Implementation: Cryptography, Identity, and Secure Protocols
This chapter explains the building blocks used to protect data and control access. You will learn symmetric and asymmetric cryptography, public key infrastructure, identity and access management, and secure protocols. These technologies enforce confidentiality, integrity, and authentication across systems.
Cryptography Fundamentals
Cryptography protects data in transit and at rest and underlies authentication, integrity, and non-repudiation, so choosing the right primitive depends on whether you need secrecy, integrity, or proof of origin. Symmetric encryption uses one shared secret key to encrypt and decrypt; algorithms like AES are fast and suited to bulk data, but the challenge is distributing the key securely, and you should know that block ciphers such as AES operate in modes like GCM, which also provides authentication. Asymmetric encryption uses a mathematically linked public and private key pair, solving the distribution problem: anything encrypted with the public key can be decrypted only with the private key, and RSA and elliptic-curve cryptography are the common examples, with ECC delivering equivalent strength at smaller key sizes. In practice systems use hybrid encryption, where asymmetric cryptography exchanges a symmetric session key that then protects the actual traffic. Hashing produces a fixed-length, one-way digest used to verify integrity; SHA-256 is standard, and a hash reveals nothing about the input yet changes completely if the input changes. Salting adds a unique random value to each password before hashing to defeat precomputed rainbow tables, and key stretching functions like bcrypt, PBKDF2, and Argon2 slow brute-force cracking. A message authentication code and HMAC combine a key with a hash to prove both integrity and authenticity. Digital signatures encrypt a hash with the signer's private key, providing integrity, authentication, and non-repudiation, verified with the signer's public key. The exam also covers key exchange such as Diffie-Hellman, the value of perfect forward secrecy so that compromise of one key does not expose past sessions, and the strength that comes from key length and algorithm choice. You should recognize supporting concepts: encryption applied at the level of full disk, partition, volume, file, database, and individual record; blockchain as an append-only distributed ledger; obfuscation techniques including steganography, tokenization, and data masking; and key management practices covering generation, escrow, and rotation. Cryptographic agility, the ability to swap algorithms as older ones weaken, keeps a system defensible over time as computing power and attacks advance.
Public Key Infrastructure
Public key infrastructure, or PKI, is the framework of roles, policies, and technology that makes asymmetric cryptography trustworthy at scale by binding public keys to verified identities. At the top of the trust model sits the certificate authority, which issues and digitally signs certificates, vouching that a given public key really belongs to the named subject. A registration authority verifies the requester's identity before the CA issues a certificate, offloading vetting from the CA. Trust flows along a certificate chain: a trusted root CA signs one or more intermediate CAs, which in turn sign end-entity certificates, so a client that trusts the root implicitly trusts everything validly chained beneath it. Because the root is so valuable, it is often kept offline, and intermediates do the day-to-day signing. Certificates follow the X.509 standard and carry fields such as the subject, issuer, validity dates, public key, and extensions; subject alternative name entries let one certificate cover multiple hostnames, while a wildcard certificate covers all subdomains of a domain. Certificates must be revocable when a key is compromised or an employee leaves, and the exam expects you to compare the two mechanisms: a certificate revocation list is a periodically published list of revoked serial numbers, while the Online Certificate Status Protocol answers the status of a single certificate in real time, with OCSP stapling letting the server present a signed status to improve speed and privacy. The certificate lifecycle runs from a certificate signing request through issuance, deployment, renewal, and revocation or expiration. Key management is central to PKI security: private keys must be protected in hardware security modules or trusted platform modules and never exposed, since a compromised private key undermines all trust that depends on it. Key escrow stores a copy of keys with a trusted party so encrypted data can be recovered if a key is lost, balancing recoverability against the risk of concentrating keys. Self-signed certificates and private internal CAs are appropriate inside an organization but are not trusted by outside parties. Understanding how trust is established, chained, validated, and revoked lets you troubleshoot certificate warnings and design trustworthy authentication.
Identity and Access Management
Identity and access management, or IAM, ensures the right subjects get the right access to the right resources and nothing more, and it is one of the most heavily tested implementation topics. Start by separating the concepts: identification claims who you are, authentication proves it, authorization decides what you may do, and accounting records what you did. Authentication draws on factors in distinct categories, something you know such as a password or PIN, something you have such as a token or smart card, and something you are such as a fingerprint or face, with location and behavior sometimes added as attributes. Multifactor authentication requires two or more independent factors, so a stolen password alone is not enough; the exam distinguishes true multifactor from using two of the same category. Password security depends on length, complexity, age, reuse restrictions, and lockout, and passwordless approaches use hardware keys or biometrics. Biometric quality is measured by the false acceptance rate, the false rejection rate, and the crossover error rate where the two meet. Access control models define how authorization decisions are made: role-based access control assigns rights by job role, rule-based control applies conditions, attribute-based control evaluates attributes of the subject, object, and environment, mandatory access control uses labels and clearances enforced by the system, and discretionary access control lets the resource owner decide. Single sign-on lets users authenticate once and reach many applications, and federation extends identity across organizations using standards such as SAML for enterprise web SSO, OAuth for delegated authorization, and OpenID Connect for federated authentication; understanding LDAP as a directory protocol and Kerberos as a ticket-based authentication system rounds out the picture. Provisioning and deprovisioning accounts promptly, especially disabling access when someone leaves, closes a common gap. Privileged access management applies extra control to administrative accounts through just-in-time access, credential vaulting, session monitoring, and ephemeral credentials, because those accounts are prime targets. Regular access reviews and attestation confirm that permissions still match need, enforcing least privilege over time.
Secure Protocols and Hardware
Secure protocols protect data as it moves, and trusted hardware protects keys and boot integrity, so replacing legacy plaintext protocols with encrypted equivalents is a fundamental hardening step the exam tests repeatedly. SSH encrypts remote administration on port 22, replacing plaintext Telnet and protecting credentials and commands in transit, and it also carries secure file transfer as SFTP. HTTPS wraps web traffic in TLS, encrypting the session and authenticating the server through its certificate; you should favor modern TLS versions and strong cipher suites and retire deprecated SSL and early TLS. Email security stacks on secure alternatives too, with IMAPS and POP3S for retrieval, SMTP over TLS for transport, and S/MIME or PGP for message-level encryption and signing. DNS security extensions add authentication to DNS responses, and DNS over HTTPS or TLS encrypts lookups. Network management moves from insecure SNMP versions to SNMPv3, and directory traffic from LDAP to LDAPS. Virtual private networks build encrypted tunnels across untrusted networks, using IPsec, which combines the Authentication Header and Encapsulating Security Payload in transport or tunnel mode with the Internet Key Exchange, or TLS-based VPNs for remote access; you should distinguish full-tunnel from split-tunnel designs and site-to-site from client-to-site topologies. On the hardware side, a trusted platform module is an onboard chip that stores keys and supports full-disk encryption and secure boot, binding trust to the specific machine, while a hardware security module is a tamper-resistant device that generates, stores, and uses keys and performs cryptographic operations at scale, ideal for certificate authorities and high-value key protection. A secure enclave isolates sensitive operations within a processor. Secure boot and measured boot verify that firmware and the operating system have not been tampered with, extending a hardware root of trust up the stack. Selecting the encrypted protocol for a given service, on the correct port, and anchoring keys in trusted hardware, is exactly the applied judgment SY0-701 rewards.
Last updated: September 2026
练习一直免费。完整的 CompTIA Security+ (SY0-701) 学习指南是知识本身,从头到尾讲清楚 —— 可下载的 PDF + EPUB,永久归你。