Security Controls, CIA, and AAA: Domain 1 Without the Fog
A clear map of CompTIA Security+ control categories and types, plus CIA, AAA, Zero Trust, and physical/deception concepts that show up on SY0-701.
Your manager forwards an audit finding: "Install cameras in the server room." You reply that cameras are detective and maybe deterrent, but they do not prevent badge cloning. The auditor pushes back—"Isn't physical security preventive?" You stall because the question mixed control category (physical) with control type (preventive vs detective). Domain 1 on SY0-701 lives in that vocabulary layer. Get it wrong early, and every later scenario about IR, cloud, or phishing feels like trick questions when it is really classification under pressure.
Domain 1 is only 12% of the exam by weight, but it is the grammar of Security+. This post maps categories vs types, CIA and extensions, AAA, Zero Trust in exam language, physical and deception controls, and change management—with examples, traps, and practice you can do in an hour.
Control categories: how controls are implemented
Categories describe the nature of the control—who or what primarily enforces it.
| Category | Primary enforcer | Typical examples | Why it matters on the exam |
|---|---|---|---|
| Technical | Systems, software, hardware config | Firewall ACLs, encryption, EDR, FIM | Stems with "configure" or "automated block" lean technical |
| Managerial | Governance, risk, planning | Risk assessments, policies, vuln management program | "Program" and "framework" often signal managerial |
| Operational | People following procedures | Awareness training, backup process, IR playbooks | Human execution without necessarily coding |
| Physical | Facility and tangible barriers | Locks, fences, mantraps, bollards, guard staff | Protects the room that holds the servers |
Real environments blur lines. A badge reader is physical and technical. Security awareness is operational and supports managerial policy goals. Exam writers usually want the best fit for the stem's emphasis: if the question highlights "security guard checks IDs," lean physical/operational over "install antivirus."
Worked example: classifying a backup strategy
A company runs nightly encrypted backups to an offsite vault, with restore tests quarterly and a documented owner.
- Technical: encryption of backup media, backup software schedules
- Operational: quarterly restore test executed by ops staff
- Managerial: ownership, RPO/RTO alignment in risk docs
- Physical: offsite vault provider's facility controls
If the stem asks which category is primary for "ensuring backups occur on schedule," operational (process + people) beats picking encryption alone.
Control types: what job the control performs
Types describe purpose—what the control tries to accomplish in the security lifecycle.
| Type | Job | Examples | Exam distractors |
|---|---|---|---|
| Preventive | Stop incident before impact | MFA, firewall deny rules, encryption of data at rest | Confused with "deterrent" when block is absolute |
| Deterrent | Discourage attempting | Warning banners, visible cameras, guard presence | Cameras also detect—read whether stem says "discourage" vs "notice" |
| Detective | Identify that something happened | IDS alerts, audit logs, SIEM correlation | Not the same as "preventive monitoring" that blocks |
| Corrective | Fix or restore after event | Restore from backup, patch after incident, account lockout reset after investigation | Patch before breach is preventive; after is corrective |
| Compensating | Alternative when preferred control infeasible | Network isolation when legacy OS cannot run EDR | Not "extra nice-to-have controls" |
| Directive | Mandate behavior | Policies, standards, AUPs, training requirements | Often paired with operational enforcement |
Comparison table: preventive vs detective vs corrective
| Scenario | Best type | Why |
|---|---|---|
| EDR blocks known malware execution | Preventive | Stops the event |
| SIEM fires on impossible travel login | Detective | Flags suspicious activity; may not block yet |
| Reimage host after confirmed compromise | Corrective | Restores known-good state post-incident |
| Security awareness reduces click rate | Preventive (for human vector) | Aims to stop phishing success |
| Honeytoken credential used in auth attempt | Detective | High-fidelity signal of misuse |
Exam trap: "Logging" is almost always detective unless the log triggers an automated block (then you get detective + preventive layers). AUP is directive; firing someone for violating it is HR/legal outcome—not a control type rename.
CIA triad and extensions
Confidentiality — limit disclosure to authorized parties. Tools: encryption, access controls, need-to-know, DLP, classification labels.
Integrity — data and systems remain accurate and trustworthy. Tools: hashing, digital signatures, change control, FIM, version control, least privilege for writes.
Availability — authorized use when needed. Tools: redundancy, patching for stability, DDoS mitigation, backups, capacity planning, maintenance windows.
Security decisions often trade among CIA elements. Encrypting everything maximizes confidentiality but can complicate availability if key management fails. Aggressive patching improves integrity/availability against known bugs but risks availability if patches break production.
Non-repudiation
Non-repudiation — a party cannot credibly deny having performed an action. Achieved through digital signatures, strong authentication bound to identity, and tamper-evident audit trails. Exams link non-repudiation to integrity of attribution, not secrecy.
