Chapter 1
Domain 1.0: General Security Concepts

THE COMPTIA SECURITY+ EXAM SY0-701 TOPICS COVERED IN THIS CHAPTER INCLUDE THE FOLLOWING:

• Domain 1.0: General Security Concepts
  • 1.1 Compare and contrast various types of security controls
    • Categories (Technical, Managerial, Operational, Physical)
    • Control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive)
  • 1.2 Summarize fundamental security concepts
    • Confidentiality, Integrity, and Availability (CIA)
    • Non-repudiation
    • Authentication, Authorization, and Accounting (AAA) (Authenticating people, authenticating systems, authorization models)
    • Gap analysis
    • Zero trust (control plane, data plane)
    • Physical security (bollards, access control vestibule, fencing, video surveillance, security guard, access badge, lighting, sensors)
    • Deception and disruption technology (honeypot, honeynet, honeyfile, honeytoken)
  • 1.3 Explain the importance of change management processes and the impact to security
    • Business processes impacting security operations (approval process, ownership, stakeholders, impact analysis, test results, backout plan, maintenance window, standard operating procedure)
    • Technical implications (allow lists/deny lists, restricted activities, downtime, service restart, application restart, legacy applications, dependencies)
    • Documentation (updating diagrams, updating policies/procedures)
    • Version control
  • 1.4 Explain the importance of using appropriate cryptographic solutions
    • Public key infrastructure (PKI) (Public key, private, key, key escrow)
    • Encryption (Level, transport/communication, asymmetric, symmetric, key exchange, algorithms, key length)
    • Tools (Trusted Platform Module [TPM], Hardware security module [HSM], key management systems, secure enclave)
    • Obfuscation (Steganography, tokenization, data masking)
    • Hashing
    • Salting
    • Digital Signatures
    • Key stretching
    • Blockchain
    • Open public ledger
    • Certificates (certificate authorities, certificate revocation lists [CRLs], Online Certificate Status Protocol [OCSP], self-signed, third-party, root of trust, certificate signing request [CSR] generation, wildcard)

1. Felicia wants to deploy an encryption solution that will protect files in motion as they are copied between file shares as well as at rest, and also needs it to support granular, per-user security. What type of solution should she select?
   1. Partition encryption
   2. File encryption
   3. Full-disk encryption
   4. Record-level encryption
2. Valerie wants to use a certificate to handle multiple subdomains for her website, including the sales.example.com and support.example.com subdomains. What type of certificate should she use?
   1. A self-signed certificate
   2. A root of trust certificate
   3. A CRL certificate
   4. A wildcard certificate
3. What information is analyzed during a gap analysis?
   1. Control objectives and controls intended to meet the objectives
   2. Physically separate networks and their potential connection points
   3. Compensating controls and the controls they are replacing
   4. Security procedures and the policies they are designed to support
4. Susan's team has recommended an application restart for a production, customer-facing application as part of an urgent patch due to a security update. What technical implication is the most common concern when conducting an application restart?
   1. Application configuration changes caused by the restart
   2. Whether the patch will properly apply
   3. Lack of security controls during the restart
   4. The downtime during the restart
5. Using a tool like git is most frequently associated with what critical change management process?
   1. Having a backout plan
   2. Stakeholder analysis
   3. Version control
   4. Standard operating procedures (SOPs)
6. Jacob is concerned that the password used for one of his organization's services is weak, and he wants to make it harder to crack by making it harder to test possible keys during a brute-force attack. What is this technique called?
   1. Master keying
   2. Key stretching
   3. Key rotation
   4. Passphrase armoring
7. Log monitoring is an example of what control category?
   1. Technical
   2. Managerial
   3. Operational
   4. Physical
8. Rick wants to make offline brute-force attacks against his password file very difficult for attackers. Which of the following is not a common technique to make passwords harder to crack?
   1. Use of a salt
   2. Use of a pepper
   3. Use of a purpose-built password hashing algorithm
   4. Encrypting password plain text using symmetric encryption
9. Diffie-Hellman and RSA are both examples of what important encryption-related solution?
   1. Rekeying
   2. Certificate revocation protocols
   3. Key exchange algorithms
   4. Key generation algorithms
10. Sally wants to ensure that her change management process includes a procedure for what to do if the change fails. What should she create to handle this possibility?
    1. An impact analysis
    2. A backout plan
    3. A regression test
    4. A maintenance window
11. Theresa is concerned that her scheduled maintenance window may extend beyond the allocated time due to an unexpected issue. What element from the CIA triad is she concerned about?
    1. Criticality
    2. Accessibility
    3. Integrity
    4. Availability
12. Alaina is concerned about vehicles that might impact her organization's backup generator. What should she install to prevent both inadvertent and purposeful vehicle impacts on a generator installed outside her building near a parking lot?
    1. A speed bump
    2. An access control vestibule
    3. Bollards
    4. A chain-link fence
13. Ben has deployed a data loss prevention (DLP) tool that inspects data and flags specific data types for review before emails containing it are sent outside the organization. What control type best describes this type of solution?
    1. Managerial
    2. Detective
    3. Corrective
    4. Preventive
14. What type of control is a policy or procedure?
    1. Directive
    2. Corrective
    3. Detective
    4. Preventive
15. Murali has deployed a file integrity monitoring tool and has configured alerts to notify him if files are modified. What control type best describes this solution?
    1. Preventive
    2. Deterrent
    3. Directive
    4. Detective
16. Charles wants to reduce the threat scope of compromised credentials. What type of the following security controls is best suited to meeting this need?
    1. Single sign-on
    2. Federation
    3. Zero trust
    4. Multifactor authentication (MFA)
17. Carol wants to obfuscate data that is contained in her database. She wants to be able to refer to the data elements without having the actual data exposed. What type of obfuscation option should she select?
    1. Tokenization
    2. Encryption
    3. Data masking
    4. Data randomization
18. What key is used to decrypt information sent by another individual between two people using public key encryption?
    1. The recipient's private key
    2. The recipient's public key
    3. The sender's private key
    4. The sender's public key
19. Selah's organization has recently experienced a breach and the private keys for her organization's certificates were exposed. What should she immediately do?
    1. Reissue the certificates with changed hostnames and other details.
    2. Replace the certificates with self-signed certificates until they can be replaced by the vendor.
    3. Revoke the certificates and place them on a certificate revocation list.
    4. Replace the certificates with wildcard certificates.
20. Which of the following is not a major concern related to downtime caused by patching and system updates?
    1. Attackers compromising the system or service while it is offline
    2. Security systems or functions being offline during restart or shutdown processes
    3. Unexpected extended downtime
    4. Dependencies between systems or services related to downtime
21. Joanna wants to ensure that the most current version of each component in her application is deployed. What change management process will help the most with this requirement?
    1. Dependency mapping
    2. Version control
    3. Impact analysis
    4. Allow and deny lists
22. Greg wants to implement a version control system to ensure that changes are made in ways that will not cause problems for his organization's critical software. Which of the following is not a common feature of version control systems designed for software source code?
    1. Atomic operations
    2. File locking
    3. Regression testing
    4. Tagging and labeling
23. Christina wants to implement a physical security control that has the...