CompTIA Security+ SY0-701 Study Guide: Security Fundamentals and Identity Management

Course section: Security Fundamentals and Identity Management Estimated course time: 8 hours Coverage: 5 modules, 83 practice questions Purpose: Full exam-focused study notes for this Security+ course section. This is original study material, not a transcript, Coursera quiz copy, or real CompTIA exam content.

How To Use This Guide

1. Read one module at a time.
2. Memorize the high-yield anchors first.
3. Work through the module details and lab notes.
4. Take the matching practice-question bank.
5. Review missed questions by returning to the named section.
6. Retest until you can score at least 85%, with 90% or better as the comfort target.

Exam Context

• Exam code: SY0-701
• Official format: up to 90 questions in 90 minutes, with multiple-choice and performance-based items.
• Official passing score: 750 on a 100-900 scaled score. The app's 85%, 90%, and 95% thresholds are local study targets, not conversions or validated predictions of exam success.
• Official domains: General Security Concepts 12%; Threats, Vulnerabilities, and Mitigations 22%; Security Architecture 18%; Security Operations 28%; Security Program Management and Oversight 20%.

High-Yield Memory Anchors

• CIA triad: confidentiality controls access, integrity protects correctness, availability keeps services usable.
• Risk is likelihood times impact in plain language; treatment is avoid, transfer, mitigate, accept, or share.
• Controls have both category and function: managerial, operational, technical, physical; preventive, detective, corrective, deterrent, compensating, directive.
• Hashing is not encryption. Hashing supports integrity and password storage; encryption supports confidentiality.
• MFA requires factors from different categories. Two passwords are not MFA.
• Authentication verifies identity; authorization decides permitted actions. Accounting records activity. Anonymous access can also have authorization rules.

Course Map

1. Getting Started with CompTIA Security+ (SY0-701) - Security+ is an applied security exam. It rewards candidates who can choose a control, process, or tool for a scenario rather than merely reciting definitions. Treat each topic as a decision point: what asset is at risk, what threat is active, what control reduces the risk, and what evidence proves the control worked?
2. Risk Management - Risk management connects technical security to business outcomes. A vulnerability is not automatically the top priority; priority depends on asset value, exposure, likelihood, impact, existing controls, compliance requirements, and business tolerance.
3. Foundations of Cryptography - Cryptography protects confidentiality, integrity, authentication, and non-repudiation when implemented correctly. The exam usually tests which cryptographic tool fits the job and what can go wrong when keys, algorithms, or protocols are weak.
4. Physical Security - Physical access often bypasses logical controls. Security+ expects you to connect facilities controls, environmental protections, and hardware threats to confidentiality, integrity, and availability.
5. Identity and Account Management - Identity is the control plane for modern security. The exam expects you to distinguish identification, authentication, authorization, and accounting, then apply MFA, federation, account lifecycle, and network authentication to realistic access problems.

Study Notes

Getting Started with CompTIA Security+ (SY0-701)

Big Picture

Security+ is an applied security exam. It rewards candidates who can choose a control, process, or tool for a scenario rather than merely reciting definitions. Treat each topic as a decision point: what asset is at risk, what threat is active, what control reduces the risk, and what evidence proves the control worked?

Must Know

• Know the five SY0-701 domains and their weights.
• Practice under time pressure: roughly one minute per question, with extra time reserved for PBQ-style scenarios.
• Expect wording that asks for BEST, FIRST, MOST likely, or NEXT action.
• Separate official scaled scoring from local practice percentages; the scales are not directly comparable.

Exam strategy

Read the final sentence first when a question is long. Identify whether it asks for a technology, governance action, detection clue, or response step. Eliminate answers that are true but do not answer the scenario.

PBQ mindset

Performance-based items usually test process and architecture: place controls, interpret logs, match ports/protocols, order response steps, or classify data and access. Even when practicing with multiple-choice items, think through the action you would take in a lab.

Readiness target

Use 85% as this bank's local review threshold and 90% as a stretch target. Repeated questions can inflate scores through recall; independently explain unfamiliar scenarios and practice performance-based tasks. No local percentage establishes that you will pass the real exam.

