Fundamental Security Concepts
Summarize fundamental security concepts
This is the broadest objective on the SY0-701 exam. It covers the CIA triad, Non-repudiation, AAA (Authentication, Authorization, Accounting), Gap analysis, Zero Trust (Control Plane vs. Data Plane), Physical security (bollards, vestibules, fencing, surveillance, sensors), and Deception technology (honeypot, honeynet, honeyfile, honeytoken).
The key insight: Zero Trust is where the exam goes deep. It splits into the Control Plane (where decisions are made: Policy Engine, Policy Administrator, adaptive identity, threat scope reduction) and the Data Plane (where decisions are enforced: Policy Enforcement Point, subjects, systems, implicit trust zones eliminated).
CIA Triad: Confidentiality (only authorized access), Integrity (data is accurate and unmodified), Availability (systems accessible when needed). Non-repudiation ensures someone cannot deny an action — typically via digital signatures or audit logs.
AAA Framework:
- Authentication — proving identity. For people: passwords, biometrics, tokens. For systems: certificates, API keys.
- Authorization — what you're allowed to do after proving identity. Models: RBAC (role-based), ABAC (attribute-based), DAC (discretionary — owner decides), MAC (mandatory — system/labels decide).
- Accounting — logging what happened. Audit trails, SIEM, session logs. Without accounting, you can't prove what occurred.
Zero Trust Architecture:
- Control Plane (decisions) — Policy Engine evaluates access requests against policy. Policy Administrator establishes/removes sessions. Adaptive identity adjusts trust based on context (location, device, behavior). Threat scope reduction minimizes blast radius by limiting access.
- Data Plane (enforcement) — Policy Enforcement Point (PEP) is the gatekeeper that allows or blocks access. Subjects/Systems are the entities requesting access. Implicit trust zones are eliminated — no device or user is trusted by default, even inside the network.
Physical Security: Bollards (vehicle barriers), vestibules/mantraps (two-door entry), fencing (perimeter), surveillance cameras, motion/infrared/pressure sensors, security guards, badge readers, lighting.
Deception Technology:
- Honeypot — a fake system designed to attract attackers and study their behavior
- Honeynet — a network of honeypots simulating a full environment
- Honeyfile — a fake document (e.g., "passwords.xlsx") that triggers an alert when opened
- Honeytoken — a fake data element (fake credentials, fake database record) that triggers alerts when used
| Concept | Components | Key Distinction |
|---|---|---|
| CIA | Confidentiality, Integrity, Availability | Foundation of all security decisions |
| AAA | Authentication, Authorization, Accounting | Who are you? What can you do? What did you do? |
| Non-repudiation | Digital signatures, audit logs | You cannot deny you did it |
| Zero Trust Plane | Components | Function |
|---|---|---|
| Control Plane | Policy Engine, Policy Administrator, Adaptive Identity, Threat Scope Reduction | Makes access decisions based on policy and context |
| Data Plane | Policy Enforcement Point, Subject/System, Implicit Trust Zones (eliminated) | Enforces access decisions; blocks or allows traffic |
| Deception Tech | What It Is | What Triggers It |
|---|---|---|
| Honeypot | Fake system (server, service) | Attacker interacts with it |
| Honeynet | Network of honeypots | Attacker moves laterally through fake network |
| Honeyfile | Fake document (e.g., "passwords.xlsx") | File is opened or accessed |
| Honeytoken | Fake data element (credential, record) | Token is used or queried |
Control Plane = where decisions are made. Data Plane = where decisions are enforced. The Policy Engine decides. The Policy Enforcement Point enforces. If the exam asks "which component restricts access" — that's the PEP (Data Plane), not the Policy Engine (Control Plane).
A mid-size financial firm provides VPN access to remote employees. Once connected, users can reach almost any internal resource. The CISO is pushing for a Zero Trust overhaul.
VPN Overhaul
Financial firm · 800 employees · Full VPN accessMigration path: Zero Trust isn't a product you buy — it's an architecture you build over time. Start with identity (strong MFA), then add device posture checking, then microsegmentation, then continuous monitoring. The exam tests the architecture, not the migration plan.
Most organizations are somewhere between "VPN for everyone" and full Zero Trust. The Security+ exam tests the ideal model. In practice, you'll implement it incrementally — starting with the highest-risk resources (finance, PII, admin access) and expanding from there.
On the exam: Zero Trust questions focus on the architecture components. Know which belongs to Control Plane vs. Data Plane. The Policy Enforcement Point is always in the Data Plane.
The firm's VPN was exploited via a compromised employee laptop. Management wants immediate remediation. Two proposals are on the table:
MAC Address Filtering on VPN
Only allow known device MAC addresses to connect. Quick to implement, low cost. But MAC addresses can be spoofed, and once connected, users still have broad access.
Zero Trust Architecture
Continuous verification per resource. Policy Engine evaluates every request. Policy Enforcement Points restrict lateral movement. No implicit trust even for authenticated users.
Option B is correct — Zero Trust eliminates implicit trust
Option B: Zero Trust architecture addresses the root problem: once a user (or attacker) authenticates, they shouldn't automatically have broad access. Every access request is verified independently. MAC filtering is trivially bypassed and doesn't solve the lateral movement problem.
Option A's kernel of truth: Device identification has value as one signal in a Zero Trust model. But alone, MAC filtering provides a false sense of security. MAC addresses are spoofable in seconds with freely available tools.
On the exam: Zero Trust is the modern standard for network access. Any answer that relies on implicit trust after initial authentication is outdated thinking.
Zero Trust architecture questions are high-frequency on the SY0-701. Know the exact components in each plane. Control Plane: Policy Engine, Policy Administrator, Adaptive Identity, Threat Scope Reduction. Data Plane: Policy Enforcement Point, Subject/System. When you see "restricts," "blocks," or "enforces" — think Data Plane (PEP). When you see "evaluates," "decides," or "adapts" — think Control Plane.
- A Policy Engine
- B Adaptive Identity
- C Threat Scope Reduction
- D Policy Enforcement Point
Correct: D. The Policy Enforcement Point (PEP) operates in the Data Plane and is the gatekeeper that allows or blocks access to resources. It enforces the decisions made by the Policy Engine (Control Plane). Policy Engine evaluates (A is Control Plane). Adaptive Identity and Threat Scope Reduction are also Control Plane components.