Study guide 1: Fundamental security concepts
Domain 1: General Security Concepts · Not started
Main exam topics
Security controls; confidentiality, integrity and availability; authentication and authorization; zero trust; physical security; change management; non-repudiation; encryption, hashing, certificates and digital signatures.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 60 minutes
By the end of this lesson you will be able to:
- Map a scenario to confidentiality, integrity, availability or non-repudiation
- Describe the five NIST CSF functions and the purpose of a gap analysis
- Distinguish control categories from functional types
- Identify security roles and business units
Topic 1A — Security concepts
Information security protects data through confidentiality, integrity and availability, with non-repudiation proving who acted. A cybersecurity framework such as NIST CSF organizes the work into Identify, Protect, Detect, Respond and Recover. A gap analysis compares the current state with the framework's target and produces a prioritized remediation plan. Access control is described as IAAA: identification (claim an identity), authentication (prove it), authorization (grant rights) and accounting (record activity).
Topic 1B — Control categories
Controls are grouped by how they are implemented. Technical (logical) controls are enforced by systems — firewalls, encryption, ACLs. Managerial controls oversee the program — risk assessments, policies. Operational controls are carried out by people — guards, training. Physical controls protect facilities — locks, fences, cameras.
Topic 1B — Functional types
Controls are also grouped by what they do. Preventive stops an incident (a lock, an ACL). Detective identifies one in progress or after the fact (logs, IDS). Corrective reduces impact after an incident (backup restore, patching). Directive tells people what to do (policy). Deterrent discourages attempts (warning signs). Compensating substitutes when the primary control isn't possible. Exam trap: one control can have one category and a different type — a CCTV camera is physical and detective.
Roles and business units
Senior executives own overall accountability; a CISO leads the program; managers own specific domains; technical staff implement controls; all employees follow policy. A SOC monitors and responds; DevSecOps builds security into development; CIRT/CSIRT handles incidents.
Know the difference: Category vs. functional type
| Example | Category | Type |
|---|---|---|
| Firewall rule | Technical | Preventive |
| Security guard | Operational | Preventive / deterrent |
| Acceptable use policy | Managerial | Directive |
| Backup restore | Technical | Corrective |
Saved