CompTIA Security+ Preparation · lesson 1 of 45 · 25 min
What Are Security Controls?
A security control is any safeguard or countermeasure designed to protect the confidentiality, integrity, or availability (CIA) of information and systems. Controls are the building blocks of every security program — from a simple password policy to a full incident response team.
The CompTIA Security+ exam (SY0-701) expects you to classify controls by two independent dimensions: category (what the control is made of) and type (what the control is trying to accomplish). Understanding both dimensions lets you design layered defenses and answer scenario questions correctly.
Why this matters
Real security programs use dozens of overlapping controls. When one fails, others compensate. This is called defense in depth. Knowing how to classify controls helps you identify gaps — for example, if you have strong technical controls but no administrative policies, attackers can exploit the human layer.
Control Categories
The category describes the nature of the control — what it is physically or logically made of.
Exam tip
Security+ SY0-701 uses the terms Technical, Managerial, Operational, and Physical. Older resources may say “Administrative” instead of “Managerial” — they mean the same thing. Know both terms.
Control Types
The type describes the control’s intended effect — what it is trying to do to a threat.
Combining Categories and Types
Every control has both a category and a type. A single control can even serve multiple types simultaneously. The key skill is being able to classify any control along both dimensions.
Flashcard Drill
Technical control A safeguard implemented in hardware or software — e.g. firewall, encryption, antivirus. Managerial control A policy, procedure, or governance document — e.g. risk assessment, security policy. Operational control A day-to-day human process — e.g. security awareness training, patch schedule. Physical control A tangible barrier or environmental safeguard — e.g. lock, badge reader, CCTV. Preventive control Stops an attack before it occurs — e.g. firewall, locked door. Detective control Identifies an attack during or after it occurs — e.g. IDS, audit logs. Corrective control Reduces damage and restores systems after an incident — e.g. backups, patching. Deterrent control Discourages attackers from attempting an attack — e.g. warning banner, visible camera. Compensating control An alternative when the primary control is not feasible — e.g. MFA for an unpatched legacy system. Directive control Instructs people on acceptable behavior — e.g. acceptable use policy, compliance training.
Scenario Practice
The Unpatched Server
This is a preventive technical control only. Network segmentation is a preventive technical control; MFA is a compensating technical control. Both controls are managerial because they were approved by management. This is a corrective control because it fixes the vulnerability. 1 Network segmentation limits blast radius (preventive + technical). MFA compensates for the inability to patch (compensating + technical). Management approval is the managerial control, but the controls themselves are technical.
The New Employee
AUP is a directive managerial control; training is a preventive operational control. Both are technical controls because they involve computers. AUP is a detective control; training is a corrective control. Both are physical controls because they happen in person. 0 The AUP is a written policy (managerial category) that instructs behavior (directive type). Security awareness training is a human process (operational category) that aims to prevent incidents (preventive type).
Classify the Control
- Encryption at rest on a database
- Technical
- Annual risk assessment report
- Managerial
- Daily backup verification procedure
- Operational
- Biometric door lock on server room
- Physical
- Firewall ACL blocking port 23
- Technical
- Security awareness training program
- Operational
Knowledge Check
Security Control Categories — 10 Questions
A firewall that blocks unauthorized traffic belongs to which control category?
- Physical
- Managerial
- Technical
- Operational
Answer: Technical
Firewalls are hardware/software safeguards — that is the Technical (Logical) category.
An IDS that alerts on suspicious traffic is best classified as which control type?
- Preventive
- Detective
- Corrective
- Deterrent
Answer: Detective
An IDS identifies attacks — it detects rather than prevents.
A visible CCTV camera can serve as both a deterrent and a detective control simultaneously.
- True
- False
Answer: True
Visible cameras deter attackers (deterrent) and record events for review (detective).
Which control type is specifically used when the ideal control cannot be implemented?
- Directive
- Corrective
- Compensating
- Deterrent
Answer: Compensating
Compensating controls are alternatives used when the primary control is not feasible.
A written policy that tells employees what they may and may not do on company systems is called an _____ Use Policy.
Answer: acceptable
An Acceptable Use Policy (AUP) is a directive managerial control.
Which of the following are examples of Physical controls? (Select all that apply)
- Mantrap
- Firewall
- Badge reader
- Security guard patrol
- Encryption
Answer: Mantrap
Badge reader
Security guard patrol Mantraps, badge readers, and guard patrols are physical. Firewalls and encryption are technical.
Restoring a system from backup after a ransomware attack is which type of control?
- Preventive
- Detective
- Corrective
- Deterrent
Answer: Corrective
Restoring from backup reduces damage and restores operations — that is corrective.
A login warning banner stating “Unauthorized access is prohibited and will be prosecuted” is primarily which type?
- Preventive
- Deterrent
- Detective
- Corrective
Answer: Deterrent
Warning banners discourage attackers by communicating consequences — that is deterrent.
Security awareness training is classified as a Managerial control because management approves it.
- True
- False
Answer: False
Security awareness training is an Operational control — it is a day-to-day human process, even though management may approve it.
Which combination correctly describes an incident response plan?
- Technical / Preventive
- Managerial / Corrective
- Physical / Detective
- Operational / Deterrent
Answer: Managerial / Corrective
An incident response plan is a documented policy (Managerial) designed to restore operations after an incident (Corrective).
Try it: Control categories
Back to CompTIA Security+ Preparation
Next lesson: Security frameworks: NIST CSF, ISO 27001, CIS Controls