1 Security Concepts and Controls · Security+

Exam objective 1.1: Explain security concepts and controls.

This objective covers the core ideas that every security professional uses to reason about protection: defense in depth; the confidentiality, integrity, and availability (CIA) triad; authentication, authorization, and accounting (AAA); non-repudiation; Zero Trust principles; and least privilege. It also covers the vocabulary used to classify security controls by category (technical, managerial, operational, and physical) and by type (preventive, deterring, detective, corrective, compensating, and directive). This is an "explain" objective, so you need to understand these concepts well enough to recognize them in a description and to classify a given control correctly. Classification questions are a favorite for drag-and-drop PBQs, so practice until you can categorize controls quickly and confidently.

Why Fundamental Concepts Matter

Security is ultimately about managing risk to the things an organization values: its data, its systems, its people, its reputation, and its ability to operate. Every security decision involves trade-offs. A control that makes data more confidential may make it less available. A control that improves availability may cost more than the risk it reduces. The concepts in this chapter give you a shared vocabulary for describing what you are trying to protect, how you are protecting it, and why.

You will see these concepts again and again throughout the guide. When Chapter 12 discusses encryption of data at rest, it is applying confidentiality. When Chapter 13 discusses redundant power supplies, it is applying availability. When Chapter 18 discusses multifactor authentication, it is applying the authentication portion of AAA. Master these ideas now and the rest of the material becomes easier to organize.

Defense in Depth

Defense in depth is the strategy of protecting assets with multiple, overlapping layers of security controls so that the failure of any single control does not lead to a compromise. The idea comes from military strategy: rather than relying on one strong wall, a defender builds a series of barriers so that an attacker who breaches one must still overcome the next.

In an information security context, layers typically include:

Policies, procedures, and awareness — the human layer: acceptable use policies, training, and security culture.
Physical security — fences, locks, badges, guards, cameras, and access vestibules that keep unauthorized people away from equipment.
Perimeter security — firewalls, secure web gateways, email filtering, and DDoS protection at the boundary between the organization and the internet.
Network security — segmentation, VLANs, internal firewalls, intrusion detection and prevention, and network access control.
Host (endpoint) security — hardening, patching, endpoint detection and response (EDR), host-based firewalls, and application control.
Application security — secure coding, input validation, web application firewalls, and code signing.
Data security — encryption, data loss prevention (DLP), access control lists, masking, and backups. Each layer addresses threats the others might miss. Email filtering may block most phishing messages, but awareness training helps users recognize the ones that get through. EDR may detect malware that a user runs anyway, and network segmentation limits how far that malware can spread. Backups ensure recovery if everything else fails.

Figure 1.1: Defense in depth places overlapping layers of controls around the data so that no single failure exposes it Diversity of Defenses

A related idea is diversity, sometimes called vendor diversity or control diversity. If every layer uses the same vendor's technology, a single vulnerability or bypass technique could defeat them all. Using different vendors for, say, the perimeter firewall and the internal firewall means an attacker who has an exploit for one product does not automatically defeat the other. Diversity also applies to control types: combining technical controls with administrative and physical controls means an attacker must defeat fundamentally different kinds of protection.

Diversity comes with costs, however. Each additional product requires expertise, licensing, and management, and complexity itself can create misconfigurations. Organizations balance diversity against manageability.

Exam tip

If a question describes multiple layers of different controls protecting the same asset, or asks for the strategy of ensuring that one control failure does not lead to compromise, the answer is defense in depth (also called layered security).

Real-world scenario

A regional credit union suffered a phishing incident in which an employee entered credentials on a fake login page. The attacker could not use the stolen password because the credit union required multifactor authentication. When the attacker then tried to deliver malware via a follow-up email, the attachment was blocked by the email gateway. The incident ended with no data loss because several independent layers each stopped part of the attack. This is defense in depth working as designed.

The CIA Triad

The CIA triad—confidentiality, integrity, and availability—is the most widely used model for describing the goals of information security. Nearly every security control can be described in terms of which of these three properties it protects.

