Security Principles & Controls

Classifying Impacts with the CIA Triad

Evidence: Mixed

Revision: Available · 6 questions · 2 flashcards

Exam relevance

• Security+ · 1.2 · direct

  Mapped on 8 October 2026 for the “Confidentiality, Integrity, and Availability (CIA)” bullet only. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 4 of 6 questions and 1 of 2 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 7): the session introduced the CIA triad of confidentiality, integrity and availability, opening with the question of what you would not want strangers to see.
• Classroom (Session 7): the security properties were related to a water-treatment environment.
• Supplementary: to classify an impact, ask whether someone saw or obtained information without authorisation (confidentiality), whether information is now wrong, altered or incomplete without authorisation (integrity), and whether authorised people cannot use the system or information when needed (availability); one event can affect more than one objective.
• Supplementary: in the medical-record example, a stranger reading the record is a confidentiality failure, an unauthorised change to a diagnosis or medication is an integrity failure, and authorised staff being unable to open the record when needed is an availability failure.
• Supplementary: reading is not changing, so disclosure alone does not show an integrity failure; information that is present but wrong is an integrity matter, and information that is correct but unreachable is an availability matter.
• Supplementary: confidentiality means only authorised people or systems should be able to access information; integrity means information should remain accurate, complete and protected from unauthorised modification; availability means authorised users should be able to access systems and data when required.
• Supplementary: in a water-treatment environment, confidentiality covers plant diagrams, administrator credentials, chemical-setting information and security procedures; integrity covers sensor readings and control settings, where altered dosing or falsified readings could cause physical harm; availability covers the monitoring and control systems.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• CIA Triad — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): the session introduced the CIA triad of confidentiality, integrity and availability, opening with the question of what you would not want strangers to see.
• Classroom (Session 7): the security properties were related to a water-treatment environment.
• Supplementary: to classify an impact, ask whether someone saw or obtained information without authorisation (confidentiality), whether information is now wrong, altered or incomplete without authorisation (integrity), and whether authorised people cannot use the system or information when needed (availability); one event can affect more than one objective.
• Supplementary: in the medical-record example, a stranger reading the record is a confidentiality failure, an unauthorised change to a diagnosis or medication is an integrity failure, and authorised staff being unable to open the record when needed is an availability failure.
• Supplementary: reading is not changing, so disclosure alone does not show an integrity failure; information that is present but wrong is an integrity matter, and information that is correct but unreachable is an availability matter.
• Supplementary: confidentiality means only authorised people or systems should be able to access information; integrity means information should remain accurate, complete and protected from unauthorised modification; availability means authorised users should be able to access systems and data when required.
• Supplementary: in a water-treatment environment, confidentiality covers plant diagrams, administrator credentials, chemical-setting information and security procedures; integrity covers sensor readings and control settings, where altered dosing or falsified readings could cause physical harm; availability covers the monitoring and control systems.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• CIA Triad — Supplementary Study Guide explanation · One record, three questions; Classifying an impact; Three pairs that are easy to confuse; Beyond the triad

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the CIA Triad lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

CIA Triad

Evidence: Mixed

Revision: Available · 4 questions · 2 flashcards

Exam relevance

• Security+ · 1.2 · direct

  This concept relates to the cited objective. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 2 of 4 questions and 1 of 2 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Confidentiality restricts information to authorised people.
• Integrity protects information from unauthorised modification.
• Availability keeps systems and information accessible when required.
• The supplementary booking example separates confidentiality, integrity and availability; encryption does not repair record-level authorisation and backups do not undo disclosure.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• CIA Triad — Supplementary Study Guide explanation

Recorded evidence

• Confidentiality restricts information to authorised people.
• Integrity protects information from unauthorised modification.
• Availability keeps systems and information accessible when required.
• The supplementary booking example separates confidentiality, integrity and availability; encryption does not repair record-level authorisation and backups do not undo disclosure.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• CIA Triad — Supplementary Study Guide explanation · The idea; Putting it into context; Confidentiality: who may see the information?; Integrity: can users rely on the record?; Availability: can authorised people use the service?; Controls to consider; One incident can affect several objectives; Further reading

