Security+ Domain 1 Study Guide: General Security Concepts (SY0-701)
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
General Security Concepts is 12% of the Security+ SY0-701 exam and has 4 objectives. This study guide lists each objective with its official title, summarizes the concepts you need in tables, flags the exam traps that cost points, and gives three original practice questions with explanations for every option. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
Domain 1 at a Glance
General Security Concepts is 12% of the Security+ SY0-701 exam. It has 4 objectives, listed below with their official titles. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
| Objective | Official title |
|---|---|
| 1.1 | Compare and contrast various types of security controls. |
| 1.2 | Summarize fundamental security concepts. |
| 1.3 | Explain the importance of change management processes and the impact to security. |
| 1.4 | Explain the importance of using appropriate cryptographic solutions. |
Security Controls: Categories and Functions
Every control has a category, which is what it is made of, and a function, which is what it does. Questions usually give an example and ask for one or the other.
| Category | What it is | Examples |
|---|---|---|
| Technical | Implemented with technology | Firewalls, encryption, antivirus, access control lists |
| Managerial | Policy, planning and risk decisions | Risk assessments, security policies, awareness program design |
| Operational | Run day to day by people | Guard patrols, backup procedures, training delivery |
| Physical | Tangible protection | Locks, fences, badge readers, cameras |
| Function | Purpose | Example |
|---|---|---|
| Preventive | Stop an event from happening | Firewall, access control, hardening |
| Deterrent | Discourage an attempt | Warning signs, visible cameras |
| Detective | Identify an event as or after it happens | Log review, intrusion detection, alarms |
| Corrective | Fix or limit damage after an event | Restore from backup, patching after an incident |
| Compensating | Substitute when the normal control is not possible | Added monitoring when a legacy system cannot be patched |
| Directive | Tell people what to do | Policies, procedures, standards |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Fundamental Concepts
| Concept | What to know |
|---|---|
| CIA triad | Confidentiality (only authorized access), integrity (data is not altered improperly), availability (systems are usable when needed) |
| Non-repudiation | A person cannot later deny an action. Digital signatures and tamper-evident logs provide it |
| AAA | Authentication proves identity, authorization decides what is allowed, accounting records what happened |
| Gap analysis | Compares the current state against a target to find what is missing |
| Zero trust | Never trust by location, always verify. A control plane makes policy decisions and a data plane enforces them at policy enforcement points |
| Physical security | Fencing, bollards, access control vestibules, badge readers, guards, lighting, cameras and sensors |
| Deception technology | Honeypots, honeynets, honeyfiles and honeytokens that attract and detect attackers |
Change Management
Change management reduces the risk that a change breaks security or availability. Know the parts of a change and why each exists.
| Element | Purpose |
|---|---|
| Approval process and ownership | Someone accountable approves and owns the change |
| Impact analysis and test results | Understand what could break before you deploy |
| Backout plan | A way to undo the change if it fails |
| Maintenance window | An agreed time that limits disruption |
| Documentation and version control | Update diagrams, policies and procedures after the change |
Cryptography Essentials
Cryptography is covered in depth in our cryptography cheat sheet. The essentials for this domain:
| Topic | Remember |
|---|---|
| Symmetric versus asymmetric | One shared key and fast, versus a key pair and slower |
| Hashing | One-way digest for integrity. Not encryption |
| Digital signature | Signed with the sender's private key, verified with the public key |
| PKI | Certificate authorities, certificates, CSRs, CRLs and OCSP |
| Hardware support | TPM and HSM store and protect keys |
| Salting and key stretching | Protect stored passwords against rainbow tables and brute force |
Common Exam Traps
These mix-ups cost points in this domain.
Category versus function
A firewall is technical by category and preventive by function. Read whether the question asks what it is or what it does.
Corrective versus compensating
Corrective fixes damage after an event. Compensating stands in for a control you cannot apply.
Encryption does not prove who sent it
For non-repudiation you need a digital signature, not shared-key encryption or a plain hash.
Wildcard versus SAN certificates
A wildcard covers one level of subdomains under a domain. A SAN certificate lists specific names.
Try It: Three Domain 1 Practice Questions
Answer these before you read the key. They are original questions written to the published objectives, and none are real exam questions.
Question 1. After a ransomware attack, an administrator restores a corrupted file server from the most recent clean backup. Which of the following control types does the restore BEST represent?