Confidentiality

Confidentiality means that information is accessible only to those who are authorized to see it. Breaches of confidentiality are what most people think of when they hear "data breach": customer records stolen, trade secrets leaked, or private messages exposed.

Controls that protect confidentiality include:

Encryption of data at rest and in transit, so that intercepted or stolen data is unreadable without the key.
Access controls such as permissions, access control lists, and role-based access control that restrict who can read data.
Authentication mechanisms that verify identity before granting access.
Data masking and tokenization, which hide sensitive values from people and systems that do not need the real data.
Physical controls such as locked server rooms and privacy screens that prevent shoulder surfing.
Classification and labeling, which tell users how sensitive information is and how it must be handled.

Threats to confidentiality include eavesdropping and packet sniffing, credential theft, social engineering, misconfigured cloud storage, insider data theft, and shoulder surfing.

Integrity

Integrity means that information is accurate, complete, and has not been modified in an unauthorized or undetected way. Integrity also applies to systems: a system with integrity behaves as intended and has not been tampered with.

Integrity failures can be subtle and dangerous. An attacker who alters a bank account number on an invoice, modifies a patient's medication dosage in a medical record, or changes a software update to include malware has violated integrity, often without anyone noticing immediately.

Controls that protect integrity include:

Hashing, which produces a fixed-length fingerprint of data. If the data changes, the hash changes, revealing the modification.
Digital signatures, which combine hashing with asymmetric cryptography to prove both integrity and the identity of the signer.
Message authentication codes (MACs and HMACs), which use a shared secret key with a hash to verify that a message was not altered in transit.
Access controls that restrict who can modify data, separate from who can read it.
Version control and change management, which record who changed what and when, and allow rollback.
File integrity monitoring (FIM), which alerts when critical system files change unexpectedly.
Input validation, which prevents malformed or malicious data from entering a system.

Availability

Availability means that systems and data are accessible to authorized users when they need them. A perfectly confidential system that no one can use is useless to the business. For many organizations— hospitals, utilities, e-commerce sites—availability is the most critical property of all. Controls that protect availability include:

Redundancy: redundant power supplies, RAID storage, clustered servers, multiple internet links, and redundant data centers.
Backups and tested restoration procedures.
Load balancing to distribute traffic and avoid overloading any single system.
DDoS protection services and rate limiting.
Patching and maintenance that keep systems stable.
Environmental controls such as HVAC, fire suppression, and uninterruptible power supplies (UPS).
Disaster recovery and business continuity planning.

Threats to availability include denial-of-service attacks, ransomware, hardware failure, power outages, natural disasters, and even poorly planned changes that take systems offline.

Balancing the Triad

The three properties often pull against each other. Strong encryption and strict access controls improve confidentiality but can make data harder to reach quickly in an emergency. Allowing many people to edit a document improves availability of the editing function but increases integrity risk. Security professionals must balance the triad according to the organization's priorities and the nature of the data. A public website's content needs high integrity and availability but little confidentiality; a database of medical records needs all three.

The DAD Triad

The opposite of CIA is sometimes described as the DAD triad: disclosure (the opposite of confidentiality), alteration (the opposite of integrity), and destruction or denial (the opposite of availability). Thinking in DAD terms can help you identify which property an attack targets. Property Goal Attack outcome (DAD)

Example attack Example control
Confidential
ity

Only authorized access

Disclosure Packet sniffing, data exfiltration

Encryption, access control

Integrity No unauthorized change

Alteration On-path modification, tampering

Hashing, digital signatures

Availability Accessible when needed

Destruction/
denial
DDoS, ransomware Redundancy, backups

Exam tip

When a question describes a control, ask yourself which property it most directly protects. Hashing and digital signatures protect integrity. Encryption protects confidentiality. Redundancy, backups, and load balancing protect availability. Ransomware is unusual because it can attack all three: it denies availability by encrypting files and, in double-extortion attacks, threatens confidentiality by leaking stolen data. Authentication, Authorization, and Accounting (AAA)

AAA describes the three functions that together control and track access to resources. Before AAA begins, a subject makes an identification claim—typically by entering a username, presenting a badge, or offering a certificate. Identification is simply a claim of identity; AAA then verifies and governs it.

