Security+ 801 Countdown, T-36: Objective 1.1 Now Starts With Defense in Depth

A security control is any safeguard that reduces the likelihood or the impact of a loss: a device, a configuration, a procedure, or a policy. No single control is trusted to hold on its own. A firewall rule is misconfigured, a password is phished, a workstation cannot be patched, and each failure is survivable only if something else stands behind it. Defense in depth is the name for arranging controls so that they stand behind one another by design, and it is the principle under which the other security fundamentals (confidentiality, integrity, and availability; authentication, authorization, and accounting; non-repudiation; Zero Trust; and least privilege) fit together as parts of one structure rather than as a vocabulary list.

SY0-801 objective 1.1, “Explain security concepts and controls,” is the expanded home for this material: it opens with defense in depth, nests those five fundamentals one level beneath it, and then covers the categories and types used to classify any control (CompTIA 2025). CompTIA’s gloss for Domain 1 on its V8 page, “Understand how layered security controls work together to protect systems and data,” is the plainest statement of what the objective is for (CompTIA 2026a).

Defense in depth as the organizing principle

NIST defines defense-in-depth as “An information security strategy that integrates people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization” (NIST n.d.). The definition names people and operations alongside technology, which means a layered defense is never only a stack of appliances. The one SP 800-53 Rev. 5 control named for the strategy, enhancement PL-8(1), requires allocating controls to “locations and architectural layers” so that they “operate in a coordinated and mutually reinforcing manner” (Joint Task Force 2020). The goal is work factor: an adversary has to defeat several controls in turn, and each attempt raises the odds of detection before the target is reached (Joint Task Force 2020).

Coordination is half of the design; diversity is the other half. SP 800-160 Vol. 1 Rev. 1 principle E.9 says successive barriers should be “diverse in nature and include technical, operational, and organizational barriers” (Ross, Winstead, and McEvilley 2022). A small calculation shows why diversity matters more than count. Take three phishing controls, a mail filter, user reporting, and EDR on execution, and suppose each misses 10 percent of attempts (invented figures, not measured rates). If their misses are independent, all three fail together 0.1 × 0.1 × 0.1 = 0.001 of the time, or 0.1 percent. If they share a failure mode, such as the same vendor’s detection content on the gateway and the endpoint, they miss the same message, and the stack behaves like a single 10 percent layer. That is why PL-8(2) asks for supplier diversity within a layer, and why “Diversity” appears as a resilience term in objective 3.2 (T-20). Three copies of the same control are redundancy, not depth.

The five concepts beneath it

Each of the five fundamentals has a distinct job in the layered design.

Confidentiality, integrity, and availability (CIA) name what the layers protect: confidentiality keeps information from parties not authorized to see it, integrity keeps it from unauthorized change, and availability keeps it reachable by the people and systems that need it. Every control in the matrix later in this post serves at least one of the three.

Authentication, authorization, and accounting (AAA) form the identity layer: who is asking, what they may do, and what record is kept. The next section defines each function from its RFC and shows all three in one log excerpt.

Non-repudiation is the evidence layer. SP 800-53 Rev. 5 control AU-10 calls for “irrefutable evidence” that a person performed an action, obtained through mechanisms such as digital signatures and receipts (Joint Task Force 2020). The term needs care: SP 800-57 Part 1 says a digital signature can “support a non-repudiation decision,” a message authentication code (MAC) cannot, and the real determination “is a legal decision” (Barker 2020). The signature mechanics are covered at T-34.

Zero Trust principles grant no implicit trust to assets or user accounts “based solely on their physical or network location” (Rose et al. 2020). CompTIA does not explain why the principles sit under defense in depth; the sensible reading is that Zero Trust adds a per-request access decision to the layers rather than replacing them, which matches SP 800-207’s expectation that most enterprises “will operate in a hybrid zero trust/perimeter-based mode” (Rose et al. 2020). The architecture itself is covered at T-21.

