General Security Concepts is the foundational domain of the CompTIA Security+ SY0-701 exam, covering the core principles that underpin all of cybersecurity. In plain English, this domain teaches you the 'why' behind security—why we need confidentiality, integrity, and availability (the CIA triad), how to manage risk, and what controls (like firewalls, encryption, or policies) actually do. It’s like learning the rules of the road before driving: you’ll understand threats, vulnerabilities, and the mindset to protect data and systems.
This domain is critical for real-world IT, security, and cloud work because every security decision—from configuring a cloud bucket to responding to a breach—starts with these concepts. For example, when you set up AWS S3 permissions, you’re applying the principle of least privilege. When you patch a server, you’re reducing risk. Understanding these fundamentals helps you communicate with stakeholders, justify security spending, and avoid common mistakes that lead to data leaks. Employers expect you to think like a security professional, not just a technician.
On the SY0-701 exam, this domain tests your ability to define and apply security concepts across scenarios. You’ll be asked to identify which control (deterrent, preventive, detective, corrective, compensating, directive) fits a given situation—like a security guard (deterrent) vs. an IDS (detective). You’ll also need to understand risk management terms (likelihood, impact, RPO, RTO), types of threats (malware, social engineering, supply chain), and the difference between vulnerability and threat. Expect multiple-choice questions that give a short scenario and ask for the best control or concept.
To study this domain effectively, focus on memorizing the definitions and then applying them to practice questions. Start with the CIA triad and non-repudiation. Then learn the control types by creating mnemonics (e.g., 'Prevent, Detect, Correct'). Use flashcards for terms like 'vulnerability' vs. 'threat' vs. 'risk'. Finally, practice with scenario-based questions from CompTIA’s official study materials or a reputable test bank. Don’t just read—quiz yourself daily. This domain is 12% of the exam, so you need to master it, but it’s also the easiest to score high on if you practice.
General Security Concepts covers the foundational principles of cybersecurity, including the CIA triad, risk management, security controls, and threat types, which are tested through scenario-based questions on the SY0-701 exam.
Define and apply the CIA triad (confidentiality, integrity, availability) to scenarios like encrypting data at rest (confidentiality) or hashing files (integrity).
Identify and differentiate security control types: deterrent (e.g., warning signs), preventive (e.g., firewalls), detective (e.g., IDS), corrective (e.g., backups), compensating (e.g., alternative controls), and directive (e.g., policies).
Understand risk management concepts: risk = likelihood x impact, and terms like RPO (Recovery Point Objective) and RTO (Recovery Time Objective) in disaster recovery.
Recognize common threat actors and vectors: insider threats, APTs, ransomware, phishing, and supply chain attacks.
Apply the principle of least privilege and defense in depth to network or system design scenarios.
Differentiate between vulnerability, threat, and risk, and identify appropriate mitigation strategies.
Common exam traps
Where candidates lose marks on General Security Concepts
⚠Confusing preventive and detective controls: a firewall is preventive, but an IDS is detective; many candidates mix them up.
⚠Misapplying the CIA triad: e.g., thinking encryption only provides integrity, when it primarily provides confidentiality.
⚠Overlooking the difference between a vulnerability (a weakness) and a threat (something that exploits it); exam questions often test this distinction.
⚠Assuming all compensating controls are temporary; they can be permanent if the primary control is too costly or complex.
SY0-701 General Security Concepts — Practice Questions
30 questions from this objective · 12% of your SY0-701 exam
A company wants one document that tells employees what they are required to do when handling company systems and data. Which document type is the best fit?
A development team signs branch-router firmware before deployment. The same code-signing private key is stored on two build servers, and a compromise of either server would let an attacker sign malicious updates that look legitimate. Which two changes best reduce the cryptographic risk while preserving the ability to sign trusted releases? Select two.
A legacy payroll server has a critical patch available, but the business cannot reboot it for 45 days. The team isolates the server to only the payroll application subnet and requires written approval before any temporary firewall exception is made. Which two control types are present? Select two.
A company is proposing a new access model for its finance application. Under this model, access requests are evaluated in real time based on device posture, user identity, and risk signals, even when users are connected via VPN. Which security principle is the proposed access model most aligned with?
