SY0-801 general security concepts explained
General Security Concepts is worth 16% of SY0-801. It has three objectives: security concepts and controls (1.1), the effect of change management on security (1.2), and appropriate cryptographic solutions (1.3). It is the shortest domain by objective count but the vocabulary appears in every other domain, so errors here cost marks everywhere.
1.1 Security concepts and controls
The core concepts are defence in depth, the CIA triad (confidentiality, integrity, availability), AAA (authentication, authorization, accounting), non-repudiation, Zero Trust principles and least privilege.
Controls are classified in two ways, and questions mix them.
| Control category | Examples |
|---|---|
| Technical/logical | Firewalls, encryption, access control lists |
| Managerial/administrative | Policies, risk assessments |
| Physical/environmental | Locks, fences, cameras |
| Operational | Procedures carried out by people, such as awareness training |
| Control type | Purpose |
|---|---|
| Preventive | Stop an event happening |
| Deterring | Discourage an attempt |
| Detective | Identify an event that occurs |
| Corrective | Limit damage and restore |
| Compensating | Substitute when the primary control is not possible |
| Directive | Tell people what to do |
A camera is physical in category and detective in type. A policy is managerial and directive. Read what the question asks for: category or type.
1.2 Change management
This objective asks how change processes affect security. Know the business side (change advisory board, approval process, ownership, stakeholders, impact analysis, test results, backout planning, fail forward, maintenance window, standard operating procedures) and the technical side (allow and deny lists, restricted activities, downtime, service and application restarts, legacy applications, dependencies). Documentation matters too: update diagrams, policies and procedures, and use version control.
The scenario pattern is a risky change. The best answer usually has a tested plan, approval, a backout plan, and a window with minimal business impact.
1.3 Cryptographic solutions
| Topic | What to know |
|---|---|
| PKI | Public and private keys, certificates, certificate authorities, key escrow, CRLs, OCSP, self-signed versus third-party, root of trust, CSR generation, wildcard certificates |
| Encryption levels | Full disk, partition, file, volume, database, record, transport/communication |
| Symmetric vs asymmetric | Symmetric is fast and used for bulk data; asymmetric solves key exchange and signatures |
| Other | Key length, digital signatures, salting, hashing, obfuscation |
A typical TLS session uses asymmetric cryptography to agree on a session key and symmetric cryptography for the traffic. Hashing is one-way and used for integrity; salting makes stored password hashes harder to attack in bulk.
Example questions
Question 1. A browser must check in near real time whether a website's certificate has been revoked, without downloading a complete list of revoked certificates. Which mechanism should be used?
- A. A certificate revocation list
- B. A certificate signing request
- C. Online Certificate Status Protocol
- D. Key escrow
Show answer
Answer: C
OCSP answers a status query for a single certificate. A CRL is a downloaded list that can be stale and large. A CSR is a request to obtain a certificate, and key escrow is the safekeeping of private keys for recovery.
Want more questions like this? Full SY0-801 practice tests →
Question 2. Before a firewall change goes to production, the change advisory board asks what the team will do if the change breaks connectivity. Which element are they asking for?
- A. Impact analysis
- B. Backout plan
- C. Maintenance window
- D. Standard operating procedure
Show answer
Answer: B
A backout plan defines how to return to the previous state if the change fails. Impact analysis estimates effects before the change, a maintenance window is when to make it, and an SOP documents a routine procedure rather than a rollback.
Want more questions like this? Full SY0-801 practice tests →
Question 3. A legacy system cannot support multifactor authentication. The team isolates it in its own segment, allows access only through a logged jump host, and reviews the logs weekly. Which control type is this?
- A. Compensating
- B. Corrective
- C. Deterring
- D. Directive
Show answer
Answer: A
A compensating control substitutes for a requirement that cannot be met directly. It is not directive, since it does not just instruct people, not corrective, since nothing has failed yet, and not deterring, since the goal is to reduce risk rather than discourage attempts.
Want more questions like this? Full SY0-801 practice tests →
Revision tips
Make flash cards for the control types with one example each, and practise answering “category or type?” before choosing an option. For cryptography, learn which tool solves which problem (confidentiality, integrity, authenticity, non-repudiation) rather than algorithm details. Next, see threats, vulnerabilities and attacks or return to the study plan.