Figure 1.2: Identification is followed by authentication and authorization, while accounting records events at every step Authentication

Authentication is the process of proving that a claimed identity is genuine. Authentication relies on one or more factors:

Factor Description Examples

Something you know A secret the user memorizes Password, PIN, answer to a security question Something you have A physical or digital object the user possesses

Smart card, hardware token, authenticator app on a phone

Something you are A biometric characteristic Fingerprint, face, iris, voice Somewhere you are The user's location GPS location, IP geolocation, network segment Something you do A behavioral characteristic Typing rhythm, gait, signature dynamics Using two or more different factors is multifactor authentication (MFA). A password plus a code from an authenticator app is MFA (know + have). A password plus a PIN is not MFA, because both are something you know. Chapter 18 covers MFA methods in detail.

Authentication applies to systems and devices as well as people. Servers authenticate to each other with certificates or shared secrets; devices joining a network can authenticate with 802.1X and device certificates; APIs authenticate callers with tokens or keys. When a question mentions authenticating systems, think certificates, device identities, and machine accounts.

Authorization

Authorization determines what an authenticated subject is allowed to do. After you log in, authorization decides whether you can open a particular file, run a particular command, or approve a particular transaction. Authorization is governed by access control models—discretionary, mandatory, role-based, rule-based, attribute-based, and time-based—which Chapter 18 covers in depth.

Authentication and authorization are distinct. A user can be authenticated perfectly and still be denied access to a resource they are not authorized to use. Many real-world breaches occur not because authentication failed but because authorization was too permissive: an account had far more access than it needed.

Accounting

Accounting (sometimes called auditing) records what subjects do: when they logged in, what resources they accessed, what changes they made, and when they logged out. Accounting data supports troubleshooting, billing, compliance, investigations, and non-repudiation. Logs, audit trails, and session records are all forms of accounting.

Memory aid

Think of a hotel. Showing your ID at the front desk is authentication. The key card that opens only your room (and the gym) is authorization. The hotel's record of when your key card opened each door is accounting.

AAA Protocols and Frameworks

Several protocols implement AAA centrally, so that network devices do not each maintain their own user databases:

RADIUS (Remote Authentication Dial-In User Service) is widely used for network access (VPNs, Wi-Fi with 802.1X, switch port authentication). It uses UDP, combines authentication and authorization, and encrypts only the password in the access-request packet.
TACACS+ (Terminal Access Controller Access-Control System Plus) is commonly used for administrative access to network devices. It uses TCP, separates authentication, authorization, and accounting into distinct functions, and encrypts the entire packet body. Its ability to authorize individual commands makes it well suited to managing router and switch administration.
Diameter is a successor to RADIUS used mainly in telecommunications networks.

Feature RADIUS TACACS+
Transport UDP (1812/1813) TCP (49)
Encryption Password only Entire payload
Feature RADIUS TACACS+

AAA separation Authentication and authorization combined All three separated Typical use Network access (Wi-Fi, VPN, 802.1X) Device administration

Command-level authorization No Yes

Non-Repudiation

Non-repudiation is assurance that someone cannot credibly deny having performed an action, such as sending a message, signing a document, or approving a transaction. It provides proof of origin and, in some contexts, proof of delivery.

The primary technical mechanism for non-repudiation is the digital signature. A sender signs a message with their private key, which only they possess. Anyone can verify the signature with the sender's public key. Because no one else has the private key, the sender cannot plausibly claim that someone else created the signature—provided the private key has not been compromised and was properly protected.

Note the contrast with symmetric mechanisms. A message authentication code (MAC) proves integrity and shows that the message came from someone who knows the shared secret key, but because both parties share that key, either one could have produced the MAC. MACs therefore do not provide non-repudiation. Other supporting mechanisms include:

Audit logs with strong integrity protections, which record who did what.
Timestamps from trusted time sources, which establish when an action occurred.
Video surveillance and access logs, which provide non-repudiation for physical actions.
Strong authentication, because a signature or log entry is only as trustworthy as the process that tied it to a specific person.

