The CIA triad and AAA
Domain 1: General Security Concepts · Not started
Main exam topics
Security controls; confidentiality, integrity and availability; authentication and authorization; zero trust; physical security; change management; non-repudiation; encryption, hashing, certificates and digital signatures.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Three goals behind every control
Confidentiality keeps information away from people who should not see it. Encryption, access control lists, and data classification all support it. Integrity means data is accurate and has not been changed without authorization; hashing, digital signatures, and change control support it. Availability means systems and data are there when authorized users need them; redundancy, backups, and capacity planning support it. On the exam, read each scenario and ask which goal was harmed. A tampered invoice is an integrity problem even if nobody else read it. A flooded web server is an availability problem even if no data left the building.
Non-repudiation
Non-repudiation means a person cannot credibly deny an action they performed. Digital signatures provide it because only the holder of the private key could have produced the signature. Audit logs help too, but only when they are protected from tampering. If a question asks how to prove who sent a message, look for digital signatures rather than encryption alone.
Authentication, authorization, accounting
AAA describes how access is managed. Authentication proves identity, such as a password plus a hardware token. Authorization decides what that identity may do, such as read-only access to a finance share. Accounting records what happened, such as logs of each file opened. A common trap is mixing up authentication and authorization: logging in is authentication; being blocked from a folder after logging in is authorization. RADIUS and TACACS+ are classic AAA protocols; TACACS+ separates the three functions and encrypts the full payload.
Exam approach
Identify the asset, identify what went wrong, then map it to a goal. Choose the control that addresses that goal most directly. Distractors are often real controls that protect a different goal.
Know the difference: Authentication vs. authorization
| Aspect | Authentication | Authorization |
|---|---|---|
| Question answered | Who are you? | What may you do? |
| Example | Password + token | Read-only share permission |
| Happens | First | After identity is proven |
Saved