Least privilege is the last line. SP 800-53 control AC-6 allows accounts only the accesses “necessary to accomplish assigned organizational tasks” (Joint Task Force 2020). Its job in a layered design is to cap what a compromised account can reach after the other layers have failed.

Least privilege and its neighbors

Three terms sit close to least privilege and are easy to swap on an exam. Need-to-know is access to specific information for official duties, per CNSSI 4009; it restricts information rather than rights. Separation of duties, SP 800-53 control AC-5, divides a task among people so as to limit “malevolent activity without collusion” (Joint Task Force 2020). Privilege creep is least privilege decaying over job changes, as a person keeps old rights while gaining new ones (T-12).

AAA and least privilege in one sudo trail

RFC 2989 defines the three AAA functions. Authentication is “The act of verifying a claimed identity.” Authorization determines whether a right “can be granted to the presenter of a particular credential.” Accounting collects usage information for “trend analysis, auditing, billing, or cost allocation” (Aboba et al. 2000). Identification, the step the acronym leaves implicit, is the claim itself: typing a username asserts an identity, and authentication proves it.

One sudo rule exercises all three functions and least privilege at the same time. It lives in /etc/sudoers.d/webops, edited with visudo -f:

%webops  web01 = (root) /usr/bin/systemctl restart nginx

Members of the webops group, on host web01, may run as root exactly one command with one argument. Alice, a member of that group, restarts the web server and then tries to stop it. The resulting entries in /var/log/secure on web01:

Oct 12 05:01:12 web01 sudo: pam_unix(sudo:auth): authentication failure; logname=alice uid=1000 euid=0 tty=/dev/pts/0 ruser=alice rhost=  user=alice
Oct 12 05:01:20 web01 sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl restart nginx
Oct 12 05:01:20 web01 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by alice(uid=1000)
Oct 12 05:02:03 web01 sudo: alice : command not allowed ; TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl stop nginx

Read it one function at a time:

• Authentication is the pam_unix(sudo:auth) line: alice mistyped her password, and the accepted command eight seconds later shows the retry succeeded.
• Authorization is the sudoers rule; because arguments listed in a command must match exactly, restart nginx is allowed and stop nginx is logged as “command not allowed.”
• Accounting is every line, and each carries the AU-3 content fields: when, where (web01, pts/0), who (alice), what (COMMAND), and the outcome.

The rule grants one command with one argument on one host, not ALL, which is least privilege in a single line (Sudo Project n.d.). The trail is attributable only because alice has her own account; a shared “admin” login breaks accounting and non-repudiation at once. AC-5 extends the separation logic to the logs themselves: the people who administer access control should not also administer the audit functions that record what they did (Joint Task Force 2020). Formats vary (older Linux-PAM omits (uid=0), and newer rsyslog setups may print RFC 3339 timestamps); the fields do not.

Control categories and control types

Every control can be classified two ways, and the two classifications answer different questions. Category answers how, and by whom or what, a control is implemented. Type answers what the control does relative to an incident. A control has one category and can have several types. When I teach this in ITN 260, I have students ask the two questions separately; “managerial” and “directive” sound like near-synonyms and answer different ones.

The four categories and their second names

SY0-801 names the categories Technical/logical, Managerial/administrative, Physical/environmental, and Operational. Technical (or logical) controls are implemented by systems: a firewall rule, an EDR agent, a login banner. Managerial (or administrative) controls govern risk through policy and assessment. Operational controls are “implemented and executed by people (as opposed to systems),” in the words of FIPS 200: guard rounds, log review, a periodic access review (NIST 2006). Physical (or environmental) controls act on the facility and its surroundings: doors, cameras, power, fire suppression, and climate.