Common trap

Encryption alone does not provide non-repudiation, and neither does a shared secret. If a question asks how to ensure that a sender cannot deny sending a message, look for "digital signature" (signing with the sender's private key), not "encrypt with the recipient's public key."

Zero Trust Principles

Traditional network security followed a "castle and moat" model: strong perimeter defenses, with anything inside the network treated as trusted. That model has broken down. Cloud services, remote work, mobile devices, and partner connections mean there is no longer a single perimeter, and attackers who get inside—through phishing, a compromised device, or a malicious insider—can move freely in a flat, trusting network.

Zero Trust is a security model built on the principle that no user, device, or network location is inherently trusted. Every access request is evaluated on its own merits, using as much context as possible, every time. The phrase most associated with Zero Trust is "never trust, always verify." The core principles of Zero Trust are:

Verify explicitly. Authenticate and authorize every request based on all available signals: user identity, device health, location, time, the sensitivity of the resource, and observed behavior.
Use least-privilege access. Grant only the access needed for the task at hand, ideally just in time and just enough, and revoke it when it is no longer needed.
Assume breach. Design as though an attacker is already inside. Segment networks, encrypt internal traffic, monitor continuously, and limit the blast radius of any compromise.
Never grant implicit trust based on network location. Being on the corporate LAN or VPN does not by itself confer access to anything.
Continuously monitor and re-evaluate. Trust is not a one-time decision at login; sessions are reassessed as conditions change.
Microsegment. Divide the environment into small zones so that access to one resource does not imply access to others.

Control Plane and Data Plane

Zero Trust architectures (described in NIST Special Publication 800-207) separate decision-making from enforcement. You will study these components in more detail in Chapter 11, but you should recognize them here:

The control plane is where access decisions are made. It includes the policy engine (PE), which evaluates requests against policy and context and decides to grant or deny, and the policy administrator (PA), which carries out the decision by establishing or tearing down the session (for example, by issuing a session token or instructing the enforcement point).
The data plane is where traffic actually flows. It includes the policy enforcement point (PEP), which sits between the subject and the resource and allows or blocks the connection as instructed.
Adaptive identity uses context such as location, device posture, and behavior to adjust authentication requirements dynamically—for example, requiring MFA when a user signs in from a new country.
Threat scope reduction limits what any single identity or device can reach, reducing the impact of a compromise.
Policy-driven access control means that access is governed by centrally defined policies rather than by network topology.
Implicit trust zones are areas in which entities are trusted once they pass through the enforcement point; Zero Trust aims to make these zones as small as possible.

Figure 1.3: In a Zero Trust architecture the control plane decides on each request and the data plane enforces that decision

Real-world scenario

A software company adopts Zero Trust after a contractor's laptop is infected with malware that then scans the internal network. Under the new model, the contractor's access to the source code repository requires a managed device with up-to-date EDR, phishing-resistant MFA, and an approved geographic location. Even when all conditions are met, the contractor can reach only the specific repositories assigned to the project—not the HR system, not the finance servers, and not the rest of the network. When the device's EDR agent reports an alert, the contractor's session is revoked automatically.

Exam tip

If a question describes access decisions based on device health, user identity, and context rather than network location—or describes continuous verification of every request—the answer is Zero Trust. If it asks which component makes the decision, choose the policy engine; which component enforces it, choose the policy enforcement point.

Least Privilege

The principle of least privilege states that every user, process, and system should have only the minimum permissions needed to perform its function, for only as long as needed. Least privilege limits the damage that a compromised account, a malicious insider, or a software bug can cause. Practical applications include:

Giving users standard accounts for daily work and separate privileged accounts for administration.
Running services under dedicated service accounts with narrowly scoped rights rather than as an administrator or root.
Granting cloud identities only the specific API permissions they require, rather than broad administrative roles.
Using just-in-time (JIT) access so that elevated privileges are granted for a limited window and then removed automatically.
Regularly reviewing access and removing permissions that are no longer needed, to counter privilege creep—the gradual accumulation of access as people change roles.

