SY0-701 · Objective 1.2 · General Security Concepts
1.2 Fundamental security concepts explained
The official objective: “Summarize fundamental security concepts.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 1.2 covers
Objective 1.2 collects the ideas that every other objective builds on. None of them is hard on its own, but the exam tests them through short scenarios, so you need to recognise each one when it is described rather than named.
Start with the CIA triad. Confidentiality means only authorised people can read the data. Integrity means the data hasn't been changed without authorisation. Availability means the data or service is there when it's needed. Non-repudiation sits beside the triad: it means someone can't credibly deny an action they took, and in practice it comes from digital signatures and good audit records.
AAA stands for authentication, authorization and accounting. Authentication proves who you are. Authorization decides what you may do once you are known. Accounting records what you actually did. Security+ also expects you to know that systems authenticate, not only people: a server presenting a machine certificate to another server is authentication too.
Gap analysis is a comparison between where you are and where a framework or standard says you should be. The output is a list of missing or weak controls, which then feeds a plan.
Zero trust removes the idea that anything inside the network is trusted by default. Every request is evaluated using identity, device health and context. The exam splits a zero trust design into two planes. The control plane decides: it holds the policy engine and policy administrator (together, the policy decision point), plus adaptive identity, threat scope reduction and policy-driven access control. The data plane enforces: the policy enforcement point sits in the traffic path and allows or blocks the connection based on the decision it receives.
Physical security covers bollards, access control vestibules, fencing, lighting, guards, access badges and sensors (infrared, pressure, microwave and ultrasonic). Deception and disruption technology covers honeypots (a single decoy system), honeynets (a network of decoys), honeyfiles (a decoy document) and honeytokens (a fake credential or record that should never be used). Any interaction with a decoy is suspicious by definition, which is why these produce such clean alerts.
What candidates mix up
- Integrity versus non-repudiation: a hash proves the data didn't change; only a signature tied to one person's private key proves who sent it.
- Authentication versus authorization: proving identity comes first; permissions come second.
- Policy engine versus policy enforcement point: the engine decides, the enforcement point carries the decision out on the traffic.
- Honeypot versus honeytoken: a honeypot is a whole system; a honeytoken is a single piece of fake data planted among real systems.
Practice questions for 1.2
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A system verifies a user's identity, then decides which files that user may open, and separately records every file the user accessed. Which three functions, in order, are being performed?
- AAuthentication, then authorization, then accounting (AAA)
- BAuthorization, then authentication, then auditing
- CIdentification, then accounting, then authentication
- DEncryption, hashing, and salting
Show answer and explanation
Answer: A) Authentication, then authorization, then accounting (AAA)
- AAuthentication proves who you are, authorization determines what you may do, and accounting logs what you did — the AAA framework.
- BAuthentication must come first; you can't authorize an unverified identity.
- CThat order is wrong and accounting is the last step, not the middle one.
- DThose are cryptographic operations, not the access-control lifecycle.
Question 2
In a zero trust architecture, which component makes the access decision by evaluating policy, identity, and device posture, and which component enforces that decision on the traffic?
- AThe policy decision point (policy engine + policy administrator) in the control plane decides; the policy enforcement point in the data plane enforces
- BThe firewall decides and the SIEM enforces
- CThe end user decides and the operating system enforces
- DDNS decides and the router enforces
Show answer and explanation
Answer: A) The policy decision point (policy engine + policy administrator) in the control plane decides; the policy enforcement point in the data plane enforces
- AZero trust separates the control plane (where the policy engine evaluates trust signals and issues a decision) from the data plane (where the PEP allows, denies, or terminates the session accordingly).
- BA SIEM analyzes logs; it doesn't enforce session access, and zero trust decisions aren't made by a static firewall rule set.
- CZero trust removes implicit trust and user self-authorization; decisions are centralized in the policy engine.
- DNeither DNS nor basic routing performs identity- and posture-based access decisions.
Question 3
A security team plants a fake service-account password and a file named 'payroll_2026.xlsx' on an existing production file server. Neither item has any legitimate business use, and any attempt to use or open them generates a high-priority alert. Which deception technique has the team deployed?
- AHoneytokens planted among real production data
- BA honeypot built to imitate a vulnerable server
- CA honeynet of several linked decoy systems
- DA DNS sinkhole that redirects malicious lookups
Show answer and explanation
Answer: A) Honeytokens planted among real production data
Decoy credentials and files planted in real systems, with no legitimate use and an alert on any access, are honeytokens (honeyfiles or honey credentials). Honeypots and honeynets are whole decoy systems, and a DNS sinkhole redirects malicious name lookups.
- AHoneytokens (including honey credentials and honeyfiles) are decoy data items such as accounts, files or keys placed inside real systems. They have no legitimate use, so any access is a strong, low-false-positive sign of an intruder.
- BA honeypot is an entire decoy system set up to attract and study attackers. Here the decoys are individual credentials and files on a real production server, not a separate fake system.
- CA honeynet is a network of honeypots that simulates an environment. The scenario involves no decoy hosts, only planted artifacts on an existing server.
- DA DNS sinkhole returns false answers for known malicious domains so that traffic is sent to a controlled address. It disrupts command-and-control traffic but does not involve planting fake credentials or files.
Other General Security Concepts objectives
Also: the General Security Concepts domain page (12% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.