Hands-On Practice

• Build a personal objective checklist. Mark each objective as explain, apply, or weak.
• Do short timed runs and review every miss by concept, not by memorizing the answer letter.

Exam Traps

• Do not convert 750/900 into a simple percent. CompTIA scoring is scaled.
• Do not ignore PBQ-style practice just because a local test is multiple choice.

Quick Self-Check

• Can you explain the concept without looking at the acronym?
• Can you choose the best control or next step in a scenario?
• Can you name what evidence would prove the control worked?
• Can you identify the most likely distractor answer and why it is wrong?

Risk Management

Big Picture

Risk management connects technical security to business outcomes. A vulnerability is not automatically the top priority; priority depends on asset value, exposure, likelihood, impact, existing controls, compliance requirements, and business tolerance.

Must Know

• Define asset, threat, vulnerability, exploit, likelihood, impact, inherent risk, residual risk, and risk appetite.
• Compare quantitative and qualitative risk assessments.
• Recognize risk treatment decisions: avoid, transfer, mitigate, accept, and share.
• Classify controls by type and function.
• Apply the data lifecycle from creation through destruction.

CIA triad

Confidentiality limits unauthorized disclosure, integrity limits unauthorized or accidental alteration, and availability keeps systems and data accessible when needed. Many questions hide the CIA property inside a scenario: ransomware often affects availability first, tampering affects integrity, and leaked records affect confidentiality.

Threat actors

Actors vary by motivation and capability. Nation-states tend to have funding and patience; organized crime seeks profit; insiders have trusted access; hacktivists seek influence; unskilled attackers often rely on existing tools; shadow IT creates unmanaged exposure even without malicious intent.

Threat intelligence

Threat intelligence can be strategic, tactical, operational, or technical. Indicators of compromise are useful, but context matters: a hash, IP, or domain should feed detection, blocking, hunting, or awareness only after validation.

Controls

Preventive controls stop or reduce events before they occur. Detective controls identify events. Corrective controls restore normal operation. Deterrent controls discourage behavior. Compensating controls are alternatives when the preferred control is not practical.

Quantitative risk

Know SLE, ARO, and ALE conceptually. Single loss expectancy estimates one event; annualized rate of occurrence estimates frequency; annualized loss expectancy estimates yearly impact.

For a simple model, SLE = asset value x exposure factor and ALE = SLE x ARO. A $100,000 asset with 40% loss per event has $40,000 SLE; at 0.25 events/year its ALE is $10,000/year. These are estimates, not guaranteed losses. Compare a proposed control's annual cost with the estimated annual loss reduction while retaining uncertainty, residual risk, and mandatory requirements. See NIST SP 800-30 Rev. 1 for assessment context.

Qualitative risk

Qualitative ranking uses labels such as low, medium, and high. It is faster and common when exact numbers are unavailable, but it must still be consistent and documented.

Risk terms and responses

A threat is a potential cause of harm; a vulnerability is a weakness that can be exploited. Risk considers both the likelihood of harm and its impact. Risk appetite is the broad willingness to take risk; risk tolerance is a more specific acceptable boundary, such as a maximum loss limit. See the NIST risk glossary and vulnerability glossary.

Avoidance stops the risky activity. Mitigation reduces likelihood or impact through safeguards. Acceptance retains the risk through an authorized decision. Transference assigns specified consequences to another party, such as insured financial losses; it does not remove the technical weakness or every responsibility.

A policy states management direction, a standard specifies mandatory requirements, a procedure gives operational steps, and a guideline recommends a practice. A data owner decides classification and permitted use; a custodian implements handling controls.

Recovery targets

Recovery time objective (RTO) is the target time to restore a service. Recovery point objective (RPO) is the acceptable data-loss window measured in time. A two-hour RTO and a fifteen-minute RPO mean different things: restore usable service within two hours and lose no more than fifteen minutes of data. Mean time between failures (MTBF) describes reliability; mean time to repair (MTTR) describes observed repair duration, not the business's restoration target. The NIST contingency planning guide provides recovery-planning context.