Related principles include:

Need to know: even a user with appropriate clearance should access specific information only if their job requires it.
Separation of duties: dividing critical tasks among multiple people so that no single person can complete a sensitive process (such as creating and approving a payment) alone. This reduces fraud and error.
Dual control (two-person integrity): requiring two people to act together, such as two officers each holding part of a vault combination or two administrators approving access to a key escrow system.
Job rotation and mandatory vacations: rotating people through roles and requiring time away, so that ongoing fraud is more likely to be discovered.

Common trap

Least privilege and need to know are related but different. Least privilege concerns permissions (what actions you can perform). Need to know concerns information (what data you may see), even among people who share the same clearance level.

Security Controls

A security control (also called a safeguard or countermeasure) is any measure that reduces risk by protecting the confidentiality, integrity, or availability of assets. The exam expects you to classify controls in two different ways: by category, which describes how the control is implemented, and by type, which describes what the control does in relation to an incident.

Every control has both a category and at least one type. A firewall, for example, is a technical control (category) that is preventive (type). A security guard is a physical control that can be deterring, detective, and preventive depending on the situation.

Control Categories

Technical (Logical) Controls

Technical controls, also called logical controls, are implemented through technology: hardware, software, and firmware. They enforce security automatically once configured.

Examples:

Firewalls and access control lists
Encryption
Antivirus and endpoint detection and response
Intrusion detection and prevention systems
Multifactor authentication systems
Data loss prevention software
Group Policy settings and SELinux policies
Logging and SIEM systems

Managerial (Administrative) Controls

Managerial controls, also called administrative controls, are the policies, procedures, plans, and decisions that direct how security is managed. They focus on governance, risk management, and the security program as a whole. Managerial controls are often documented and are typically set by management.

Examples:

Security policies and standards
Risk assessments and risk management programs
Security planning and the acceptable use policy
Vendor (third-party) risk management
Change management policy
Personnel policies such as background checks, hiring and termination procedures, and separation of duties
Data classification policy

Operational Controls

Operational controls are carried out primarily by people as part of day-to-day operations, rather than by technology. They implement the intent of managerial controls through the actions of staff. Examples:

Security awareness training
Security guards performing patrols
Configuration management performed by administrators
Media handling and secure disposal procedures
Incident response activities performed by the team
Reviewing logs and conducting access reviews

Note

The line between managerial and operational controls can blur. A useful test: managerial controls define and oversee (a policy requiring awareness training, a risk assessment), while operational controls are performed by people day to day (delivering the training, a guard checking badges). If a control is "a document or decision made by management," lean toward managerial; if it is "an activity people do," lean toward operational.

Physical (Environmental) Controls

Physical controls protect the physical environment: buildings, rooms, equipment, and people. The SY0- 801 objectives list this category as physical/environmental, which reminds you that controls such as fire suppression, HVAC, and power protection belong here.

Examples:

Fences, bollards, gates, and barricades
Locks, badge readers, and access control vestibules (mantraps)
Security guards and guard dogs (also operational)
Video surveillance (CCTV) and lighting
Motion, infrared, pressure, and microwave sensors
Fire suppression and smoke detection
HVAC and humidity controls
Faraday cages and shielding

Category Implemented by Examples
Technical/logical Technology Firewall, encryption, MFA, EDR, ACLs
Managerial/
administrative

Management decisions and documentation

Policies, risk assessments, background check requirements

Operational People performing tasks Awareness training delivery, guard patrols, log review Physical/

environmental

Tangible barriers and environmental protections

Locks, fences, cameras, fire suppression, HVAC
Control Types
Preventive Controls

Preventive controls stop an incident from happening in the first place. They block or restrict unauthorized actions before damage occurs.

Examples: firewalls blocking traffic, locked doors, access control lists, encryption, MFA, account lockout, input validation, and an intrusion prevention system that drops malicious packets.

