Security controls are the mechanisms organizations use to reduce risk, while zero trust is an architectural approach for making access decisions without assuming that location or prior network membership makes a subject trustworthy. The CompTIA Security+ SY0-701 objectives place both ideas in the General Security Concepts domain because they provide vocabulary for nearly every later security decision.
Candidates should be able to classify controls in more than one way. A firewall may be a technical control and also preventive. A security-awareness program is managerial or operational in category depending on the specific control, while its purpose may be directive or preventive. Zero trust then connects several controls into a policy-driven access model built around identity, context, least privilege and continuous evaluation.
Control categories describe how a safeguard is implemented
SY0-701 identifies technical, managerial, operational and physical control categories. Technical controls are implemented through technology: access-control systems, encryption, endpoint protection and filtering are common examples. Managerial controls come from governance and management decisions such as policies, risk assessment and oversight.
Operational controls are carried out through people and repeatable processes, such as incident handling, change procedures and security operations. Physical controls protect facilities and equipment through measures such as locks, barriers, guards and surveillance.
The broader CompTIA cybersecurity certifications path builds on all four categories because security work is never purely technical. Mature defenses combine policy, operations, technology and physical protection.
Control types describe the effect a safeguard is intended to have
Preventive controls try to stop an unwanted event before it succeeds. Detective controls identify that an event occurred or is occurring. Corrective controls help return the environment to an acceptable state after a problem. Deterrent controls discourage unwanted behavior. Directive controls tell people or systems what behavior is required, while compensating controls provide an alternative when the preferred control cannot be used.
The same safeguard can fit more than one description depending on how it is used. A security camera can deter some intruders and detect activity for later review. Multifactor authentication is technical and preventive. A documented manual review might act as a compensating control when an automated approval mechanism is unavailable.
Exam questions often describe the objective of the control rather than naming its category. Ask what the safeguard is meant to accomplish in the scenario before choosing the label.
Defense in depth uses controls with different failure modes
One strong control is not a security program. Attackers succeed when they find a path around the protection an organization relied on most. Defense in depth reduces that dependence by layering controls so that one failure does not automatically become a compromise.
An internet-facing application might use secure coding, a web application firewall, strong authentication, network segmentation, logging and backup. Those controls do not duplicate each other. They address different parts of the attack path and provide different kinds of evidence or recovery.
The site’s discussion of the confidentiality, integrity and availability model provides another way to test a control design. A security program that protects confidentiality but ignores availability is incomplete, just as a resilient service that allows unauthorized data changes is incomplete.
Zero trust removes implicit confidence based on location
Traditional network designs often treated the internal network as relatively trusted and the external network as untrusted. Zero trust challenges that assumption. Being inside a corporate address range does not prove that a user, device or workload should have access to a resource.
Instead, access decisions are policy-driven and based on signals such as identity, device state, requested resource, sensitivity and other context. The objective is to grant only the access required and to keep evaluating whether the conditions for that access remain acceptable.
This does not mean that networks stop mattering. Segmentation, firewalls and secure access paths remain important. Zero trust changes the trust model: network placement becomes one signal among several rather than the source of automatic broad trust.
The control plane makes and administers access decisions
CompTIA’s zero-trust terminology distinguishes a control plane from a data plane. The control plane contains the policy logic used to decide whether access should be granted and how that policy is administered. Concepts such as adaptive identity, threat-scope reduction and policy-driven access belong in this decision layer.
A policy engine evaluates the available signals and determines whether the request satisfies policy. A policy administrator can translate that decision into the instructions needed to establish or terminate the connection. Implementations vary, but the conceptual separation is important: one layer decides and administers policy; another enforces the resulting access.
For Security+, focus on the relationship rather than memorizing vendor-specific product names. The exam tests the architecture concept that access is explicitly evaluated instead of inherited from a broad trusted zone.
The data plane is where subjects actually access resources
The data plane carries the traffic and activity that occurs after an access decision. The subject or system is the entity requesting access, while the policy enforcement point sits in the path and applies the decision.
A policy enforcement point could be represented by different technologies depending on architecture. What matters conceptually is that it can allow, restrict or terminate the connection according to policy. The enforcement point should not invent its own trust rule independently of the control-plane decision model.
This separation helps explain why zero trust is more than installing a firewall. A firewall may participate in enforcement, but zero trust also requires identity, policy logic, contextual signals and ongoing access decisions.
Least privilege limits the impact of a successful compromise
Zero-trust design assumes that credentials, endpoints or sessions can be compromised. Least privilege reduces what an attacker can do with that foothold. Users should receive only the permissions required for their current responsibilities, and privileged access should be tightly controlled.
The same principle applies to workloads and service accounts. An application that only needs to read one data set should not receive broad administrative authority. Machine identities can be compromised just as human identities can, so their permissions deserve the same review.
Least privilege also interacts with time. Temporary or just-in-time privilege reduces the window in which high-impact permissions are active. Strong zero-trust implementations avoid permanent broad access simply because it is convenient.
Segmentation reduces threat scope
If every internal system can communicate freely with every other system, one compromised endpoint can become a stepping stone across the environment. Segmentation limits that movement by creating boundaries between workloads, user groups or sensitivity levels.
Microsegmentation applies this idea at a finer level, using identity- and workload-aware controls rather than relying only on large network zones. The exact implementation depends on the environment, but the security objective is consistent: compromise of one subject should not create an unrestricted path to unrelated resources.
The cross-vendor cybersecurity certifications landscape repeatedly returns to segmentation because it supports both prevention and containment. Security+ introduces the principle; specialized security and networking credentials go deeper into implementation.
Continuous verification needs useful signals
Zero trust is sometimes summarized as “never trust, always verify,” but verification has to use meaningful evidence. Identity assurance, multifactor authentication, device compliance, geolocation anomalies, risk signals and resource sensitivity can all contribute to an access decision.
Not every request needs the same friction. A low-risk request from a compliant managed device may proceed normally, while a sensitive action from an unfamiliar context may require stronger authentication or be denied. This adaptive approach is more practical than forcing the strictest possible challenge on every action regardless of risk.
Continuous verification also means access can change when context changes. A session that was acceptable at sign-in should not automatically remain trusted forever if risk signals indicate compromise.
Compensating controls matter when ideal controls are unavailable
Legacy systems often cannot support the preferred security mechanism. A device might lack modern authentication, or an application may not support a required encryption method. The organization still needs to reduce risk, so it can introduce compensating controls such as network isolation, additional monitoring or tightly restricted access paths.
A compensating control should address the same risk as closely as practical and should be documented as an exception rather than treated as equivalent by default. The gap remains relevant because the workaround may not provide the same assurance as the preferred control.
This is a realistic Security+ pattern: security decisions operate under technical and business constraints. The correct response is to reduce and document residual risk rather than pretend the limitation does not exist.
Study zero trust as an access-decision system
When a SY0-701 question describes zero trust, identify the subject, the resource, the signals available for the decision, the policy logic and the enforcement point. Ask whether implicit trust is being granted merely because the subject is inside a network zone. Then look for least privilege, segmentation and adaptive verification.
For candidates new to the credential, the site’s Security+ certification places these concepts in the larger exam path, while the main CompTIA certification inventory shows how Security+ sits alongside more specialized security credentials. The important exam skill is classification plus application: know what the controls are, then reason about why a scenario needs them.
Security controls and zero trust are foundational because they turn abstract security goals into concrete decisions. Categories describe how controls are delivered, control types describe what they do, and zero trust coordinates many of those controls around explicit, least-privilege access rather than inherited confidence.