Summarize fundamental security concepts
CIA triad, non-repudiation, AAA, gap analysis, and zero trust's control and data planes.
- Reading time
- 24 min read
- Flashcards
- 25 cards
- Practice questions
- 13 questions · 4 PBQs
If 1.1 taught you to classify a control, 1.2 is the vocabulary the rest of the exam assumes you already have. Six clusters: the CIA triad, non-repudiation, AAA, gap analysis, zero trust, and physical security including deception technology.
Zero trust is the part that carries the most marks and the part most people half-learn. It gets the most room here.
The CIA triad
Three properties every security control ultimately protects.
Confidentiality
- Only authorised parties can read it
- Broken by: disclosure, eavesdropping, theft
- Protected by: encryption, access control, masking
Integrity
- Data has not been altered
- Broken by: tampering, corruption
- Protected by: hashing, digital signatures, checksums
Availability
- Authorised users can get to it when needed
- Broken by: DoS, hardware failure, ransomware
- Protected by: redundancy, backups, failover
The tellRead what the incident actually cost. Data read by the wrong person is confidentiality. Data changed is integrity. Data unreachable is availability.
Ransomware is the classic exam trap here. It encrypts your files, so the instinct is confidentiality — but you are still the only one who can read them once recovered. What you lost is access. Ransomware is primarily an availability attack. If the attacker also stole a copy before encrypting (double extortion), confidentiality is affected too.
Check yourself
An attacker modifies transaction amounts in a database without reading customer records. Which part of the triad is affected?
Non-repudiation
Non-repudiation means someone cannot credibly deny having done something.
It is not part of the triad, and it is not the same as integrity. Integrity says the message was not changed. Non-repudiation says this specific person sent it and cannot deny it.
The mechanism the exam wants is the digital signature: signing with a private key only you hold proves it came from you, because nobody else could have produced that signature. Audit logs and video footage also support non-repudiation.
AAA
Three separate questions, asked in order.
Authentication
Who are you? Proving identity — password, token, biometric, certificate.
Authorization
What are you allowed to do? Granting or denying access to specific resources after identity is established.
Accounting
What did you do? Logging and tracking activity for audit and billing.
The exam also applies AAA to systems, not just people. A device authenticating to the network proves its identity with a certificate rather than a password, because nobody is present to type one. That distinction — people use passwords and biometrics, devices use certificates — is tested directly.
Check yourself
A user logs in successfully but is denied access to the finance share. Which part of AAA denied them?
Gap analysis
A gap analysis compares where you are against where you need to be. Current state versus desired state, and the difference is the gap.
The desired state usually comes from a framework or regulation — you compare your controls against ISO 27001 or PCI DSS, and the gaps become your remediation plan. That is the whole idea, and it is typically one question.
Zero trust
The old model was a hard perimeter with a soft interior: get inside the firewall and you were trusted. Zero trust removes that implicit trust. Never trust, always verify — every request is authenticated and authorised regardless of where it comes from.
CompTIA splits zero trust into two planes, and expects you to know which components sit in which. This is the highest-value thing in 1.2.
Control plane — decides
- Policy Engine — evaluates and makes the decision
- Policy Administrator — issues and revokes access tokens
- Adaptive identity — identity considered with context
- Threat scope reduction — limit what each subject can reach
- Policy-driven access control — decisions from policy, not location
Data plane — enforces
- Policy Enforcement Point (PEP) — where access is allowed or blocked
- Subject / system — the user or device requesting access
- Implicit trust zones — the area reached after passing the PEP
The tellControl plane makes the decision. Data plane carries it out. If the component thinks, it is control plane; if it enforces or is enforced upon, it is data plane.
Follow one request through: a subject (data plane) requests access. The request hits the Policy Enforcement Point (data plane), which does not decide anything itself — it asks. The Policy Engine (control plane) evaluates the request against policy and decides. The Policy Administrator (control plane) issues the token. The PEP then permits the subject into the implicit trust zone (data plane).
Check yourself
Which zero trust component actually evaluates a request and decides whether to grant access?
Adaptive identity is worth its own note: identity is judged with context, not just credentials. The same valid password is treated differently when it arrives at 3am from a country the user has never visited. If a stem describes access decisions changing based on behaviour, location or device posture, that is adaptive identity.
Physical security
Mostly recognition, with a few distinctions that get tested.
An access control vestibule (formerly mantrap) is two interlocking doors where only one opens at a time. Its specific purpose is preventing tailgating — someone following an authorised person through a door. If a stem describes tailgating or piggybacking, the vestibule is the answer.
Bollards stop vehicles. Fencing delimits and deters. Lighting deters and enables surveillance. Video surveillance detects, or deters if visible. A security guard is the only physical control that can exercise judgement, which is why guards appear in scenarios where the situation is ambiguous.
Sensors get their own sub-list, and the exam does ask which is which:
| Sensor | Detects by |
|---|---|
| Infrared | Body heat |
| Pressure | Weight on a surface |
| Microwave | Reflected radio waves, motion |
| Ultrasonic | Reflected sound waves, motion |
Deception and disruption
Four terms that differ only in scale and target. The exam tests exactly that difference.
Honeypot
- A single decoy system
- Attracts and observes attackers
Honeynet
- A whole decoy network
- Multiple systems, richer observation
Honeyfile
- A decoy file
- Bait named to look valuable, e.g. passwords.txt
Honeytoken
- A decoy piece of data
- Fake credential or record that alerts when used
The tellScale it: token is a data element, file is a file, pot is one system, net is a network of them.
The point of all four is the same: nothing legitimate should ever touch them, so any interaction is a high-confidence alert. That is why they generate so few false positives compared with signature-based detection.
Check yourself
A security team plants a fake set of admin credentials in a database. When those credentials are ever used, an alert fires. What is this?