Reviewed 2026-09-23. Reviewed against approved Sessions 1–2 and Study Buddy Core Concepts. Scenarios are fictional educational applications, not completed practical work. This concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Security Control Categories

Evidence: Mixed

Revision: Available · 8 questions · 4 flashcards

Exam relevance

• Security+ · 1.1 · direct

  Mapped on 8 October 2026 for the “Categories” bullet (technical, managerial, operational, physical). The three-category administrative model also taught here is not the objective’s model. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 2 of 8 questions and 1 of 4 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 7): the control categories covered were managerial, operational, technical and physical, and managerial controls were explained in terms of management and board oversight.
• Classroom (Session 7): in the football-stadium analogy, executives and management set policies and rules (managerial), stewards and staff carry out procedures (operational), technology performs or enforces functions (technical), and gates, barriers, turnstiles and locked areas are physical.
• Classroom (Session 7): the term Administrative (Management) Controls was used later in the session.
• Supplementary: the managerial category means governance and oversight mechanisms such as policies and risk assessments, not the managers themselves, and VAR was only an analogy for technology doing a job, not a cybersecurity control.
• Supplementary: a category describes how a control is implemented, which is a separate question from what it does; to choose one, ask what mainly makes the control work: a governance decision or rule (managerial), people following a process (operational), a system acting automatically (technical) or a physical object or barrier (physical), so a policy requiring a technical measure is itself managerial.
• Supplementary: administrative controls are based primarily on policies, procedures, governance, organisational rules, and people and processes, for example security policies, an acceptable-use policy, training, background checks, risk assessments, incident-response procedures, access reviews, segregation of duties and change-management procedures.
• Supplementary: frameworks divide controls differently: a three-category model uses administrative, technical and physical, the four-category model uses managerial, operational, technical and physical, and older NIST guidance uses management, operational and technical; administrative covers most of what the four-category model splits between managerial and operational, so check which model is in use.
• Supplementary: managerial controls are governance, oversight, policy and risk-management mechanisms; operational controls are implemented primarily through people and processes; technical controls are implemented or enforced through technology; physical controls protect buildings, equipment and physical access.
• Supplementary: examples in the four-category model are policies, governance and risk assessments (managerial); security awareness training and incident-response procedures (operational); MFA, encryption, firewalls and security software (technical); and locks, barriers and badge-controlled doors (physical).

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Security Controls: Categories and Functions — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): the control categories covered were managerial, operational, technical and physical, and managerial controls were explained in terms of management and board oversight.
• Classroom (Session 7): in the football-stadium analogy, executives and management set policies and rules (managerial), stewards and staff carry out procedures (operational), technology performs or enforces functions (technical), and gates, barriers, turnstiles and locked areas are physical.
• Classroom (Session 7): the term Administrative (Management) Controls was used later in the session.
• Supplementary: the managerial category means governance and oversight mechanisms such as policies and risk assessments, not the managers themselves, and VAR was only an analogy for technology doing a job, not a cybersecurity control.
• Supplementary: a category describes how a control is implemented, which is a separate question from what it does; to choose one, ask what mainly makes the control work: a governance decision or rule (managerial), people following a process (operational), a system acting automatically (technical) or a physical object or barrier (physical), so a policy requiring a technical measure is itself managerial.
• Supplementary: administrative controls are based primarily on policies, procedures, governance, organisational rules, and people and processes, for example security policies, an acceptable-use policy, training, background checks, risk assessments, incident-response procedures, access reviews, segregation of duties and change-management procedures.
• Supplementary: frameworks divide controls differently: a three-category model uses administrative, technical and physical, the four-category model uses managerial, operational, technical and physical, and older NIST guidance uses management, operational and technical; administrative covers most of what the four-category model splits between managerial and operational, so check which model is in use.
• Supplementary: managerial controls are governance, oversight, policy and risk-management mechanisms; operational controls are implemented primarily through people and processes; technical controls are implemented or enforced through technology; physical controls protect buildings, equipment and physical access.
• Supplementary: examples in the four-category model are policies, governance and risk assessments (managerial); security awareness training and incident-response procedures (operational); MFA, encryption, firewalls and security software (technical); and locks, barriers and badge-controlled doors (physical).

