Security Principles and Concepts
What this domain tests
Security Principles and Concepts is the foundation domain. It checks whether you can explain why a control exists before naming a product. Expect questions on the CIA triad, AAA, least privilege, separation of duties, defense in depth, and zero trust.
Core rules
- Confidentiality protects against unauthorized disclosure; integrity protects accuracy and completeness; availability protects timely access.
- AAA: authentication proves identity, authorization grants permissions, accounting records actions.
- Least privilege and need to know limit standing access; separation of duties prevents one person from completing a sensitive transaction alone.
- Defense in depth layers preventive, detective, and corrective controls; zero trust removes implicit trust based on network location.
- Non-repudiation uses digital signatures and tamper-evident logs to prove an action occurred.
Worked example
A payroll clerk's laptop is stolen with an unencrypted salary spreadsheet. Confidentiality is breached immediately. If the clerk's cached credentials are reused, integrity and availability may also be affected. The control gaps are missing full-disk encryption, excessive bulk-export rights, and no data-loss monitoring. The correct fix is data minimization plus encryption plus least privilege plus detection, not simply buying antivirus.
Traps that cost marks
- Mixing authentication with authorization: a valid login does not imply permission.
- Calling a vulnerability a threat: a threat is who or what can exploit; a vulnerability is the weakness.
- Assuming encryption alone gives integrity unless authenticated encryption is used.
- Treating zero trust as a product rather than an architecture built on verify explicitly, least privilege, and assume breach.