Data lifecycle

Creation, classification, storage, usage, sharing, retention, archiving, and destruction all need controls. Classification drives handling: public, internal, confidential, restricted, regulated, or other local labels.

An approved retention schedule defines normal disposal dates. A legal hold suspends disposal for records within its approved scope, including when their normal retention period expires. Preserve held records and their integrity; counsel or privacy personnel resolve the applicable duties. For a verified deletion request, held invoices do not automatically justify retaining an unrelated marketing profile. Delete eligible records outside the hold under the approved procedure, and document the scope and decision. The ICO's right-to-erasure guidance distinguishes eligible erasure from necessary retention for legal obligations or claims; its jurisdiction-specific rules are not universal deadlines.

Data destruction

Match sanitization to the medium, sensitivity, and disposition policy. Ordinary overwriting may miss SSD remapped cells; degaussing is for suitable magnetic media, not flash. Cryptographic erase depends on encryption and key-lifecycle prerequisites. Physical damage is not necessarily sufficient destruction. Use an approved media-specific technique and verify its result, with asset-level disposition records.

Hands-On Practice

• Create a small risk register with asset, threat, vulnerability, likelihood, impact, control, owner, and residual risk.
• Classify several sample data types such as public marketing copy, payroll records, source code, and authentication logs.

Exam Traps

• Insurance transfers financial risk; it does not remove technical risk.
• Deleting a file is not secure destruction.
• A high-severity vulnerability on an isolated low-value asset may rank below a moderate issue on a critical exposed system.

Quick Self-Check

• Can you explain the concept without looking at the acronym?
• Can you choose the best control or next step in a scenario?
• Can you name what evidence would prove the control worked?
• Can you identify the most likely distractor answer and why it is wrong?

Foundations of Cryptography

Big Picture

Cryptography protects confidentiality, integrity, authentication, and non-repudiation when implemented correctly. The exam usually tests which cryptographic tool fits the job and what can go wrong when keys, algorithms, or protocols are weak.

Must Know

• Distinguish hashing, symmetric encryption, asymmetric encryption, digital signatures, certificates, and key exchange.
• Know why salts and slow password hashing matter.
• Understand public/private key roles at a high level.
• Recognize common cryptographic attacks and poor implementation choices.

Hashing

A hash produces a fixed-length digest. It should be one-way and collision-resistant for security uses. Hashes verify integrity, but a bare fast hash is not enough for password storage. Password storage needs salts and slow/adaptive algorithms.

Symmetric encryption

Symmetric encryption uses the same secret to encrypt and decrypt. It is efficient for files, disks, databases, VPN payloads, and bulk data. The main challenge is securely sharing and protecting the secret key.

Asymmetric encryption

Asymmetric systems use public and private keys. They are useful for key exchange, signatures, certificates, and authentication. They are slower than symmetric encryption, so real protocols often use asymmetric methods to establish symmetric session keys.

Digital signatures

A signature is created with a private key and verified with the public key. It supports integrity, origin authentication, and non-repudiation when the private key is protected.

Signing does not hide the message or keep its delivery service available. Hashing, encryption, and signing solve different problems: a digest supports change detection, encryption protects confidentiality, and a trusted public-key signature supports integrity and signer authentication. See the NIST digital-signature glossary.

Certificates and trust

Certificates bind identity information to public keys. Trust depends on certificate authorities, expiration, revocation, subject/SAN matching, and correct chain validation.

The certificate does not contain the subject's private key. Key escrow is controlled safekeeping of recovery material for authorized release; key rotation replaces an active key, key exchange establishes keying material, and key stretching increases the cost of guessing a secret.

Password cracking

Offline cracking becomes easier when password hashes are stolen and are unsalted or computed with fast algorithms. MFA, lockout, rate limiting, salted slow hashing, and password managers all reduce different parts of password risk.

SSH public key authentication

The server stores the public key. The user protects the private key. A passphrase on the private key protects it if the key file is stolen.

Hands-On Practice

• Generate an SSH key pair in a lab and identify which file is public and which must remain private.
• Compare a file hash before and after editing a file to see integrity detection.