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Security Controls: Categories and Functions — Supplementary Study Guide explanation · What a security control is; Two questions about every control; Categories: how a control is implemented; The football-stadium analogy; Choosing the category; Functional types: what a control does; Before, during and after; Directive, deterrent and compensating; Compensating controls: a legacy system without MFA; Classifying a control both ways; Administrative, managerial and management controls; How this fits with defence in depth

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Security Controls: Categories and Functions lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Security Control Functional Types

Evidence: Mixed

Revision: Available · 7 questions · 5 flashcards

Exam relevance

• Security+ · 1.1 · direct

  Mapped on 8 October 2026 for the “Control types” bullet (preventive, deterrent, detective, corrective, compensating, directive). Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 2 of 7 questions and 3 of 5 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 7): a control was defined, approximately, as something used to mitigate a vulnerability or threat.
• Classroom (Session 7): the functional types covered were preventive, detective, corrective, directive, deterrent and compensating.
• Supplementary: a security control is a safeguard or measure that reduces risk by preventing, detecting, correcting, deterring or otherwise addressing threats and vulnerabilities; it normally reduces likelihood, impact or both and does not necessarily remove the threat or vulnerability.
• Supplementary: category asks how or where a control is implemented and function asks what it does; they are separate questions, a control usually has one category, and it can have more than one functional type.
• Supplementary: a directive control tells people who intend to follow the rules what the rules are, while a deterrent control makes someone thinking of breaking them think twice; a compensating control is not simply extra security, because it must stand in for a specific control and reach a similar objective another way.
• Supplementary: as a memory aid, preventive acts before (for example MFA, access controls, firewall rules and locked doors), detective acts during and discovers (for example IDS alerts, CCTV monitoring and log monitoring), and corrective acts after and fixes (for example restoring from backup, removing malware and reconfiguring a compromised system).
• Supplementary: a directive control tells people what they are expected to do, for example a policy, a procedure, security instructions or mandatory requirements; a deterrent control discourages unwanted behaviour, for example visible CCTV, warning signs, guards and monitored-system warning banners.
• Supplementary: a compensating control is an alternative safeguard used when the preferred control cannot be implemented; for a legacy system that cannot support MFA, possible compensating controls are restricting access to trusted networks or to a limited group, requiring a jump host, increasing logging and monitoring, and more frequent access reviews.
• Supplementary: MFA is technical and preventive; a policy is managerial and directive; CCTV is commonly classed as physical, although some sources treat cameras as technical, and it is detective, deterrent or both depending on use.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Security Controls: Categories and Functions — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): a control was defined, approximately, as something used to mitigate a vulnerability or threat.
• Classroom (Session 7): the functional types covered were preventive, detective, corrective, directive, deterrent and compensating.
• Supplementary: a security control is a safeguard or measure that reduces risk by preventing, detecting, correcting, deterring or otherwise addressing threats and vulnerabilities; it normally reduces likelihood, impact or both and does not necessarily remove the threat or vulnerability.
• Supplementary: category asks how or where a control is implemented and function asks what it does; they are separate questions, a control usually has one category, and it can have more than one functional type.
• Supplementary: a directive control tells people who intend to follow the rules what the rules are, while a deterrent control makes someone thinking of breaking them think twice; a compensating control is not simply extra security, because it must stand in for a specific control and reach a similar objective another way.
• Supplementary: as a memory aid, preventive acts before (for example MFA, access controls, firewall rules and locked doors), detective acts during and discovers (for example IDS alerts, CCTV monitoring and log monitoring), and corrective acts after and fixes (for example restoring from backup, removing malware and reconfiguring a compromised system).
• Supplementary: a directive control tells people what they are expected to do, for example a policy, a procedure, security instructions or mandatory requirements; a deterrent control discourages unwanted behaviour, for example visible CCTV, warning signs, guards and monitored-system warning banners.
• Supplementary: a compensating control is an alternative safeguard used when the preferred control cannot be implemented; for a legacy system that cannot support MFA, possible compensating controls are restricting access to trusted networks or to a limited group, requiring a jump host, increasing logging and monitoring, and more frequent access reviews.
• Supplementary: MFA is technical and preventive; a policy is managerial and directive; CCTV is commonly classed as physical, although some sources treat cameras as technical, and it is detective, deterrent or both depending on use.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Security Controls: Categories and Functions — Supplementary Study Guide explanation · What a security control is; Two questions about every control; Categories: how a control is implemented; The football-stadium analogy; Choosing the category; Functional types: what a control does; Before, during and after; Directive, deterrent and compensating; Compensating controls: a legacy system without MFA; Classifying a control both ways; Administrative, managerial and management controls; How this fits with defence in depth

