Security Concepts and Practices
The vocabulary that drives every other domain
Domain 1 supplies the definitions the exam reuses everywhere else. Start with the CIA triad: confidentiality (encryption, access controls, classification), integrity (hashing, change control, logs), and availability (redundancy, backups, DDoS defenses). Extend it to AAA - identification, authentication, authorization, accountability - which Domain 2 expands.
Learn the control taxonomy cold. Type is the mechanism: administrative/managerial (policies, awareness training, background checks), technical/logical (firewalls, ACLs, encryption), physical (locks, bollards, guards). Function is the purpose: preventive, detective, corrective, deterrent, recovery, compensating. One control can serve several functions - a motion-activated light is preventive, detective and deterrent.
Distinguish policy (management's mandatory intent), standard (a specific mandatory requirement), procedure (step-by-step instructions), and guideline (advisory). Know due care (doing what a reasonable organization would do) versus due diligence (verifying it actually happens). Segregation of duties, least privilege, need-to-know, job rotation and mandatory vacation are the classic anti-fraud controls.
Also master threat vs vulnerability vs risk: a threat exploits a vulnerability to create risk to an asset. Risk is likelihood times impact.
Trap: encryption offered as a deterrent. Encryption is preventive; a visible CCTV camera is the deterrent. Another trap: confusing compensating with corrective - compensating substitutes for a missing control, corrective repairs damage after an incident.
Rule of thumb: classify by the question the control answers. Does it stop it? Preventive. Does it notice it? Detective. Does it fix it? Corrective.