The Control Matrix: Four Categories, Six Types, and the Security+ Question You Will See Five Times
Chris Rees
25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings
Objective 1.1 is the first thing on the Security+ outline and the source of more silly lost marks than any other. The question shows you a control in one sentence: a guard, a backup, a policy, a warning sign. The answers are four real terms. Candidates who studied the definitions still get it wrong, because the outline hides two separate questions inside one: who implements the control, and what it does. Split them, and the whole objective turns into a grid you can draw from memory.
Two axes, one grid
Security+ classifies every control twice. The category is about the nature of the control and who owns it. The type is about its function, what it does to a threat and when. Every control has exactly one category and at least one type, and the exam will happily ask about either axis using the same example.
The categories are four:
| Category | What it is | Owned by | Examples |
|---|---|---|---|
| Technical | implemented by systems and software | engineers, administrators | firewall, encryption, MFA, IDS |
| Managerial | administrative oversight of the program | leadership, risk, compliance | policy, risk assessment, awareness program |
| Operational | carried out by people in day-to-day work | staff, operations teams | guard patrols, backup rotation, log review |
| Physical | protects the tangible world | facilities, physical security | fence, lock, badge reader, bollard |
The line candidates blur is technical versus operational. A tool is technical. A person using a tool as part of a routine is operational. An intrusion detection system is a technical control; the analyst reviewing its alerts every morning is an operational one. Physical is the easiest to spot and the one the exam uses least, precisely because it is easy.
Types: what the control does, and when
The types are six, and the tidiest way to hold them is by their relationship to the moment of attack.
Two pairs cause nearly all the errors on this axis.
Deterrent versus preventive. A deterrent works on the attacker's decision. A preventive control works on the attacker's ability. A sign that says "premises under surveillance" is deterrent; the lock on the door is preventive. If the attacker ignores the deterrent nothing stops them; if they ignore the preventive control they still cannot get in. On the exam, anything that reduces willingness rather than capability is deterrent.
Corrective versus compensating. Corrective controls fix damage after an incident: restore the backup, reimage the host, apply the patch that was missing. Compensating controls replace a control you cannot implement at all. The medical device that cannot be patched gets network isolation instead; the small team that cannot separate duties gets extra logging and review. The word that signals compensating in a stem is some version of "cannot": the system cannot be patched, the vendor does not support MFA, the budget does not allow a second administrator.
The grid
Put the axes together and every control lands in one cell. The exam does not require you to memorize the grid, but drawing it once makes the classification questions mechanical, because you stop searching for a single right word and start answering two easy questions instead.
Notice that a single control can be more than one type. A visible camera is deterrent (it discourages) and detective (it records). A backup is corrective when restored and preventive of data loss when taken. The exam handles this by asking for the best or primary classification given the scenario, which brings us to the method.
Reading the stem: the verb decides
Most objective 1.1 questions can be answered by finding one verb in the stem and ignoring the noun.
- Stops, blocks, prevents, denies point to preventive.
- Discourages, warns, makes less attractive point to deterrent.
- Identifies, alerts, logs, discovers, notices point to detective.
- Restores, repairs, recovers, returns to normal point to corrective.
- Instead of, because it cannot, as an alternative point to compensating.
- Requires, mandates, instructs, tells employees to point to directive.
Then ask who implements it. Software or hardware doing it automatically is technical. Leadership deciding it is managerial. Staff doing it as a routine is operational. Anything you could kick is physical.
Which type protects which property
The grid also connects to the triad. Objective 1.2 gives you confidentiality, integrity and availability, and the control types map onto them in a way that helps with selection questions. Confidentiality is mostly protected by preventive controls (encryption, access control) and checked by detective ones (access logs, DLP alerts). Integrity leans on detective controls to notice change (hashing, file integrity monitoring) and corrective ones to reverse it (restore from a known-good copy). Availability is where corrective controls do most of the work (failover, backups, redundant power) and where preventive controls look like capacity planning. Non-repudiation is almost purely detective: digital signatures and audit trails exist to prove after the fact who did what.
When a question asks you to pick a control for a stated property, this mapping narrows the answers before you read them. A stem about proving a transaction happened wants a detective control for non-repudiation, not a preventive one for confidentiality, however strong the encryption in the distractor sounds.
Five scenarios, answered in two steps
Practice the method on the shapes the exam actually uses.
- A bank posts a notice that all transactions are logged and reviewed. Verb: discourages. Owner: management wrote the notice. Managerial deterrent. (The logging itself would be technical detective, but the stem is about the notice.)