Exam Traps

• Hashing is not reversible encryption.
• Encoding is not encryption.
• A certificate can be validly signed but still wrong for the hostname if the subject/SAN does not match.

Quick Self-Check

• Can you explain the concept without looking at the acronym?
• Can you choose the best control or next step in a scenario?
• Can you name what evidence would prove the control worked?
• Can you identify the most likely distractor answer and why it is wrong?

Physical Security

Big Picture

Physical access often bypasses logical controls. Security+ expects you to connect facilities controls, environmental protections, and hardware threats to confidentiality, integrity, and availability.

Must Know

• Identify physical access controls such as locks, badges, guards, mantraps, visitor logs, cages, and cameras.
• Recognize environmental controls: HVAC, humidity, fire suppression, power, UPS, generators, and water detection.
• Understand physical attack examples such as keyloggers, malicious USB devices, shoulder surfing, tailgating, and device theft.

Layered facility controls

A secure facility usually layers perimeter controls, reception controls, access badges, mantraps, locked rooms, racks or cages, cameras, and logs. No single control is enough for high-value equipment.

Environmental availability

Temperature, humidity, smoke, fire, water, and unstable power can become security issues because they affect availability and safety. UPS devices cover short outages; generators support longer outages; fire suppression should match the environment.

Physical audit evidence

Visitor logs, badge records, camera footage, maintenance records, and rack access records can support investigations and compliance reviews.

Preserve original controller logs and relevant configuration before changing a source clock. Record its offset from trusted time, the measurement time, time zone, and uncertainty. A collector heartbeat or receipt timestamp is not the time a door opened. Normalize a working timeline using the documented offset while retaining the original timestamps and evidence; correcting the clock does not retroactively explain earlier events. See NIST SP 800-86 for forensic collection and preservation context and Evidence Correlation And Time Normalization for a worked calculation.

Hardware keyloggers and malicious peripherals

A hardware keylogger between a keyboard and workstation can capture credentials. Malicious USB devices can emulate keyboards or network adapters. Port control and user awareness matter.

Hands-On Practice

• Walk through a room and list what protects access, power, cooling, fire, water, and visitor activity.
• Draw a simple control map from building entrance to server rack.

Exam Traps

• Encryption does not make physical security irrelevant.
• A camera is detective, not preventive, unless paired with active monitoring and response.
• Fire suppression and HVAC are availability controls, not just facilities concerns.

Quick Self-Check

• Can you explain the concept without looking at the acronym?
• Can you choose the best control or next step in a scenario?
• Can you name what evidence would prove the control worked?
• Can you identify the most likely distractor answer and why it is wrong?

Identity and Account Management

Big Picture

Identity is the control plane for modern security. The exam expects you to distinguish identification, authentication, authorization, and accounting, then apply MFA, federation, account lifecycle, and network authentication to realistic access problems.

Must Know

• Define identification, authentication, authorization, and accounting.
• Distinguish knowledge, possession, and inherence factors. SY0-701 also lists location in its factor terminology; in NIST assurance design, location is a contextual signal, not an independent authenticator factor. Behavioral observations likewise do not automatically establish a separate factor.
• Compare DAC, MAC, RBAC, ABAC, and rule-based access.
• Understand provisioning, deprovisioning, privileged access, reviews, and shared account risks.
• Recognize federation and SSO concepts such as SAML, OAuth, and OIDC at a high level.

AAA and IAM

Identification is the identity claim, authentication verifies it, authorization grants or denies access, and accounting records activity. A user may authenticate successfully and still be denied access because authorization fails.

MFA

True MFA uses different factor categories. Password plus PIN is still one category. Password plus authenticator app or hardware token uses two categories. Biometrics are convenient but require secure template storage and fallback planning.

Access control schemes

DAC is owner controlled, MAC is label and policy controlled, RBAC maps access to job roles, ABAC uses attributes such as user, resource, action, device, and location, and rule-based systems apply defined conditions.

Least privilege and separation of duties

Users should receive only the access needed for their role. Sensitive processes may require two people or separate roles to prevent fraud or mistakes.

