |
| Hashing | One-way digest | Protects integrity | Expecting to decrypt a hash |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Category is function
- What candidates pick
- Answer a control-function question with a category such as technical.
- Why it looks right
- Both classify controls.
- Why it's wrong
- Category (technical, managerial, operational, physical) is where the control lives; function (preventive, detective, corrective and others) is what it does.
Clue to watch for The question asks what the control does versus where it lives.
-
Hash can be decrypted
- What candidates pick
- Expect to recover the original data from a hash.
- Why it looks right
- It looks like encrypted output.
- Why it's wrong
- Hashing is one-way and cannot be reversed; it protects integrity, while encryption is reversible with a key.
Clue to watch for The goal is to verify integrity, not recover data.
-
MFA is authorization
- What candidates pick
- Describe multifactor authentication as granting access rights.
- Why it looks right
- Both relate to access.
- Why it's wrong
- Authentication verifies identity; authorization determines what the verified user may do.
Clue to watch for The need is to grant or limit permissions.
-
Trust the internal network
- What candidates pick
- Assume internal traffic is trusted under zero trust.
- Why it looks right
- The perimeter feels safe.
- Why it's wrong
- Zero trust verifies every request regardless of location, with no implicit trust for internal traffic.
Clue to watch for The model trusts nothing by default.
-
Encryption gives non-repudiation
- What candidates pick
- Use encryption alone to prove who sent a message.
- Why it looks right
- Encryption protects the message.
- Why it's wrong
- Non-repudiation comes from a digital signature using the sender's private key, not from encryption alone.
Clue to watch for The requirement is to prove the sender cannot deny the action.
-
Skip change management
- What candidates pick
- Treat change management as unrelated to security.
- Why it looks right
- It seems like a process formality.
- Why it's wrong
- Unmanaged change can introduce vulnerabilities and outages, so structured, reversible change is a security control.
Clue to watch for A change could introduce risk without review or a backout plan.
Answer framework
For any Domain 1 concept scenario, use these steps to find the answer Security+ expects.
- Decide whether the question is about a control, a fundamental concept, change management or cryptography.
- For controls, classify on both axes: the category (technical, managerial, operational, physical) and the function (preventive, detective, corrective and others).
- For concepts, identify the CIA element, the AAA concept, or apply zero trust by verifying every request with no implicit trust.
- For change management, recognize structured, approved, tested and reversible change as a security control.
- For cryptography, choose encryption for confidentiality, hashing for integrity, and digital signatures for authenticity and non-repudiation, with PKI managing keys and certificates. Where two options seem to fit, pick the one that most precisely matches the scenario's requirement.
Practice question
Want more like this? The Security+ practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Treat this domain as learning the precise vocabulary the whole exam uses, and get the definitions exactly right. Start with security controls, and drill the two-axis classification until you can give both the category (technical, managerial, operational, physical) and the function (preventive, detective, corrective and others) for any control, since the exam tests both and they are easily confused.
Next, fix the fundamental concepts: the CIA triad, the authentication-versus-authorization distinction within AAA, and zero trust with its control and data planes. Then learn cryptography precisely, keeping hashing (integrity) distinct from encryption (confidentiality), symmetric from asymmetric, and understanding digital signatures, non-repudiation and PKI. Finally, understand why structured change management is itself a security control.
Because these concepts recur everywhere, precise definitions here pay off across the exam. Afterwards, move to Domain 2, Threats, Vulnerabilities, and Mitigations. Because Security+ rewards applied understanding across a broad field, use scenario practice questions and relate each concept to a real situation rather than only memorizing lists, and review missed practice questions by domain to find weak spots.
FAQ
How much of Security+ is Domain 1?
General Security Concepts is 12% of the exam, the smallest domain, but its vocabulary and principles underpin every other domain.
What is the difference between a control category and a control function?
A category describes where a control lives: technical, managerial, operational or physical. A function describes what it does: preventive, deterrent, detective, corrective, compensating or directive. One control has both, and the exam tests both.
What is the CIA triad?
Confidentiality, integrity and availability, the three core goals of security. Confidentiality keeps data private, integrity keeps it accurate and unaltered, and availability keeps it accessible when needed.
What is zero trust?
A security model that assumes no implicit trust and verifies every request regardless of its location, separating the control plane that makes access decisions from the data plane that enforces them. It is a new emphasis in SY0-701.
What is the difference between hashing and encryption?
Encryption is reversible with a key and protects confidentiality. Hashing is a one-way function producing a fixed digest that protects integrity and cannot be reversed to recover the original data.
What provides non-repudiation?
A digital signature, created with the sender's private key, proves the sender's identity and that the content was not altered, so the sender cannot deny the action. Encryption alone does not provide non-repudiation.
How does Domain 1 connect to the rest of the exam?
Its concepts, control types, the CIA triad, zero trust and cryptography, are applied throughout the threats, architecture, operations and governance domains, so a precise grasp here supports the whole exam.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have covered security control types, fundamental concepts, change management and cryptography. Test whether you can apply these foundational concepts precisely under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Security+ AI tutor Get any concept explained your way