Domain 1: General Security Concepts — What to Focus On
Domain 1 is one of the smaller domains by weight, but it sets the foundation for everything else. Get these concepts solid and the other domains make more sense.
> Domain weightings are set by CompTIA and change with each exam version — confirm the current objectives at comptia.org.
Must-Know Topics
CIA Triad
- Confidentiality: keeping data private (encryption, access controls)
- Integrity: keeping data accurate and unaltered (hashing, digital signatures)
- Availability: keeping systems accessible (redundancy, backups, load balancing)
AAA Framework
- Authentication: proving who you are
- Authorization: what you're allowed to do
- Accounting: logging what you did
Zero Trust
- "Never trust, always verify"
- Microsegmentation, least privilege, continuous verification
- Expect to see 3–5 questions on zero trust concepts
Security Controls
- Types: technical, managerial, operational, physical
- Functions: preventive, detective, corrective, deterrent, compensating
- Know examples of each combination (e.g., a firewall is a technical preventive control)
Threat Actors
- Nation-states, hacktivists, organised crime, insider threats, script kiddies
- Know their motivations and typical TTPs
Study Tips
Domain 1 is conceptual — no hands-on labs needed. Use flashcards for the control types matrix and threat actor characteristics. Focus on understanding why each concept matters, not just definitions.