Account lifecycle

Provisioning, modification, review, suspension, and deprovisioning should tie to HR and management processes. Dormant accounts, shared accounts, and unmanaged service accounts create investigation and privilege risk.

Network authentication

802.1X, EAP, RADIUS, TACACS+, Kerberos, and certificates can control network or service access. Know the purpose more than vendor syntax.

Federation and SSO

Federation lets an identity provider assert identity to service providers. SSO improves user experience and centralizes control, but it increases the importance of protecting the identity provider.

Hands-On Practice

• Create a sample joiner-mover-leaver checklist for access changes.
• Map three job roles to least-privilege access and identify one separation-of-duties conflict.

Exam Traps

• Authentication is not authorization.
• Two knowledge factors are not MFA.
• Shared admin accounts reduce accountability even when they seem convenient.

Quick Self-Check

• Can you explain the concept without looking at the acronym?
• Can you choose the best control or next step in a scenario?
• Can you name what evidence would prove the control worked?
• Can you identify the most likely distractor answer and why it is wrong?

Final Review Checklist

• I can map the course topics to the SY0-701 domains.
• I can explain each major control in plain language and identify whether it is preventive, detective, corrective, deterrent, compensating, managerial, operational, technical, or physical.
• I can answer scenario questions by identifying the asset, threat, vulnerability, impact, and best next action.
• I can distinguish implementation/tool questions from governance/process questions.
• I can describe how I would perform labs safely and only with authorization.
• I can score at least 85% locally and preferably 90% or better across multiple randomized tests.

Deep Review Tables

Risk And Governance Terms

Governance determines who approves account-review policy and exceptions. A central security governance committee with enterprise approval authority can make those decisions while local teams implement the controls. Independent business-unit approval instead distributes decision authority. An advisory council without an approval mandate recommends changes; an external auditor assesses compliance rather than becoming the policy approver. This is a governance structure, not a single-sign-on architecture. SY0-701 objective 5.1 includes governance structures and roles; federation and SSO remain distinct IAM topics.

Control Classification Drill

Cryptography Decision Guide

Identity Decision Guide

Scenario Drills

1. A finance server stores sensitive records and is missing a critical patch, but it is not internet-facing. A public test server is internet-facing and has a medium vulnerability. Which is higher priority? The answer depends on impact, exposure, exploitability, and business context. Do not rank by severity label alone.
2. A user can sign in but cannot access a folder. This is not an authentication failure; it is authorization.
3. A web download has a published SHA-256 hash. Use it to verify integrity, not confidentiality.
4. A company keeps old backup tapes. Choose destruction by sensitivity and medium; do not assume deletion or formatting is enough.
5. A camera catches tailgating after the fact. The camera is detective; a mantrap or guard is more preventive.

September 2026 Applied Review

These additions connect the existing notes to decisions and evidence. The scope is CompTIA's SY0-701 objectives, version 6.0, not a prediction of future exam content. All worked examples are invented learning scenarios.

Control Function And Zero Trust Decisions

Ask two different questions: what implements the safeguard, and what does it accomplish here? A policy approval is managerial; a gateway rule is technical. A guard physically stopping entry is preventive, while a recorded camera image is detective. A posted instruction is directive even if it never blocks a door. A compensating control is an approved substitute meeting a protection objective when the preferred safeguard is unavailable, not simply any extra layer. These distinctions help apply the control families in NIST SP 800-53 Rev. 5.

Worked comparison: a controller cannot run a host firewall. The owner approves restrictive gateway filtering until replacement. Its category is technical, its blocking function preventive, and its relationship to the unavailable host control compensating. Insurance might pay some losses but would not supply that filtering function. Write down what the alternative actually protects and the risk it leaves.

In zero trust, separate the decision from its execution. The policy engine decides; the policy administrator coordinates the path; the policy enforcement point permits or stops actual access. A successful control-plane message is not proof of effective data-plane denial. Correlate decision ID, session ID, delivery acknowledgement, and resource access. This follows the logical components in NIST SP 800-207, section 3.

