RANGER CompTIA Security+ (SY0-701) · chapter 2 of 27
Day 3: Who changed the price list?
In this chapter Objectives 1.2
Objective 1.2
The CIA triad and non-repudiation
Confidentiality, integrity, availability
The CIA triad is the core goal of security. Confidentiality keeps data secret from anyone not authorized (encryption, access controls, MFA). Integrity makes sure data is stored and moved without unauthorized change and that changes can be detected (hashing, digital signatures, certificates). Availability makes sure systems and data are there when authorized people need them (redundancy, fault tolerance, patching, DDoS protection).
Exam tip Map the attack to the leg it hurts: data leak = confidentiality, tampering = integrity, outage or DDoS = availability.
Non-repudiation
Non-repudiation means someone cannot credibly deny they did something, such as sending a message or approving a payment. It needs two proofs: proof of integrity (the message was not changed, shown with a hash) and proof of origin (it came from this sender, shown with a digital signature made with the sender's private key). Only the sender holds that private key, so only they could have signed it.
Exam tip Exam trap: a hash alone gives integrity, not non-repudiation. Anyone can compute a hash. Non-repudiation needs the private-key signature.
Why it matters at Kibble & Co.
If Rosa's price file is signed by whoever last approved it, any later change breaks the signature (integrity) and the signature names the approver (origin). That is the difference between "we think Jim did it" and "we can prove it".
- Hash = was it changed?
- Signature = who sent it, and was it changed?
- Encryption = who can read it?
Exam tip Memory trick: hashing proves WHAT, signing proves WHO and WHAT, encryption hides it.
Check yourself 1Mr. Barkley approves vendor payments by email. Finance wants proof that he really sent each approval and can't later deny it. What should they use?
- Hash each email with SHA-256
- Encrypt each email with TLS
- Digitally sign each email
- Request a read receipt on each
Show the answer
Answer: C. Digitally sign each email
A digital signature uses the sender's private key, proving origin and integrity, which gives non-repudiation. A hash alone proves only that the message wasn't changed, and anyone can make one.
Objective 1.2
AAA: authentication, authorization, accounting
The AAA framework
Identification is claiming an identity (typing a username). Authentication proves it (password, MFA, certificate). Authorization decides what that identity may do. Accounting records what it actually did: login time, resources used, data sent and received, logout time. An AAA server (often reached through RADIUS or TACACS+) handles all three for VPNs, Wi-Fi and network devices.
Exam tip Order on the exam: identify, authenticate, authorize, account. Accounting is the logging leg, and it is what makes an investigation possible.
Authenticating people and authenticating systems
Authenticating people uses factors such as something you know, have or are, ideally MFA. Authenticating systems proves a device is one of yours, even with no person at the keyboard. The usual way is a device certificate signed by the company's own CA and installed on approved laptops; 802.1X checks it before the device joins the network.
Exam tip Clue: "only company-owned laptops may join the VPN, whoever signs in" points to certificates that authenticate the device (system), not the user.
Authorization models
Giving rights to each person one by one does not scale. Authorization models put an abstraction between users and resources: users go into a role or group (Shipping Clerks), and the role gets the rights. Add a new clerk to the group and they get the right access; remove them and it's gone. Common models include role-based, rule-based, attribute-based, discretionary and mandatory (covered in depth with identity management).
Exam tip Why it matters: models make access consistent and easy to audit. Per-user rights drift and pile up (privilege creep).
Objective 1.2
Gap analysis
Where are we vs. where should we be?
A gap analysis compares the organization's current security posture with a target, usually a framework or standard such as the NIST Cybersecurity Framework or ISO/IEC 27001. Steps: pick the target, document the current state (a baseline) for people, processes and technology, compare, list the gaps, then build a plan with costs and timelines to close them. The result is a gap analysis report.
Exam tip It is a planning tool, not a hunt for an attacker or a scan for missing patches. Clue words: "compare current state with", "framework", "roadmap".
Gap analysis at Kibble & Co.
Priya compares Kibble & Co. with the framework the board picked. Example gaps: no MFA on the shop admin panel, no written incident response plan, backups never test-restored. Each gap becomes a project with an owner and a date.
Requirement Current Gap? ------------------ -------------- ---- MFA for admins Password only YES IR plan documented None YES Backups tested Never YES Disk encryption All laptops no
Exam tip Trap: a vulnerability scan finds technical flaws; a gap analysis measures the whole program against a standard.
Check yourself 2Priya compares Kibble & Co.'s current policies, staffing and tools with the controls in ISO/IEC 27001 to plan next year's budget. What is she doing?
- Penetration test
- Gap analysis
- Vulnerability scan
- Impact analysis
Show the answer
Answer: B. Gap analysis
Comparing the current state with a target framework to find what's missing is a gap analysis. A vulnerability scan only looks for technical flaws in systems, not policies or staffing.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.