2.1 - Security concepts and defense principles
CompTIA A+ Core 2 objective 2.1 covers the security concepts and guiding principles you apply every day. Zero Trust assumes no user or device is trusted by default and verifies every access request. Least privilege gives people only the access their job needs, while separation of duties splits a critical task so no single person can complete it alone. You should recognise defense in depth (layering controls), the value of security-awareness training plus filtering as the best defense against phishing, and how detection tools such as XDR correlate telemetry across endpoints, email, network and cloud. The exam also compares biometrics: an iris or retina scan is generally the most accurate and hardest to fake. Expect scenario questions that name a situation and ask which principle or control fits best.
Match the principle to the scenario: Zero Trust = never trust, always verify; Least privilege = only what the job needs; Separation of duties = no one person completes a critical task alone; Defense in depth = layers. Best anti-phishing = awareness training + filtering. Most accurate biometric = iris/retina.
Practice questions
1. Which security model assumes no user or device is trusted by default and verifies every access request, even inside the network?
- Zero Trust (correct answer)
- Implicit trust
- Perimeter-only security
- Open network model
Zero Trust = 'never trust, always verify'. Every request is authenticated and authorized regardless of whether it originates inside or outside the network perimeter.
2. Granting a user only the access needed to do their job is which security principle?
- Implicit trust
- Least privilege (correct answer)
- Open access
- Separation of duties
Least privilege limits each user/account to the minimum rights required, reducing risk if compromised.
3. Which approach correlates telemetry across endpoints, email, network and cloud for unified threat detection?
- Signature antivirus
- Host firewall
- XDR (correct answer)
- WEP
XDR (Extended Detection and Response) correlates data across multiple layers; EDR is endpoint-only, MDR is a managed service.
4. What is the BEST defense against users falling for phishing emails?
- A faster office internet link
- Security awareness training plus filtering (correct answer)
- Larger monitors for every user
- Disabling the host software firewall
User education (recognize phishing) combined with email filtering/anti-spam is the strongest practical defense.
5. Which biometric is generally considered the MOST accurate/hard to fake?
- A 4-digit numeric PIN
- An iris or retina scan (correct answer)
- A text password
- A login username
Iris/retina scans are highly accurate biometrics. Fingerprint/face are common; PINs/passwords aren't biometrics.
6. Splitting a critical task so no single person can complete it alone is which principle?
- The least-privilege principle
- Separation of duties (correct answer)
- A zero-trust model
- Single sign-on (SSO)
Separation of duties requires multiple people for sensitive actions, reducing fraud/error (e.g., one requests, another approves).