Deterring (Deterrent) Controls

Deterring controls discourage an attacker from attempting an attack by making it seem risky or unattractive. They do not physically prevent the attack; they influence the attacker's decision. Examples: warning signs ("Premises under video surveillance"), login banners stating that activity is monitored and unauthorized access will be prosecuted, visible security cameras, visible guards, and lighting around a building.

Detective Controls

Detective controls identify and record that an incident is occurring or has occurred. They do not stop the incident but make it visible so that people can respond.

Examples: intrusion detection systems, log monitoring and SIEM alerts, security cameras (recording), motion sensors, file integrity monitoring, audits and reviews, and smoke detectors.

Corrective Controls

Corrective controls reduce the impact of an incident after it occurs and restore systems to normal. They fix the problem.

Examples: restoring data from backups, reimaging an infected system, applying a patch after an exploit, antivirus quarantining and removing malware, fire suppression systems extinguishing a fire, and incident response procedures that remove an attacker.

Some frameworks also describe recovery controls, which restore normal operations after an incident (such as disaster recovery sites). The SY0-801 objectives do not list recovery as a separate type, so on the exam treat restoration activities such as restoring from backup as corrective.

Compensating Controls

Compensating controls are alternative controls used when the primary or required control cannot be implemented, is too expensive, or would interfere with business operations. A compensating control provides a similar level of protection through different means.

Examples:

A legacy system cannot be patched because the vendor no longer supports it, so the organization isolates it on a separate VLAN with strict firewall rules and enhanced monitoring.
A small business cannot afford separation of duties for a financial process because it has only one bookkeeper, so it requires the owner to review all transactions monthly.
A medical device cannot run endpoint protection, so the organization uses network-based intrusion prevention and application allow listing on the network segment.

Exam tip

The phrase "cannot be implemented" or "the vendor no longer supports" in a question is a strong hint toward compensating controls. The compensating control does not have to be the same kind of control —it just has to address the same risk.

Directive Controls

Directive controls direct, instruct, or require people to behave in a certain way. They tell people what to do (or not do) and rely on compliance.

Examples: policies requiring screen locks, signs reading "Authorized personnel only" or "Badge must be visible at all times," acceptable use policies, standard operating procedures, and training that instructs staff how to handle sensitive data.

Directive controls and deterring controls can look similar. A sign that says "Visitors must sign in at reception" is directive: it tells people what to do. A sign that says "Trespassers will be prosecuted" is deterring: it discourages unwanted behavior by threatening consequences.

Putting Categories and Types Together

Because category and type are independent dimensions, you can place any control in a grid. The following table shows examples of each combination.

Type Technical Managerial Operational Physical

Preventive Firewall rule, MFA Hiring policy requiring background checks

Guard checking badges at entry

Locked door, bollards

Deterring Login warning banner

Policy stating sanctions for violations

Visible guard patrol Warning sign, visible cameras, lighting

Detective IDS, SIEM alerts Periodic risk assessment or audit

Reviewing logs, access reviews

Motion sensor, CCTV recording

Corrective Restoring from backup, patching

Policy for handling incidents Incident response team actions

Fire suppression system
Compensa
ting
Network isolation for

an unpatchable system

Increased management review where separation of duties is impossible

Additional manual checks

Extra guard where a lock cannot be installed

Directive Pop-up requiring acknowledgement of

Aup

Acceptable use policy Training that instructs staff

"Authorized personnel only" sign

Controls With Multiple Types

Many controls serve more than one type. A visible security camera is deterring (people are less likely to misbehave if they see it) and detective (it records events). A security guard can be deterring (visible presence), preventive (stopping someone at the door), and detective (noticing suspicious behavior). An account lockout policy is preventive (it stops a brute-force attack) and can be detective if lockouts generate alerts.

On the exam, choose the type that best matches the function described in the question. If the question emphasizes that cameras discourage theft, the answer is deterring. If it emphasizes reviewing footage to identify who entered a room, the answer is detective.