Example: decision=deny, termination=sent, followed by a successful resource request indicates an enforcement or delivery gap to investigate. Re-enrolling the user does not explain the failed termination. Test behavior at the resource without assuming an internal IP, a company-owned device, or an earlier login supplies permanent trust.

Deception needs similar evidence discipline. A honeypot is a decoy service; a honeynet is a collection of decoys; a honeyfile is a decoy document; a honeytoken can be a monitored fake credential. None should grant real business privilege. Record the trigger and validate whether a sanctioned scanner or indexing service caused it before declaring compromise.

Server Hardening Basics

Server hardening includes disabling listening services that the server's approved role does not require. This removes network entry points; longer log retention and protected backups serve different investigation and recovery needs. Check service dependencies against the baseline, test the change, and retain a rollback path. See NIST SP 800-123, Guide to General Server Security.

Cryptographic Lifecycle And Change Evidence

A certificate's signature, validity period, intended usage, revocation status, and service identity are separate checks. A chain reaching a trusted root does not authorize every hostname. A DNS SAN of *.example.com can cover api.example.com but not api.eu.example.com or the bare example.com. Use a SAN that actually identifies the service. See RFC 9525, service identity and wildcard matching.

A CSR includes a public key and requested identity details; the private key is not sent to the CA. Domain-control validation is a separate issuance requirement. Protect root and intermediate signing keys, constrain issuance roles, and plan renewal before expiry. OCSP supplies per-certificate status; a CRL supplies a list. Neither an unavailable status responder nor a valid certificate implies that application content is safe. A self-signed certificate can be deliberately trusted in a controlled environment but does not acquire public trust merely by existing.

Use a TPM for device-bound protection and measured-state key release, an HSM for protected service-scale cryptographic operations, and a key-management system for lifecycle policy, rotation, permissions, and audit. A secure enclave isolates selected processing; it is not a blanket guarantee that every application query is private. Protect key backups and recovery authority as carefully as active keys.

Worked change: browser tests pass after disabling legacy TLS, but a settlement agent runs only overnight. The approval packet still needs a representative settlement test, dependency owner, maintenance window, restart requirements, prior configuration, and rollback trigger. Record who can restore service and what exposure a rollback reintroduces. Certificate replacement and protocol hardening are changes to a dependency graph, not just a checkbox.

Common errors: unauthenticated key exchange does not establish who the peer is; a digital signature does not prove software is free of malicious behavior; deleting a leaked key from a repository does not remove copies already obtained. Contain key exposure, rotate or revoke as appropriate, re-protect dependent data, and validate recovery before destroying the last usable recovery key.

Phishing Resistant Authentication And Recovery

Knowledge, possession, and inherence are distinct factors. A PIN that locally activates a cryptographic security key can combine knowledge with possession when user verification is required. It is not the same as typing two passwords into a website. Location and device reputation are useful policy inputs, but do not by themselves create NIST MFA.

WebAuthn/FIDO2 binds authentication to the relying party. Manually typed OTPs and ordinary push approvals do not provide equivalent resistance to an impostor verifier. Number matching can reduce accidental approvals without becoming cryptographic phishing resistance. Passwordless also does not automatically mean multifactor: verify the authenticator and activation configuration. See NIST SP 800-63B-4 authenticator requirements.

Password policy should distinguish exam vocabulary from deployment guidance. NIST's current minimum is 15 characters for a password used alone; a password used only within MFA may be at least eight. It calls for compromised/common-password screening, suitable salted password hashing, and rate limiting, not routine arbitrary password changes or mandatory composition patterns. Change a password when compromise is indicated. See NIST's password rationale.

Worked recovery: a caller knows an executive's biography but lacks the enrolled authenticator. Public facts and a newly supplied email address are not sufficient recovery proof. Use the documented verification path, escalate exceptions, revoke lost authenticators, notify the legitimate subscriber, and log replacement binding. A weak recovery route can undo strong everyday authentication. NIST's recovery threat discussion explains why recovery needs its own controls.

Common error: restricting online guesses does not slow offline guesses against a stolen verifier database. Salt and hashing cost address that separate exposure. Conversely, stronger hashing does not protect a user who willingly supplies a current OTP to an impostor.

