Security Controls, CIA, and AAA: The Grammar of Security+

Your manager forwards an audit finding: "Install cameras in the server room." You reply that cameras are detective and maybe deterrent — they notice and discourage — but they do not prevent badge cloning. The auditor pushes back: "Isn't physical security preventive?" You stall because the question mixed control category (physical — how the control is implemented) with control type (preventive, deterrent, or detective — what job it performs). Domain 1 on SY0-701 lives entirely in that vocabulary layer. Get the grammar wrong, and every later scenario about IR, cloud, or phishing feels like a trick question when the issue is really misclassification under time pressure.

Domain 1 is only 12% of the exam by weight, but it is the vocabulary foundation every other domain builds on. This post maps categories versus types, CIA and non-repudiation, AAA, separation of duties, defense in depth, Zero Trust in the exam's terms, and change management — with exam traps named out loud at the end.

Control categories — how a control is implemented

A category describes the nature of the control: who or what primarily enforces it. Security+ recognizes four, and distinguishing them matters because scenario stems often emphasize one dimension while answer choices span all four.

Technical controls live in systems, software, and hardware configuration — firewall ACLs, encryption, EDR, file integrity monitoring. Anything enforced without continuous human action is technical. When a stem says "configure" or "automated block," technical is usually the right category.

Managerial controls belong to governance, risk, and planning. A vulnerability management program, a risk assessment, a security policy framework. The words "program" and "framework" in a stem almost always signal managerial — they create structure rather than operating in real time.

Operational controls involve people following defined procedures. Security awareness training, a documented backup process, an incident response playbook — executed by humans rather than automatically. An untrained employee represents an operational failure even when all the technical gear is in place.

Physical controls protect facilities and tangible assets. Locks, mantraps, bollards, badge readers, guards, fencing. Physical and technical blur at the edges — a badge reader is physical in enforcement but relies on a technical system behind it. The exam expects best-fit based on the stem's emphasis.

A worked example anchors all four. A company runs nightly encrypted backups to an offsite vault and tests restores quarterly. The encryption of media is technical. The quarterly test executed by the operations team is operational — a human must run it. Documented RPO/RTO ownership in governance records is managerial. The vault provider's locked cage, climate control, and visitor logs are physical. If the stem asks which category is primary for "ensuring backups run on schedule," the answer is operational — a person initiates and verifies the process rather than a system doing it autonomously.

Control types — what job the control performs

A few boundaries deserve special attention. Logging is almost always detective unless the log feeds a rule that triggers an automated block — then you have detective and preventive layers working together, and distinguishing them is the point. A security awareness training requirement in an AUP is directive; the click-rate reduction it produces is preventive for the social engineering vector. Backup restore is corrective — you restore after an event — not preventive, however tempting that framing seems.

CIA — naming what broke

The triad is familiar. What trips candidates is applying it under time pressure when a stem describes a violation rather than asking for a definition.

Confidentiality is violated when information reaches someone who should not have it — a misconfigured bucket exposing employee PII, a database record visible to the wrong user, a file leaked in transit. Encryption, access control, DLP, and classification labels that govern handling policy all protect it.

Integrity is violated when data or systems are modified in unauthorized or undetected ways — altered log files, a tampered transaction record, a configuration changed outside change management. Hashing and digital signatures detect modification; FIM raises the alarm when something changes; least privilege for write operations limits who can change what in the first place.

Availability is violated when authorized users cannot reach the resource they need — ransomware encrypting file shares, a DDoS exhausting bandwidth, a misconfigured update crashing a production service Saturday night. Redundancy, DDoS mitigation, backup and recovery, and capacity planning all serve it. The failure mode for availability is access denied to legitimate users, which distinguishes it cleanly from confidentiality failures where access is granted to illegitimate ones.

Security decisions trade among these. Encrypting everything improves confidentiality but can threaten availability if key management fails during an incident. Aggressive patching improves integrity and availability against known bugs but introduces its own outage risk if a patch breaks compatibility.

Non-repudiation ensures that a party cannot credibly deny having taken an action — achieved through digital signatures bound to verified identity and tamper-evident audit trails. Security+ links it to integrity of attribution, not secrecy. Shared accounts and shared passwords undermine it completely: there is no cryptographic way to attribute an action to a specific individual when five people share the same credential.

AAA — three different questions

Authentication answers who are you? — passwords, MFA, biometrics, certificates, and the assertion that arrives from an SSO federation. Authorization answers what may you do? — RBAC group memberships, ABAC policies, ACLs, and IAM permission sets evaluated after identity is confirmed. Accounting answers what did you do? — session records, audit logs, and usage trails that support forensics, compliance reporting, and sometimes billing.

The classic exam trap is single sign-on. SSO simplifies authentication — the user proves identity once at the identity provider, and the assertion travels to many service providers. It does not touch authorization. Each application still enforces its own permission model independently. "SSO is configured" does not mean the contractor can access everything; it means the contractor can prove identity once, and each application decides separately what that identity may do.