- A hospital installs badge readers on every ward door. Verb: blocks. Owner: hardware on a door. Physical preventive.
- After a breach, the team restores a database from the previous night's backup. Verb: restores. Owner: staff performing a procedure. Operational corrective.
- A firm cannot enforce separation of duties in a two-person finance team, so every payment is reviewed by the CFO. Verb: cannot, therefore instead of. Owner: a management-imposed review. Managerial compensating.
- A new hire is required to complete security training before receiving credentials. Verb: requires. Owner: policy and HR process. Managerial directive, delivered operationally.
Notice how often the category is the harder half. Candidates find the type in the verb quickly and then guess the category from the noun, which is why example five trips people: training feels operational, but the requirement that creates it is managerial.
Why the grid is the foundation of the exam
The rest of Security+ is, in a sense, a long list of controls, and every later objective assumes you can place them. Zero Trust is a set of preventive and detective technical controls arranged around identity. A PKI is a preventive technical control for confidentiality and a detective one for integrity. An incident response plan is a corrective managerial control until the moment it is executed, when it becomes corrective operational. When a Domain 4 or Domain 5 question asks what kind of control something is, it is testing objective 1.1 again with a harder example.
That is also why the outline lists the categories and types first. Everything after them is about selecting the right control for a risk, and you cannot select what you cannot classify.
Key takeaways
- Two axes, two questions. Category says who implements (technical, managerial, operational, physical); type says what it does (preventive, deterrent, detective, corrective, compensating, directive).
- Deterrent works on willingness; preventive works on ability. If ignoring it still lets the attacker in, it was a deterrent.
- Corrective fixes damage; compensating replaces a control you cannot have. The word "cannot" in a stem is the compensating signal.
- Technical is the tool; operational is the person using it. An IDS is technical, the analyst reading it is operational.
- Find the verb, then find the owner. Most 1.1 questions resolve in two steps and ten seconds.
Control categories and types are objective 1.1 of Security+ Domain 1, General Security Concepts, the foundation every later domain assumes. Work all 22 Domain 1 topics, from the CIA triad and change management through every cryptographic solution on the exam, with our free Security+ Domain 1 study guide.
#SecurityPlus #SY0701 #SecurityControls #ControlTypes #CompensatingControls #DefenseInDepth #ExamPrep #CompTIA #InfoSec #CyberSecurity
Build the foundation first
Zero Trust is one of 22 topics in Security+ Domain 1, the foundation the rest of the exam builds on. Master all 4 objectives, from control categories through cryptography, with our objective-mapped guide and 60 practice questions.
Get the Domain 1 guideKeep reading
MSA, SOW, SLA, BPA, NDA: The Third-Party Risk Alphabet, and Which Document Answers Which Question
Your vendors are your attack surface, and Security+ Domain 5 tests whether you know the paperwork that manages them. Objective 5.3 end to end: the vendor lifecycle from due diligence to offboarding, the agreement stack (master agreement, statements of work, service levels, business partners, non-disclosure, memoranda), right-to-audit and rules of engagement, questionnaires and ongoing monitoring, and supply chain analysis.
Read Security+ deep divesEstablish, Deploy, Maintain: Secure Baselines, Hardening Targets, BYOD vs. COPE vs. CYOD, and WPA3 on Security+
Objective 4.1 is the widest bullet in the biggest domain, and it hides its questions in verbs and ownership: which baseline step failed when settings drifted, which mobile model gives the least control, why WPA3 ends the offline handshake attack, which application control stops which flaw. The baseline lifecycle, hardening emphasis by device class, site surveys and heat maps, MDM and deployment models, 802.1X with RADIUS, and the application security checklist, decoded the way the exam asks them.
Read Security+ deep divesSPF, DKIM, DMARC, and Friends: The Enterprise Security Capabilities Security+ Expects You to Configure
Objective 4.5 is where Security+ stops asking what a control is and starts asking where it goes. Email authentication drawn as one flow (SPF checks the sender, DKIM signs the message, DMARC decides what happens), web and DNS filtering, DLP and what it can actually see, EDR versus XDR, NAC posture checks, file integrity monitoring, and the placement map that answers every scenario in the objective.
ReadFollow Skillthropic
Keep learning between study sessions
The same exam-focused teaching, in smaller pieces, wherever you scroll.
Enjoyed this? Get the AI security news that matters.
Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.
No spam. Unsubscribe anytime.