Security Fundamentals
The core vocabulary
Security fundamentals questions test whether you can reason from principles rather than recall products. Anchor yourself in the CIA triad: confidentiality (information is disclosed only to authorized parties), integrity (data and systems are accurate and unaltered), and availability (authorized users can access resources when needed). Every control you meet can be classified as preventive, detective, or corrective, and separately as administrative, technical, or physical. Practice labeling controls along both axes; exam items frequently describe a measure that is clearly detective (a log review) but tempt you to call it preventive because it "stops" incidents after the fact.
Defense in depth and least privilege
Layered defense assumes any single control can fail, so independent controls overlap. Least privilege, separation of duties, and need-to-know limit the blast radius of a compromised identity. Understand the difference between authentication (proving identity), authorization (granting rights), and accountability (linking actions to a person through logging and non-repudiation).
Traps to expect
- Confusing a policy (management intent) with a standard (mandatory specifics) or a procedure (step-by-step instructions).
- Treating encryption as a cure-all; it protects confidentiality in transit and at rest but not availability.
- Assuming a firewall is a complete boundary when insider and remote-access paths bypass it.
Rule of thumb
When a stem asks for the best control, eliminate options that only detect or only respond if the scenario demands prevention of a specific loss, and prefer the control that addresses the root cause at the lowest layer of the stack.
Worked example: A question describes a shared administrator password on a server. The best answer is not "stronger password policy" but "unique accounts with individual accountability," because the root problem is loss of attribution, not password strength.