Authorization models in exam shorthand: DAC lets the resource owner decide who shares their own files, typical of standard file ACLs. MAC applies mandatory labels enforced by the system — classification-level controls common in government environments. RBAC bundles permissions into job roles so rights follow the position rather than the person. ABAC adds contextual attributes — device health, time of day, department, clearance — to express policies that roles alone cannot capture. A stem where contractors get CRM access only during business hours from managed devices describes ABAC logic, and often pairs with Zero Trust device posture checks.

Separation of duties and need-to-know — the human side of least privilege

Least privilege gets most of the access control discussion, but two related concepts appear reliably on SY0-701 and deserve a paragraph each because they describe different dimensions of the same problem.

Separation of duties means that no single person can complete a sensitive transaction from start to finish without another person's involvement. A developer who can write code, deploy it to production, and approve their own changes is a control failure waiting to become an insider incident. A finance user who initiates wire transfers should not also approve them. The exam frames these as fraud prevention and error detection — if any step requires a second party, both accidents and deliberate manipulation become harder to hide.

Need-to-know is the information-access companion. Even within a role that grants broad system access, personnel should only receive the specific data their current assignment requires. A security analyst needs log data; they do not necessarily need HR records even if both reside in the same platform. Least privilege governs what operations you may perform; need-to-know governs which information you may see — a distinction the exam tests through insider-threat and data-classification stems.

Defense in depth as a story

Defense in depth is not a product category or a checklist — it is a philosophy that the exam tests through narrative. The idea is that any single control can fail, so you layer controls at different points along the attack path so that an attacker's progress requires defeating multiple independent mechanisms rather than one.

Here is what that story looks like as a concrete scenario. An external attacker targets a payroll server. At the perimeter, a firewall with default-deny drops unsolicited inbound traffic and permits only the specific ports the payroll application needs. If that fails — perhaps through a zero-day in the VPN appliance — the network is segmented so the payroll VLAN is isolated from general employee subnets, sharply limiting lateral movement. On the host, EDR monitors for unusual process chains. The payroll application requires MFA from a named service account with just-in-time elevation rather than a shared password. Audit logs flow to a SIEM tuned to payroll-server access outside business hours. Backups run offline and get tested monthly. Each layer operates independently; defeating one does not disable the others. That is the defense-in-depth story the exam expects when a stem asks how to reduce blast radius or limit the impact of a compromise already in progress.

Zero Trust — the exam's version, briefly

Zero Trust shows up in Domain 1 as a philosophy, not a product architecture. The companion post on Zero Trust and secure enterprise architecture covers the policy engine, policy administrator, and policy enforcement points in full. For this domain, three ideas are sufficient: network location does not imply trust; access is least-privilege and time-bound where possible; and the design assumes breach so lateral movement is constrained even after a single endpoint is compromised.

The practical exam cue: when a stem describes a compromised laptop on the "trusted" LAN asking what prevents the attacker from reaching a sensitive database, strong answers involve microsegmentation, MFA at the application tier, and PAM-controlled service credentials — not "check the perimeter firewall."

Physical controls and deception technology

Physical controls protect the facilities that house every logical asset. Mantraps and vestibules prevent tailgating. Bollards and fencing deter and delay physical approach. Biometrics at server room doors authenticate physical presence beyond what a cloned badge alone provides. A stolen laptop matters less if FDE protects confidentiality — but the physical theft still triggers detective asset tracking and corrective remote wipe.

Deception technology earns a reliable place on Security+. A honeypot is a decoy system — any interaction is suspicious because no legitimate user has reason to reach it. A honeynet extends that to a decoy network segment. A honeyfile or honeytoken is a fake credential or document; if it appears in an authentication attempt, someone inside the network is doing something they should not. All three are detective controls that assume the attacker is already past the perimeter, generating high-fidelity alerts precisely because legitimate users never interact with them. An unmonitored honeypot is theater.

Change management as a security control

Uncontrolled change is among the most common sources of both unexpected outages and newly introduced vulnerabilities. The Security+ change management framework requires a business-owner approval, impact analysis with test results, a documented backout plan, a maintenance window communicated in advance, and updated diagrams after the change completes.

The exam frames this retrospectively. A quick Friday-night patch that takes down production skipped impact analysis, testing, and the backout plan. A firewall rule that opened port 1433 to the internet survived because nobody updated the network diagram the next reviewer would check. The corrective fix for one failure is process accountability; the preventive fix is enforcing the process before the next change runs.

Exam traps summary

Closing

Domain 1 is the grammar that makes every other domain legible. When you can answer "what category, what type, and which CIA property?" without hesitation, scenario stems in Domains 2 through 4 stop feeling arbitrary. Get the grammar right, and Security+ becomes translation work rather than memorization.

Companion reading: the Threats, Vulnerabilities, and Mitigations post maps these control types to specific attack mitigations. The Zero Trust and Secure Architecture post covers how separation of duties, microsegmentation, and policy enforcement points operate in modern enterprise design.