- A. Detective
- B. Preventive
- C. Directive
- D. Corrective
Question 2. A purchasing system must ensure a manager cannot later deny approving a purchase order. Which of the following BEST provides non-repudiation for the approval?
- A. Symmetric encryption of the purchase order using a shared departmental key
- B. A SHA-256 hash of the purchase order stored beside the order record
- C. Role-based access control restricting the application to purchasing staff
- D. A digital signature created with the approver's private key
Question 3. A company runs mail.example.com, vpn.example.com, and portal.example.com and plans to add more first-level subdomains. It wants ONE certificate that covers all of them. Which of the following should it request?
- A. Self-signed certificate
- B. Code-signing certificate
- C. Extended validation certificate
- D. Wildcard certificate
Answer Key and Explanations
Question 1: D. Corrective (objective 1.1)
Corrective controls return systems to a known good state after an incident, which is exactly what a restore from backup does.
- A. Detective. Detective controls discover that an event occurred, but the restore does not detect anything.
- B. Preventive. Preventive controls stop an event before it happens, and the attack has already occurred.
- C. Directive. Directive controls tell people what to do through policy, which is not what a restore does.
Question 2: D. A digital signature created with the approver's private key (objective 1.2)
Only the approver holds the private key, so a valid signature proves origin and prevents later denial.
- A. Symmetric encryption of the purchase order using a shared departmental key. Symmetric encryption protects confidentiality, and the shared key means anyone holding it could have produced the data.
- B. A SHA-256 hash of the purchase order stored beside the order record. An unkeyed hash shows the data was not altered but anyone can recompute it, so it does not prove who approved.
- C. Role-based access control restricting the application to purchasing staff. Access control limits who can reach the application but does not bind a specific approval to one person.
Question 3: D. Wildcard certificate (objective 1.4)
A wildcard certificate for *.example.com covers every first-level subdomain, including ones added later.
- A. Self-signed certificate. A self-signed certificate is not issued by a trusted CA and does not address covering multiple names.
- B. Code-signing certificate. A code-signing certificate verifies software publishers and does not secure hostnames.
- C. Extended validation certificate. An extended validation certificate describes the level of identity vetting and does not cover unlimited subdomains.
How to Study Domain 1
Domain 1 carries 12% of the exam. See our objectives explained for all five domains, the study plan for how to split your days by weight, and the commonly confused terms cheat sheet for the pairs that appear here.
Learn the control matrix
Make a grid of the four categories against the six functions and fill in an example for each cell.
Practice classifying examples
For each security measure you can think of, name its category and function, then check yourself.
Retry misses on different days
A widely cited review of learning techniques rated practice testing and spaced practice as high utility. Return to the questions you miss a few days later instead of rereading the same pages.
Practice With DD Academy
DD Academy has Security+ flashcards and practice questions for every objective in Domain 1, plus an AI tutor that explains why each option is right or wrong. It is free to start on iPhone and the web.
The bottom line
Know the 4 Domain 1 objectives, learn the concept tables until you can explain each term without notes, watch for the traps listed above and keep practicing with scenario questions across all five domains.
Frequently asked questions
What percentage of Security+ is Domain 1?
General Security Concepts is 12% of SY0-701 according to CompTIA's published weights. It is the smallest domain on SY0-701, and it grows to 16% on SY0-801.
What are the four security control categories?
Technical, managerial, operational and physical. Technical controls use technology, managerial controls are policy and risk decisions, operational controls are run by people, and physical controls are tangible protections.
What is the difference between corrective and compensating controls?
A corrective control fixes or limits damage after an event, such as restoring from backup. A compensating control substitutes for a control that cannot be applied, such as extra monitoring on a system that cannot be patched.
How many objectives are in Domain 1?
Domain 1 has four objectives on SY0-701: 1.1 security controls, 1.2 fundamental concepts, 1.3 change management and 1.4 cryptographic solutions.
What provides non-repudiation?
A digital signature made with the signer's private key. Only the signer holds that key, so a valid signature proves origin and prevents later denial.
Is Domain 1 different in SY0-801?
Yes. SY0-801 merges the controls and fundamental concepts objectives into one, keeps change management and cryptography, and raises the domain weight to 16%. See our guide to what changed in SY0-801.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