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Security Controls: Categories and Functions lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

DAD Triad

Evidence: Mixed

Revision: Available · 3 questions · 3 flashcards

Exam relevance

• Security+ · 1.2 · supporting

  Course mnemonic supporting CIA; not an official objective term.

Verified for Security+: 0 of 3 questions and 0 of 3 flashcards. The mapping does not verify the others.

Reviewed revision scope

• The taught DAD wording is disclosure, alteration and denial.
• Disclosure threatens confidentiality, alteration threatens integrity, and denial threatens availability.
• The supplementary document-service example maps Disclosure, Alteration and Denial to CIA, distinguishes denial from destruction and avoids assuming every incident affects all objectives.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• DAD Triad — Supplementary Study Guide explanation

Recorded evidence

• The taught DAD wording is disclosure, alteration and denial.
• Disclosure threatens confidentiality, alteration threatens integrity, and denial threatens availability.
• The supplementary document-service example maps Disclosure, Alteration and Denial to CIA, distinguishes denial from destruction and avoids assuming every incident affects all objectives.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• DAD Triad — Supplementary Study Guide explanation · The idea; Disclosure; Alteration; Denial; Denial or destruction; A simple example; Separate the consequences before choosing controls; Change one fact, change the conclusion; Why it matters; Further reading

Reviewed 2026-09-23. Reviewed against approved Sessions 1–2 and Study Buddy Core Concepts. Scenarios are fictional educational applications, not completed practical work. This concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Defence in Depth

Evidence: Supplementary

Revision: Available · 4 questions · 3 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Supplementary defence in depth combines preventative, detective, responsive and recovery controls; MFA, patching, segmentation and backups have different limits and shared dependencies.

• Defence in Depth — Supplementary Study Guide explanation

Recorded evidence

• Supplementary defence in depth combines preventative, detective, responsive and recovery controls; MFA, patching, segmentation and backups have different limits and shared dependencies.

• Defence in Depth — Supplementary Study Guide explanation · The idea; A layered example; Follow the attack with defensive decisions; Authentication and appropriate access; Patching, segmentation and endpoint controls; Monitoring needs a response; Backups and recovery; Quality over quantity; Further reading

Reviewed 2026-09-23. Reviewed against approved Sessions 1–2 and Study Buddy Core Concepts. Scenarios are fictional educational applications, not completed practical work. This concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Non-Repudiation