The second names exist because the field has never settled on one vocabulary. FIPS 200 (2006) and SP 800-53 Rev. 3 (2009) used a management, operational, and technical triad, and Rev. 3 classed the PE family (Physical and Environmental Protection) as Operational (Joint Task Force 2009). Rev. 4 (2013) dropped the class designations because many controls mix “management, operational, and technical properties” (Joint Task Force 2013). The ISC2 Certified in Cybersecurity outline effective September 1, 2026 uses Technical, Administrative, and Physical controls, plus “logical access controls” (ISC2 2026). Basically, the slashes let either vocabulary map onto CompTIA’s four.

CompTIA publishes no definition of “environmental.” The NIST PE family is the best anchor: FIPS 200 requires protecting systems “against environmental hazards” (NIST 2006), and SP 800-53 Rev. 5 implements that requirement as PE-11 Emergency Power, PE-13 Fire Protection, PE-14 Environmental Controls, and PE-15 Water Damage Protection (Joint Task Force 2020).

The six types

Preventive controls block an action: a lock, a firewall deny rule. Deterring controls discourage an action but can be ignored: a sign, a login banner, a visible camera. Detective controls notice and record: a log, an alarm, a review. Corrective controls act after an incident to limit or undo damage: restore, rollback, quarantine. Directive controls tell people what to do: an acceptable use policy, an “authorized personnel only” sign. Compensating controls are “employed in lieu of” a baseline control that cannot be implemented (NIST n.d.); the choice is made before any incident, because the primary control is infeasible, and that timing is what separates compensating from corrective.

The matrix below is an interpretation, since CompTIA publishes no mapping of examples to categories and types; the multi-type rows are the point. Guards are the split case: SP 800-12 Rev. 1 lists gates and guards among physical defenses (Nieles, Dempsey, and Pillitteri 2017), but FIPS 200’s people-executed test puts the guard in Operational, so read the stem; the fence or guard booth is Physical/environmental, and the person on rounds is Operational.

Control	Category	Type(s)
Badge reader on server-room door	Physical	Preventive; its log is Detective
Visible CCTV	Physical	Detective; Deterring because visible
Security guard	Operational (a person executes it)	Preventive, Deterring, Detective
“Authorized personnel only” sign	Physical	Directive, Deterring
Acceptable use policy	Managerial/administrative	Directive
Firewall deny rule	Technical/logical	Preventive
EDR kills and quarantines a process	Technical/logical	Detective, Corrective
Clean-agent fire suppression (PE-13)	Physical/environmental	Corrective
HVAC with humidity alarms (PE-14)	Physical/environmental	Preventive; alarm is Detective
Isolating an unpatchable host	Technical/logical	Compensating
Login warning banner (AC-8)	Technical/logical	Deterring, Directive
Quarterly privileged-access review, AC-6(7)	Operational	Detective, then Corrective

In the unpatchable-host row, firewall rules that admit only a jump host and log everything else are Preventive and Detective in function, but they exist because patching is infeasible, and that is what makes them compensating.

What you need to know for SY0-801

• Defense in depth means coordinated, diverse layers so that one failure is not a compromise; three copies of the same control are redundancy, not depth.
• Rename spotter: “logical” means technical, “administrative” means managerial, and “environmental” (HVAC, humidity, fire suppression, power) means physical.
• Managerial controls govern risk (policy, risk assessment); operational controls are “implemented and executed by people (as opposed to systems)” per FIPS 200 (guard rounds, log review).
• Deterring discourages and can be ignored (sign, banner, visible camera); Preventive blocks (lock, deny rule). Deterring is the SY0-801 spelling of what SY0-701 called Deterrent; the type is the same.
• Compensating is chosen before an incident because the primary control is infeasible; Corrective acts after one (restore, rollback, quarantine).
• “Only the access needed” signals least privilege; “only this information” signals need-to-know; “no single person can complete” signals separation of duties.
• Identification claims, authentication proves, authorization decides, and accounting records.
• “Proves who signed” signals non-repudiation; MACs and shared accounts cannot support it.
• Zero Trust in 1.1 is a set of principles (no implicit trust by location); “control plane” and “data plane” are SY0-701 vocabulary, and the architecture itself is covered at T-21.
• Look-alikes: “Corrective” in 5.6 is a training type, and 4.5 uses similar slash pairs (“Logical/technical,” “Administrative/business”) for access-management policies.