Worked example: online banking transfer
- Confidentiality: TLS protects account data in transit; RBAC limits who sees balances.
- Integrity: transaction records hashed/signed; server-side validation prevents amount tampering.
- Availability: load-balanced web front ends, DR site for failover.
- Non-repudiation: customer confirms with MFA; bank logs immutable audit entry tied to user cert or strong session identity.
Ask "which property is violated?" if a stem describes altered log files (integrity), leaked PDF (confidentiality), or ransomware downtime (availability).
AAA: authentication, authorization, accounting
| Pillar | Question answered | Examples |
|---|---|---|
| Authentication | Who are you? | Password, MFA, biometrics, certificates, SSO at login |
| Authorization | What may you do? | RBAC, ABAC, ACLs, group policy, IAM policies |
| Accounting | What did you do? | Audit logs, session records, billing-style usage trails |
Exam trap: SSO simplifies authentication across apps; each app still needs authorization rules. "Single sign-on" does not mean "single permission everywhere."
Authorization models (high level)
- DAC (discretionary access control) — owner decides sharing (typical file ACLs).
- MAC (mandatory access control) — labels/classifications enforced by system (government-style).
- RBAC (role-based) — permissions bundled into job roles.
- ABAC (attribute-based) — policies on attributes (department, device health, time of day).
Scenario pattern: "Contractors may access CRM only business hours from managed devices" → ABAC flavor, possibly with Zero Trust device posture checks.
Zero Trust in SY0-701 language
Marketing slides vary; exam Zero Trust converges on:
- Never trust, always verify — network location does not imply trust.
- Least privilege — minimal access for the task, time-bound where possible.
- Assume breach — design for lateral movement containment and strong detection.
Control plane concepts: identity, policy engine, policy administrator, continuous validation.
Data plane concepts: subjects (users/devices), resources, policy enforcement points (PEPs) that allow/deny/enforce encryption.
| Traditional perimeter thinking | Zero Trust exam angle |
|---|---|
| "Inside VPN = trusted" | VPN user still needs app-level MFA and device compliance |
| Flat VLAN | Microsegmentation limits east-west movement |
| Static firewall rules once | Policy adapts to identity and context |
Why it matters: stems describe a compromised laptop on the "trusted" LAN. Correct answers shrink blast radius (segmentation, PAM, continuous auth), not "change the Wi-Fi password" alone.
Physical security and environmental controls
Physical controls protect facilities that host logical assets:
- Access control vestibules / mantraps — prevent tailgating
- Bollards, fencing, lighting — deter and delay
- Badge systems, biometrics at door — authenticate physical presence
- Environmental: fire suppression, HVAC, humidity for hardware availability
Couple physical with logical: a stolen laptop matters less if FDE and strong auth protect confidentiality; the physical theft still triggers detective asset tracking and corrective remote wipe.
Deception technology
Deception aims to detect adversaries early and sometimes delay them:
| Asset | Purpose | Signal quality |
|---|---|---|
| Honeypot | Single decoy system | Touch = suspicious |
| Honeynet | Decoy network segment | Broader interaction logging |
| Honeyfile / honeytoken | Bait document or fake credential | Very high fidelity if never used legitimately |
Exam trap: honeypots are detective, not preventive—they assume an attacker is already inside. Placement and monitoring matter; an unmonitored honeypot is theater.
Change management as security control
Uncontrolled change is a top source of outages and vulnerabilities. Change management bundles:
- Request and approval with business owner
- Impact analysis and test results
- Backout plan if deploy fails
- Maintenance window communication
- Updated diagrams and docs after change
Security stems ask what failed after a "quick patch Friday night": missing rollback, untested dependency, firewall rule left open, legacy system incompatible with new TLS. The corrective fix is process; the preventive fix is enforcing the process next time.
Common Domain 1 exam traps (quick reference)
- Backup restore → corrective + availability, not preventive.
- Security awareness → operational, often preventive for social engineering.
- Hashing passwords → integrity/verification, not confidentiality of password (salt + slow hash).
- Cameras → detective/deterrent; rarely preventive unless paired with active blocking (unusual).
- Compensating control → only when primary control cannot be applied.
How to practice in one sitting
- Take 15 real-world controls at your job (VPN, MDM, badge reader, SIEM rule). Sort each into one primary category and one primary type. Debate edge cases aloud.
- Write three scenarios that violate each CIA pillar; swap with a study partner to label.
- Sketch Zero Trust with one user, one PEP, one policy engine, one protected app—60 second timer.
- For change management, write a "bad change" story and list which phases were skipped.
Domain 1 rewards crisp vocabulary. Nail categories vs types and CIA/AAA, and Domain 2 threat scenarios become "which control type breaks this vector?" instead of memorization roulette.