Authentication Sessions And Revocation

Authentication is an event; a session continues access afterward. Distinguish the identity-provider session, refresh token, API access token, and application-owned session cookie. Resetting a password or revoking a refresh token does not automatically terminate all of those objects. Microsoft specifically documents that an application controls its own session token. See Microsoft's emergency access-revocation guidance.

Worked timeline: at 10:00 an account is disabled; at 10:02 its refresh token is rejected; at 10:04 a SaaS cookie still reads a report. The first two outcomes do not contradict the third. Ask the application owner to invalidate its session and verify denial at the resource. Preserve a redacted session identifier, principal, device, time, action, and result, never the usable cookie itself.

Reauthentication, idle timeouts, absolute lifetimes, and session-risk evaluation limit different exposures. A user actively using a stolen session may never reach an idle timeout. Revocation signals can shorten exposure, but only supported clients and services enforce them. Microsoft continuous access evaluation documents integration and propagation limitations; do not assume universal instantaneous invalidation. NIST session guidance separates session continuity from the original authentication.

For joiners, movers, and leavers, check authoritative HR or contract events, group changes, app-local roles, active sessions, badges, and service ownership. Removing a directory group can leave local permissions behind. A just-in-time role expiry limits standing privilege but must be tested against cached application authorization. Review emergency identities and recovery paths without making them dependent on the same failed service they are intended to recover.

Federation And Token Validation

SAML commonly carries signed federation assertions. OAuth delegates access to resources; an authorization grant alone is not a user-authentication assertion. OIDC layers identity onto OAuth and gives the client an ID token. The resource server uses the appropriate access-token contract, not an arbitrary ID token.

For an OIDC ID token, validate trusted issuer and signature, audience, time limits, and relevant transaction-binding values such as nonce. A signature from the right issuer still fails if the token was issued solely for another client. In a worked example, aud=benefits-web must not authenticate a user to payroll-web. See OpenID Connect Core, ID Token Validation.

RBAC suits stable job permissions; ABAC can combine subject, resource, action, device, and environment. DAC delegates choices to an owner, while MAC uses centrally enforced labels. Rule-based restrictions such as time windows can supplement these models. Authenticate the identity, then evaluate the actual operation and object: successful SSO does not authorize every tenant's invoices. Account reviews need resource-level evidence, not only a list of people able to log in.

Data Stewardship And Sanitization

An owner decides classification and permitted use; a custodian implements handling. A steward commonly maintains quality and metadata. Controller and processor are privacy roles determined by purpose and instructions, not by whose disks store the data. Classification, encryption, masking, tokenization, retention, and access restrictions solve different problems.

Example: support needs the last four digits of an account number. Return that minimized field from the service, not the full value hidden by browser styling. Encryption at rest protects storage; it does not stop an authorized API from exposing plaintext. Tokenization replaces values with references whose mapping needs independent protection. Steganography conceals the presence of information and is not automatically encryption.

For disposition, distinguish clear, purge, and destroy. An SSD may retain data outside normal logical writes. Cryptographic erase depends on sound encryption throughout the relevant lifecycle and effective sanitization of all necessary keys, including recoverable copies. Document asset serials, method, operator, verification, and approval. Follow NIST SP 800-88 Rev. 2, not a universal overwrite-count rule. A legal hold suspends disposal only for its approved scope; counsel resolves legal conflicts.

Physical And Ledger Coverage Notes

Choose physical controls by the hazard. Bollards resist vehicle entry; fences define barriers; access vestibules control passage; lighting improves visibility or deterrence. Infrared, pressure, microwave, and ultrasonic sensors detect different physical conditions and need environmental tuning. Detection without an observed signal or response is not automatic prevention. Suppression and emergency egress require qualified facilities design; a security preference must not override life safety.

A hash-linked distributed ledger can make changes evident under its consensus and governance assumptions. It does not make an inaccurate entry true, hide public transactions, or recover a lost signing key. A supplier can immutably record the wrong serial number. This distinction between record integrity and real-world truth is the useful Security+ lesson from NIST IR 8202.