Check yourself

These are original practice questions, not exam items.

1. A clinic cannot patch an imaging workstation because its vendor no longer supports the operating system. The team moves it to an isolated segment reachable only from one jump host and logs every denied connection. Using SY0-801 1.1 terms, which pair best describes this arrangement?

• A. Technical/logical; compensating.
• B. Operational; corrective.
• C. Technical/logical; corrective.
• D. Managerial/administrative; compensating.

Answer: A. Segmentation and firewall rules are implemented by technology, and they substitute for patching, the infeasible primary control. Corrective controls act after an event, which is not why this segment exists.

2. A data center adds humidity alarms, water-detection cable under the raised floor, and a clean-agent fire suppression system. Which SY0-801 category name fits these controls, and which type is the suppression system?

• A. Physical/environmental; corrective.
• B. Operational; preventive.
• C. Technical/logical; detective.
• D. Physical/environmental; deterring.

Answer: A. 801 pairs physical with environmental, and NIST groups heat, water, and fire hazards in its PE family. Suppression acts after a fire starts to limit damage, so it is corrective; the smoke detector would be detective.

3. A Linux server logs alice : command not allowed ; ... COMMAND=/usr/bin/systemctl stop nginx after alice successfully ran systemctl restart nginx with sudo. Which AAA function produced the denial, and which principle does the rule enforce?

• A. Authentication; separation of duties.
• B. Authorization; least privilege.
• C. Accounting; need-to-know.
• D. Authentication; least privilege.

Answer: B. Alice had already authenticated; the sudoers rule decided she may restart nginx but not stop it, which is authorization enforcing minimum rights. The log line is accounting, which records the decision rather than making it.

This is T-36 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-35: Change Management Becomes a Scenario Objective. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Aboba, Bernard, Pat R. Calhoun, Steven Glass, et al. 2000. Criteria for Evaluating AAA Protocols for Network Access. RFC 2989. Internet Engineering Task Force.

Barker, Elaine. 2020. Recommendation for Key Management, Part 1: General. NIST Special Publication 800-57 Part 1 Rev. 5.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CompTIA. 2026a. “Security+ V8.” Accessed October 12, 2026.

ISC2. 2026. “Certified in Cybersecurity Exam Outline.” Effective September 1, 2026. Accessed October 12, 2026.

Joint Task Force. 2009. Recommended Security Controls for Federal Information Systems and Organizations. NIST Special Publication 800-53 Rev. 3.

Joint Task Force. 2013. Security and Privacy Controls for Federal Information Systems and Organizations. NIST Special Publication 800-53 Rev. 4. Withdrawn September 23, 2021.

Joint Task Force. 2020. Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53 Rev. 5.

NIST (National Institute of Standards and Technology). 2006. Minimum Security Requirements for Federal Information and Information Systems. FIPS 200.

NIST (National Institute of Standards and Technology). n.d. “Defense-in-Depth.” CSRC Glossary. Accessed October 12, 2026. See also the entries for need-to-know and compensating controls.

Nieles, Michael, Kelley Dempsey, and Victoria Yan Pillitteri. 2017. An Introduction to Information Security. NIST Special Publication 800-12 Rev. 1.

Rose, Scott, Oliver Borchert, Stu Mitchell, and Sean Connelly. 2020. Zero Trust Architecture. NIST Special Publication 800-207.

Ross, Ron, Mark Winstead, and Michael McEvilley. 2022. Engineering Trustworthy Secure Systems. NIST Special Publication 800-160 Vol. 1 Rev. 1.

Sudo Project. n.d. “Sudoers Manual.” Accessed October 12, 2026.