Lesson 2: Security Control Categories and Control Types

Why this level matters

A security control is any safeguard an organisation puts in place to reduce risk to its systems, data, people or buildings. Objective 1.1 of the SY0-701 exam asks you to compare and contrast controls using two separate labels:

• Category: how the control is implemented (what it is made of).
• Control type: what the control does (its function against an incident).

Every control has both labels at once. Your job in this level is to learn the four categories and six types, and to practise labelling controls quickly and consistently.

Task 1: Classify the category (how is it implemented?)

Ask: "What carries out this control: a system, a document, a person, or a physical object?"

• Technical: implemented by hardware, software or firmware. Examples: firewall rules, antivirus, encryption, operating system access permissions.
• Managerial: implemented through management decisions and documents that govern security. Examples: security policies, risk assessments, onboarding policy, separation of duties policy.
• Operational: implemented by people carrying out day-to-day activities. Examples: security guards checking identification, awareness training sessions, a technician reviewing logs each morning.
• Physical: limits physical access to a building, room or device. Examples: fences, door locks, badge readers, warning signs.

Do this: when two categories seem to fit, find the actor. A written password policy is managerial (a document). The system setting that enforces password length is technical (software). The trainer who teaches staff the policy is operational (a person).

Task 2: Identify the control type (what does it do?)

Ask: "When does this control act relative to an incident, and what is its purpose?"

1. Preventive: stops the incident from happening. Examples: a firewall rule that blocks traffic, a door lock, a guard who refuses entry without identification.
2. Deterrent: discourages an attacker from trying, but does not physically or logically stop them. Examples: a warning sign, a login banner stating that activity is monitored, the threat of disciplinary action.
3. Detective: identifies and records an incident during or after the event. It does not stop it. Examples: system logs, motion detectors, reviewing login reports, guard patrols.
4. Corrective: acts after an incident to limit damage or restore normal operation. Examples: restoring from backup, using a fire extinguisher, contacting law enforcement.
5. Compensating: an alternative control used when the primary or required control cannot be applied. Examples: isolating a legacy server that cannot be patched behind a restrictive firewall rule, a generator used when mains power fails.
6. Directive: tells people what to do to stay secure. It relies on people following instructions. Examples: an acceptable use policy (AUP), a compliance procedure, an "Authorized personnel only" sign, required security training.

Do this: place the control on a timeline.

• Before the incident: deterrent (discourage), directive (instruct), preventive (block).
• During or after the incident: detective (notice).
• After the incident: corrective (fix).
• At any point, standing in for a control that is missing: compensating.

Task 3: Separate the commonly confused pairs

• Preventive vs. deterrent: a locked door physically stops entry (preventive). A "Trespassers will be prosecuted" sign only changes the attacker's mind (deterrent).
• Deterrent vs. directive: a deterrent warns of consequences. A directive gives an instruction to follow.
• Detective vs. corrective: an alert that reports a malware infection is detective. Removing the malware and restoring the files is corrective.
• Compensating vs. corrective: compensating substitutes for a control you cannot have. Corrective repairs damage that has already occurred. Look for scenario wording such as "cannot be patched", "not supported" or "until the fix is available"; that signals compensating.
• Managerial vs. operational: managerial is the plan or rule on paper. Operational is people doing the work.

Task 4: Combine category and type into one label

Think of a grid with four rows (categories) and six columns (types). Every control sits in one cell. Use this procedure:

1. Read the scenario and underline the control itself, not the threat.
2. Assign the category using the actor test from Task 1.
3. Assign the type using the purpose test from Task 2.
4. State both together: category + type.

Worked examples:

One control can also serve more than one type depending on the purpose described. A visible camera deters intruders; its recordings detect them. Always answer according to the purpose the scenario stresses.

Task 5: Apply the reasoning to a matching-style PBQ

Performance-based questions (PBQs) on this topic typically present a list of controls and ask you to match each to a label. Practise with this method:

1. Check which label set is offered: categories, types, or both.
2. Place the unambiguous items first (for example, a door lock is physical and preventive).
3. For the remaining items, reread the scenario for purpose words: "discourage" (deterrent), "identify" or "record" (detective), "restore" (corrective), "instead of" or "cannot" (compensating), "must" or "instructs" (directive).
4. Select the best-fit label, not every label that could apply.
5. Review that no label has been used in a way that contradicts the scenario.

What the exam asks about this

The objective verb is "compare and contrast". Expect short scenarios that describe a control and ask for its category, its type, or both. Typical traps are:

• Offering a correct category as a distractor when the question asks for the type, or the reverse.
• Describing a sign or banner and offering "preventive" alongside "deterrent".
• Describing a workaround for an unpatchable or unsupported system, where the answer is "compensating".

Use CompTIA's exact terms: Technical, Managerial, Operational, Physical; Preventive, Deterrent, Detective, Corrective, Compensating, Directive.

Key takeaways

• Category = how the control is implemented: technical, managerial, operational or physical.
• Type = what the control does: preventive, deterrent, detective, corrective, compensating or directive.
• Every control has one category and at least one type; label both.
• Preventive blocks, deterrent discourages, detective notices, corrective restores, compensating substitutes, directive instructs.
• In scenarios, choose the label that matches the purpose the question describes.