General Security Concepts
Frameworks and core principles
Questions in this domain reward vocabulary precision more than depth. Anchor every answer to the CIA triad (confidentiality, integrity, availability), then to authentication, authorization, accounting, and non-repudiation. Zero trust (never trust, always verify; assume breach) and defense in depth are design philosophies often used as each other's distractors: zero trust removes implicit trust through identity-based policy, while defense in depth layers overlapping controls. Least privilege, separation of duties, and job rotation are the standard administrative safeguards.
Controls: category versus type
Every control has a category - technical, managerial, operational, physical - and a type - preventive, deterrent, detective, corrective, compensating, directive. A badge reader is technical/preventive; a signed acceptable-use policy is managerial/directive; a monthly access review run by staff is operational/detective. Most misses come from collapsing the two axes.
Cryptography essentials
Symmetric encryption (AES) is fast and handles bulk data; asymmetric (RSA, ECC) solves key distribution and enables signatures; hashing gives integrity only and is not encryption. Salting defeats precomputed rainbow tables. A digital signature pairs a hash with the sender's private key to prove integrity and origin - it provides no confidentiality. PKI binds identities to keys through a CA, and key escrow is the recovery tradeoff. Obfuscation and steganography hide meaning rather than mathematically protect it; blockchain is an append-only distributed ledger, not a privacy control.
Rule of thumb: ask what the control acts on (people/policy = managerial; staff-run process = operational; hardware/software = technical) and when it acts (prevent, detect, correct) to get category and type.