Security · Topic 2 of 13
Logical Security and Active Directory
Understand least privilege, ACLs, multifactor authentication, email filtering, Active Directory and mobile device management in logical security.
- 5 min
- Includes a diagram
- Least privilege means the minimum access needed to do the job.
- An ACL lists who has which permission on a resource.
- MFA needs two or more different factor types.
What it is
Logical security uses software and settings to control who can reach data and systems. It answers three questions: who are you (authentication), what may you do (authorisation), and what did you do (accounting). Active Directory is the main Windows tool for managing these at scale.
How it works
Principle of least privilege
A user gets only the access needed for the job, and no more. This limits the damage from a mistake, a stolen account or malware that runs with the user's rights. Admin rights are given sparingly and only for the time needed.
Zero Trust
Zero Trust follows the rule never trust, always verify. Every request is authenticated and authorised, whether it comes from inside or outside the network. Microsegmentation splits the network into small zones so a breach in one zone cannot spread freely.
Access control lists
An access control list (ACL) is a list of who may do what to a resource. A file, folder, share or network device can each have one. Each entry names a user or group and the permission, such as read or write.
Multifactor authentication (MFA)
MFA requires two or more different kinds of proof. A password and a security question are both something you know, so together they are not MFA.
| Factor | Examples |
|---|---|
| Something you know | Password, personal identification number (PIN) |
| Something you have | Smart card, hardware token, phone with an authenticator app |
| Something you are | Fingerprint, face, iris |
| Somewhere you are | Location based checks |
A one time passcode may be sent by text message, voice call or email, or shown in an authenticator app. Authenticator apps and hardware tokens are stronger than text messages, which can be intercepted or redirected. A hardware token is a small device that makes codes or acts as a key.
Identity and access management
Identity and access management (IAM) covers the life of accounts, roles and permissions. The usual steps are joiner (create and grant access), mover (change access for a new role) and leaver (remove access).
| Term | Meaning |
|---|---|
| SAML (Security Assertion Markup Language) | An identity provider signs the user in and sends a signed assertion in Extensible Markup Language (XML) to other services, which gives federated single sign on (SSO) |
| Just in time access | Privileges are granted for a short, approved period and then removed |
| Privileged access management (PAM) | Admin credentials are kept in a vault, checked out when needed and monitored |
Email filtering
Email filtering scans messages before they reach the inbox. It blocks spam, known malicious links and attachments, and phishing attempts. It reduces risk but cannot catch everything, so user training still matters.
Data loss prevention
Data loss prevention (DLP) tools detect and block sensitive data, such as card numbers or personally identifiable information (PII), leaving by email, USB drive or cloud upload. Rules match patterns in the content and can warn, block or log the action.
Active Directory
Active Directory (AD) is Microsoft's directory service. It stores user, group and computer accounts in one place, and sign in checks happen on a domain controller (DC), the server that holds the directory.
| Term | Meaning |
|---|---|
| Domain controller | Server that authenticates users and holds the directory |
| Organizational unit (OU) | A container used to group users or computers and apply settings |
| Group Policy Object (GPO) | A set of settings applied to users or computers in a domain, site or OU |
| Security group | A collection of accounts used to assign permissions together |
| Login script | A script that runs at sign in, such as mapping a drive |
| Home folder | A personal network folder for each user |
| Folder redirection | Moves a user's folders, such as Documents, to a server |
Giving permissions to groups rather than to individuals is simpler to manage. A new employee is placed in the right groups and gets the right access at once.
Mobile device management (MDM)
MDM software lets an organisation manage phones and tablets from a central console. It can enforce screen locks and encryption, install apps, separate work from personal data, and wipe a lost device remotely.
Two passwords are not MFA. Look for two different factor types, such as a password plus a code from an authenticator app.
What to remember for the exam
- Least privilege means the minimum access needed to do the job.
- An ACL lists who has which permission on a resource.
- MFA needs two or more different factor types.
- Authenticator apps and hardware tokens are stronger than Short Message Service (SMS) codes.
- Active Directory stores accounts and is served by domain controllers.
- An OU groups objects. A GPO applies settings to them.
- Permissions are easier to manage through security groups.
- Folder redirection and home folders keep user data on a server.
- MDM manages and can remotely wipe mobile devices.
Common mistakes
Calling a password plus a PIN MFA. Both are knowledge factors, so it is still a single factor.
Giving permissions to individual users. It becomes hard to audit. Use groups.
Giving everyone admin rights for convenience. This breaks least privilege and raises the damage from any compromise.
Assuming email filtering stops all phishing. Some messages get through, so users still need training.
Check yourself
Which two items count as MFA?
A password (something you know) plus a code from an authenticator app (something you have).
What does a GPO do?
It applies a set of configuration settings to users or computers in a domain, site or OU.
What does least privilege mean?
Users receive only the access required for their work.
Topic 2 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.