Exhibit
Current access model:
- Any laptop on the corporate VPN can reach 10.8.40.15:443.
- The VPN checks device compliance only when the tunnel is created.
- After login, the session remains valid for 12 hours.
- Users can access the finance app from any managed or unmanaged device once connected.
Security proposal:
- Reevaluate device posture before each sensitive transaction.
- Grant only application-specific access, not subnet-wide access.
- Require MFA again if device risk changes during the session.
A cloud backup service uses envelope encryption. The key-encryption key is nearing the end of its approved lifetime, but the business cannot decrypt and re-encrypt every backup object this week. Which two statements best describe the correct rotation approach? Select two.
A contractor is brought in to investigate a single alert on an ERP system. The contractor gets read-only access to one log source through a jump host, cannot see user payroll records, and the account expires automatically at shift end. Which two principles are being applied? Select two.
A company stores application passwords in a database that could be stolen during a breach. The team wants to prevent attackers from using precomputed tables and also make identical passwords produce different stored values. Which two changes should be implemented? Select two.
Before installing a vendor patch package on hundreds of endpoints, the security team wants to confirm the file was published by the vendor and was not altered during download. Which two verification steps should the team perform? Select two.
A contractor is assigned to a single merger project. The manager approves access to only the project share and the project chat space, even though the contractor technically could use other collaboration tools. Which principle is most directly reflected?
A developer installed an unknown root CA on a laptop. The browser now accepts a proxy certificate for intranet.apps.example without warnings. Which two controls most directly reduce the chance that this endpoint trusts a malicious interception certificate? Select two.
Exhibit
Endpoint findings:
- Local root certificate store was modified
- Browser trusts a new enterprise-looking root CA
- TLS warnings no longer appear for the internal portal
- The user has local administrator rights
A microservices team stores service private keys inside container images and renews certificates manually once a year. Security wants to reduce damage if a node is compromised and keep certificate trust manageable at scale. Which two changes are the best fit? Select two.
Exhibit
Deployment notes:
- service.key is copied into the image layer
- the same key is reused across several nodes
- certificate renewal is manual and yearly
- services authenticate to each other with TLS
A network team wants no single person to both approve and deploy a production firewall rule, and they also want the approval path to be defensible during an investigation. Which two control concepts best address the stated risk? Select two.
Exhibit
Change request excerpt:
- One engineer can submit a firewall rule and approve it alone
- Security requires a second person review for production changes
- The team wants a clear record of who approved and deployed the change
An internal audit found that a procurement team uses the shared account procure-approve to approve emergency purchases. The log only shows the shared account name, and managers say they cannot prove which person approved each request. Which two changes best improve accountability and nonrepudiation? Select two.
Exhibit
Audit summary:
- Approval account: procure-approve
- 12 employees know the password
- Audit trail records only the shared account name
- No digital signature or tamper-evident log is present
A security architect is designing a defense-in-depth strategy for a corporate network. Which of the following are fundamental principles or concepts that should be incorporated into this strategy? (Choose four.)
An organization is updating its security policies to align with modern threats and compliance requirements. Which of the following are key security concepts that should be explicitly addressed in these updated policies? (Choose four.)
A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?
A financial institution updates its access control policy to require that two different system administrators must approve and execute any changes to the core transaction processing database. Which security principle is this practice primarily designed to enforce?
A security architect is designing the network security posture for a new branch office. The plan includes a next-generation firewall at the perimeter, an intrusion prevention system on the internal network, mandatory multi-factor authentication for all remote access, and quarterly security awareness training for employees. The architect explains that these controls are independent of each other so that a failure in any single control does not leave the entire network unprotected. Which security concept is the architect primarily implementing?
A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?
A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?
A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?
A software vendor distributes critical security updates for its application through a public download website. The vendor wants to allow customers to verify that each update originated from the vendor and has not been modified in transit. Which of the following cryptographic techniques should the vendor apply to the update files before posting them for download?
A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?
A security auditor is reviewing the access controls for a payroll application. The auditor discovers that a single user, the payroll manager, has permissions to both create new employee records and then approve and process salary payments for those records. The company's security policy requires that no single individual should be able to execute both the creation and the approval of a payment for the same employee. Which of the following security principles is the company's policy attempting to enforce?
More General Security Concepts questions available in the full practice test.