Common trap

Do not confuse IDS and IPS. An intrusion detection system is detective—it alerts but does not block. An intrusion prevention system is preventive—it sits inline and blocks malicious traffic. The single letter matters.

Control types: "Please Don't Deny Cool Compensating Directives" — Preventive, Deterring, Detective, Corrective, Compensating, Directive. Control categories: "The Manager Operates Physically" — Technical, Managerial, Operational, Physical.

Gap Analysis and Control Selection

Organizations choose controls by comparing their current state with a desired state. A gap analysis identifies where existing controls fall short of a framework, standard, or policy requirement. For example, an organization might compare its controls against the NIST Cybersecurity Framework or the CIS Critical Security Controls and find that it lacks centralized logging or a formal incident response plan. The gaps then become a prioritized list of controls to implement. Gap analysis is covered again in Chapter 26 as an assessment engagement type.

When selecting controls, security professionals weigh:

Risk reduction: how much does the control lower likelihood or impact?
Cost: purchase, implementation, and ongoing operational costs.
Usability and business impact: does the control slow users down or block legitimate work?
Coverage: does the control address the specific threats the organization faces?
Layering: does the control complement existing controls, adding a different kind of protection?

Chapter Summary

Defense in depth uses multiple, overlapping layers of diverse controls so that the failure of one control does not lead to compromise.
The CIA triad describes the goals of security: confidentiality (only authorized access), integrity (no unauthorized or undetected change), and availability (access when needed). DAD—disclosure, alteration, destruction—describes the opposite outcomes.
AAA consists of authentication (proving identity), authorization (determining permitted actions), and accounting (recording actions). RADIUS and TACACS+ are common AAA protocols.
Non-repudiation prevents someone from denying an action. Digital signatures created with a private key are the primary mechanism.
Zero Trust removes implicit trust based on network location: verify explicitly, use least privilege, assume breach, and continuously evaluate. The policy engine decides, the policy administrator executes, and the policy enforcement point enforces.
Least privilege grants only the minimum access needed, for only as long as needed. Related principles include need to know, separation of duties, and just-in-time access.
Control categories are technical, managerial, operational, and physical. Control types are preventive, deterring, detective, corrective, compensating, and directive. Every control has a category and at least one type.

Key Terms

Defense in depth; diversity; confidentiality; integrity; availability; DAD triad; identification; authentication; authorization; accounting; authentication factors; multifactor authentication; RADIUS; TACACS+; non-repudiation; digital signature; Zero Trust; control plane; data plane; policy engine; policy administrator; policy enforcement point; adaptive identity; threat scope reduction; implicit trust zone; least privilege; need to know; separation of duties; privilege creep; just-in-time access; technical control; managerial control; operational control; physical control; preventive control; deterring control; detective control; corrective control; compensating control; directive control; gap analysis.

Review Questions

1. A hospital installs signs at the entrance to its data center reading "Restricted Area — Violators Will Be Prosecuted." Which control type does this sign BEST represent?

A. Preventive
B. Deterring
C. Detective
D. Compensating

2. An organization's payroll application runs on a legacy operating system that the vendor no longer supports, and the application cannot be migrated for another year. The security team places the server on an isolated network segment and restricts access to two administrative workstations. Which type of control has the team implemented?

A. Directive
B. Corrective
C. Compensating
D. Deterring

3. Which of the following provides non-repudiation for an email message?

A. Encrypting the message with the recipient's public key
B. Calculating an HMAC with a key shared by sender and recipient
C. Signing the message with the sender's private key
D. Sending the message over a TLS-encrypted connection

4. A user successfully logs in to a file server with a valid username, password, and hardware token, but receives an "access denied" message when trying to open the finance folder. Which AAA function denied access?

A. Identification
B. Authentication
C. Authorization
D. Accounting

5. A security architect is designing an access system in which a component evaluates each access request against policy, user identity, device health, and threat intelligence, and decides whether to permit it. Which Zero Trust component is described?

