Find each foundational concept hidden in the grid. Selecting a word reveals its definition and a link to study it in depth.
12 terms · Choose how you want to study
New to the CompTIA Security+ exam? Read our how-to-pass guide →
The CIA triad — Confidentiality, Integrity, Availability — is the foundational model for information security.
Every security control ultimately maps to one or more triad pillars — encryption serves Confidentiality, hashing and digital signatures serve Integrity, and redundancy and backups serve Availability. Some extended models add non-repudiation and authenticity, but CIA remains the SY0-701 default and the lens for classifying any control or threat.
Assurance that data has not been altered in an unauthorized or undetected way.
Integrity controls let a recipient detect any unauthorized change — a checksum mismatch on a downloaded file, a failed digital-signature check, or an altered log entry. Hashing (SHA-256) detects accidental or malicious modification, while digital signatures layer authentication and non-repudiation on top of integrity.
Assurance that systems and data are accessible when authorized users need them.
SLAs commonly measure availability as “nines” of uptime — 99.9% (three nines) allows roughly 8.8 hours of downtime per year, while 99.999% (five nines) allows about five minutes. Availability controls include redundancy, load balancing, failover clustering, and off-site backups; the chief threats are DoS/DDoS attacks, hardware failure, and ransomware.
Proving an identity claim using something you know, have, are, or somewhere you are.
The four factor categories are something you know (password, PIN), have (token, smart card), are (biometric), and somewhere you are (location). Strong authentication combines different categories — two passwords are not MFA, because both are “something you know.” Phishing-resistant factors such as FIDO2/WebAuthn hardware keys are the current gold standard.
Granting an authenticated principal permission to perform specific actions on resources.
RBAC grants permissions by job role, ABAC evaluates attributes (department, device, time of day) at access time, and DAC lets resource owners set permissions at their discretion; MAC enforces central labels and is reserved for high-security environments. Authorization always follows authentication — you cannot scope what a principal may do until you have established who they are.
Recording what authenticated users do so actions can be reviewed and attributed.
Centralized logging is the practical implementation of accounting — forwarding events to a SIEM so they can be correlated, retained, and protected from tampering. Effective accounting depends on synchronized time (NTP) across sources so events can be sequenced, and on write-once or access-controlled storage so the logs themselves can’t be altered to cover an attacker’s tracks.
Assurance that a sender cannot credibly deny having sent a message.
Non-repudiation ties an action to an identity in a way the actor can’t later disown. Digital signatures provide it because only the holder of the private key could have produced the signature; symmetric MACs do not, because both parties share the same key and either could have generated it. In operations, signed actions plus tamper-evident logging give a defensible audit trail.
Multi-factor authentication — combining two or more distinct factor categories.
MFA combines two or more different factor categories, so a stolen password alone can’t grant access. Not all factors are equal: SMS one-time codes are phishable and SIM-swappable, and push approvals are vulnerable to MFA-fatigue (prompt-bombing) attacks, while phishing-resistant factors such as FIDO2/WebAuthn hardware keys bind the credential to the legitimate site and are the strongest option.
Identity and Access Management — the discipline of managing digital identities and their access.
IAM spans the full identity lifecycle — provisioning, authentication, authorization, and prompt de-provisioning when a user leaves (orphaned accounts are a classic audit finding). Federated identity (SAML, OIDC) extends IAM across organizational boundaries so one identity provider can grant access to many services, enabling single sign-on without each app storing its own credentials.
Authentication using a physical or behavioral trait — fingerprint, face, voice, gait.
FAR (false acceptance rate) and FRR (false rejection rate) trade off against each other; the crossover error rate (CER), where the two are equal, is the standard single-number accuracy measure — lower CER is better. Because a biometric trait can’t be reissued once compromised, biometrics work best as one factor within MFA rather than as a sole credential.
An approved, documented secure configuration that systems are compared against.
CIS Benchmarks and DISA STIGs are common baseline sources that prescribe hardened configurations per platform. Once a baseline is approved, configuration-management tooling enforces it and reports deviations; unexplained drift from baseline is a leading indicator of misconfiguration or compromise and a frequent SIEM detection rule.
The difference between current state and a desired/required security state.
A gap analysis compares the current security posture against a target framework (NIST CSF, ISO 27001, CIS Controls) and catalogs each delta. The prioritized output — which gaps carry the most risk and what they cost to close — feeds the security roadmap, budget requests, and the risk register.
All General Security Concepts sets and terms → · All CompTIA Security+ study games → · Not sure where to start? Take the CompTIA Security+ diagnostic →