Evidence: Mixed

Revision: Available · 7 questions · 3 flashcards

Exam relevance

• Security+ · 1.2 · direct

  Mapped on 8 October 2026 for the “Non-repudiation” bullet only. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 3 of 7 questions and 1 of 3 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 7): non-repudiation was discussed as an information-security property alongside confidentiality, integrity and availability.
• Classroom (Session 7): the security properties, including non-repudiation, were related to a water-treatment environment.
• Supplementary: non-repudiation is not part of the CIA triad, which has exactly three members; it is an additional security property.
• Supplementary: non-repudiation provides evidence and does not itself prevent modification; a signature lets a change be detected and a log lets an action be attributed, while preventing the change needs other controls.
• Supplementary: the evidence depends on each person acting as themselves and is weakened by shared accounts, stolen passwords or keys, records that the recorded person can alter, and unreliable time; it makes a denial not credible, not impossible.
• Supplementary: non-repudiation provides evidence that an action or communication occurred, so that a party cannot credibly deny having performed it; mechanisms that can provide it, depending on context, include digital signatures, certificates, timestamps and audit records.
• Supplementary: integrity asks whether the data has changed, while non-repudiation asks who performed the action and whether they can credibly deny it; with a digital signature, integrity can reveal that signed data was modified, and non-repudiation provides evidence linking the signing action to the signer’s key.
• Supplementary: in a water-treatment environment, authenticated actions, audit logs and digital records can provide evidence of who changed settings or approved actions.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
• Non-Repudiation — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 7): non-repudiation was discussed as an information-security property alongside confidentiality, integrity and availability.
• Classroom (Session 7): the security properties, including non-repudiation, were related to a water-treatment environment.
• Supplementary: non-repudiation is not part of the CIA triad, which has exactly three members; it is an additional security property.
• Supplementary: non-repudiation provides evidence and does not itself prevent modification; a signature lets a change be detected and a log lets an action be attributed, while preventing the change needs other controls.
• Supplementary: the evidence depends on each person acting as themselves and is weakened by shared accounts, stolen passwords or keys, records that the recorded person can alter, and unreliable time; it makes a denial not credible, not impossible.
• Supplementary: non-repudiation provides evidence that an action or communication occurred, so that a party cannot credibly deny having performed it; mechanisms that can provide it, depending on context, include digital signatures, certificates, timestamps and audit records.
• Supplementary: integrity asks whether the data has changed, while non-repudiation asks who performed the action and whether they can credibly deny it; with a digital signature, integrity can reveal that signed data was modified, and non-repudiation provides evidence linking the signing action to the signer’s key.
• Supplementary: in a water-treatment environment, authenticated actions, audit logs and digital records can provide evidence of who changed settings or approved actions.

• Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
• Non-Repudiation — Supplementary Study Guide explanation · The idea; A fourth property outside the triad; How non-repudiation is provided; Integrity and non-repudiation; Four properties at a water-treatment plant; Limits of the evidence

Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Non-Repudiation lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

People, Processes, Technology and IT/OT

Evidence: Mixed

Revision: Available · 2 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 2): information security brings together policies, processes and technical controls, and technical controls achieve little without trained people.
• Study Buddy (9 September): cybersecurity protects devices, networks, operating systems, applications, services and data, not only computers.
• Classroom (Session 4): IT supports information and business systems, while IACS and operational technology monitor or control physical processes, so security decisions there can affect physical operations and safety.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Study Buddy — 9 September 2026 — Study Buddy session (supplementary)

Recorded evidence

• Classroom (Session 2): information security brings together policies, processes and technical controls, and technical controls achieve little without trained people.
• Study Buddy (9 September): cybersecurity protects devices, networks, operating systems, applications, services and data, not only computers.
• Classroom (Session 4): IT supports information and business systems, while IACS and operational technology monitor or control physical processes, so security decisions there can affect physical operations and safety.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Study Buddy — 9 September 2026 — Study Buddy session (supplementary) · What We Are Trying to Protect; Learning Pathway; Switch Connections / Trunking; Virtual Machines

Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.

Security, Usability and Functionality

Evidence: Supplementary

Revision: Available · 3 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Supplementary school-application and MFA decisions consider protection, usable accessible authentication, required capabilities, recovery and unintended workarounds; these goals can reinforce each other.

• Security, Usability & Functionality — Supplementary Study Guide explanation

Recorded evidence

• Supplementary school-application and MFA decisions consider protection, usable accessible authentication, required capabilities, recovery and unintended workarounds; these goals can reinforce each other.

• Security, Usability & Functionality — Supplementary Study Guide explanation · Three questions; Thinking beyond a trade-off; A fictional example; Define what success requires; Examine a restrictive password policy; Accessibility; Unintended consequences of poorly designed controls; Blocking necessary file access; Generating excessive low-value alerts; Worked decision: introducing MFA; Follow the decision through; Key takeaway; Further reading

Reviewed 2026-09-23. Reviewed against approved Sessions 1–2 and Study Buddy Core Concepts. Scenarios are fictional educational applications, not completed practical work. This concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.