A. Policy enforcement point
B. Policy engine
C. Implicit trust zone
D. Data plane

6. Which of the following is an example of a managerial control?

A. A firewall rule blocking inbound Telnet
B. A guard checking badges at the front desk
C. A risk assessment conducted annually by the security committee
D. A motion sensor in a server room

7. An attacker modifies the bank account number in an invoice email before it reaches the recipient. Which element of the CIA triad has been compromised?

A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation

8. An administrator is choosing a AAA protocol for managing administrative access to routers and switches. The solution must encrypt the entire payload and support command-level authorization. Which protocol BEST meets these requirements?

A. RADIUS
B. TACACS+
C. LDAP
D. SAML

9. Which of the following combinations represents multifactor authentication? (Select TWO.)

A. Password and PIN
B. Fingerprint and smart card
C. Password and security question
D. Smart card and PIN
E. Retina scan and fingerprint

10. An employee who has worked in sales, marketing, and finance over five years still has access to resources from all three departments. Which problem does this describe, and which principle addresses it?

A. Privilege escalation; separation of duties
B. Privilege creep; least privilege
C. Shadow IT; need to know
D. Impersonation; Zero Trust

11. A company wants to ensure that no single employee can both create a new vendor in the accounting system and approve payments to that vendor. Which principle is being applied?

A. Least privilege
B. Job rotation
C. Separation of duties
D. Need to know

12. Security cameras in a parking lot are positioned where employees and visitors can easily see them, and the footage is reviewed when incidents are reported. Which control types do the cameras provide? (Select TWO.)

A. Deterring
B. Corrective
C. Detective
D. Compensating
E. Directive

Answers and Explanations

1. B. The sign discourages unauthorized entry by warning of consequences, which makes it a deterring control. It does not physically prevent entry (preventive), it does not detect anything (detective), and it is not a substitute for a required control (compensating). A sign that instructs people what to do ("Badge required beyond this point") would be directive.
2. C. Isolating the server is an alternative measure used because the primary control—patching or upgrading the operating system—cannot be implemented. That is the definition of a compensating control. It is not corrective because no incident is being remediated.
3. C. Signing with the sender's private key creates a digital signature that only the holder of that private key could have produced, so the sender cannot credibly deny sending the message. Encrypting with the recipient's public key provides confidentiality, not proof of origin. An HMAC uses a shared key, so either party could have created it. TLS protects the connection, not the message itself after delivery.
4. C. The user was authenticated successfully—the password and token were accepted. The denial came from authorization, which determines what an authenticated user is allowed to access. Accounting would record the attempt but does not make access decisions.
5. B. The policy engine evaluates requests and makes the access decision. The policy administrator executes that decision, and the policy enforcement point allows or blocks the actual connection in the data plane.
6. C. A risk assessment is a management-level activity that directs the security program, making it managerial. The firewall rule is technical, the guard is operational (and physical), and the motion sensor is physical.
7. B. Altering data without authorization violates integrity. Confidentiality might also be affected if the attacker read the email, but the core harm described is modification. Non-repudiation is not part of the CIA triad.
8. B. TACACS+ uses TCP, encrypts the entire payload, separates authentication, authorization, and accounting, and supports per-command authorization, making it the preferred choice for device administration. RADIUS encrypts only the password and does not support command authorization. LDAP is a directory protocol, and SAML is a federation standard for web SSO.
9. B, D. A fingerprint (something you are) with a smart card (something you have) is MFA, as is a smart card (have) with a PIN (know). A password with a PIN, or a password with a security question, uses two "know" factors. A retina scan with a fingerprint uses two "are" factors. Using more than one instance of the same factor is not multifactor.
10. B. Accumulating access over time as one changes roles is privilege creep. The principle that counters it is least privilege, enforced through regular access reviews and removal of access when roles change.
11. C. Separation of duties divides a sensitive process so that one person cannot complete it alone, reducing the risk of fraud. Least privilege limits permissions generally but does not specifically require splitting a process between people.
12. A, C. Visible cameras deter misbehavior, and reviewing footage after an incident detects and identifies what happened. Cameras do not correct an incident, are not described as a substitute for another control, and do not instruct behavior.