The Control Matrix: Four Categories, Six Types, and the Security+ Question You Will See Five Times

Objective 1.1 is the first thing on the Security+ outline and the source of more silly lost marks than any other. The question shows you a control in one sentence: a guard, a backup, a policy, a warning sign. The answers are four real terms. Candidates who studied the definitions still get it wrong, because the outline hides two separate questions inside one: who implements the control, and what it does. Split them, and the whole objective turns into a grid you can draw from memory.

Two axes, one grid

Security+ classifies every control twice. The category is about the nature of the control and who owns it. The type is about its function, what it does to a threat and when. Every control has exactly one category and at least one type, and the exam will happily ask about either axis using the same example.

The categories are four:

The line candidates blur is technical versus operational. A tool is technical. A person using a tool as part of a routine is operational. An intrusion detection system is a technical control; the analyst reviewing its alerts every morning is an operational one. Physical is the easiest to spot and the one the exam uses least, precisely because it is easy.

Types: what the control does, and when

The types are six, and the tidiest way to hold them is by their relationship to the moment of attack.

Two pairs cause nearly all the errors on this axis.

Deterrent versus preventive. A deterrent works on the attacker's decision. A preventive control works on the attacker's ability. A sign that says "premises under surveillance" is deterrent; the lock on the door is preventive. If the attacker ignores the deterrent nothing stops them; if they ignore the preventive control they still cannot get in. On the exam, anything that reduces willingness rather than capability is deterrent.

Corrective versus compensating. Corrective controls fix damage after an incident: restore the backup, reimage the host, apply the patch that was missing. Compensating controls replace a control you cannot implement at all. The medical device that cannot be patched gets network isolation instead; the small team that cannot separate duties gets extra logging and review. The word that signals compensating in a stem is some version of "cannot": the system cannot be patched, the vendor does not support MFA, the budget does not allow a second administrator.

The grid

Put the axes together and every control lands in one cell. The exam does not require you to memorize the grid, but drawing it once makes the classification questions mechanical, because you stop searching for a single right word and start answering two easy questions instead.

Notice that a single control can be more than one type. A visible camera is deterrent (it discourages) and detective (it records). A backup is corrective when restored and preventive of data loss when taken. The exam handles this by asking for the best or primary classification given the scenario, which brings us to the method.

Reading the stem: the verb decides

Most objective 1.1 questions can be answered by finding one verb in the stem and ignoring the noun.

• Stops, blocks, prevents, denies point to preventive.
• Discourages, warns, makes less attractive point to deterrent.
• Identifies, alerts, logs, discovers, notices point to detective.
• Restores, repairs, recovers, returns to normal point to corrective.
• Instead of, because it cannot, as an alternative point to compensating.
• Requires, mandates, instructs, tells employees to point to directive.

Then ask who implements it. Software or hardware doing it automatically is technical. Leadership deciding it is managerial. Staff doing it as a routine is operational. Anything you could kick is physical.

Which type protects which property

The grid also connects to the triad. Objective 1.2 gives you confidentiality, integrity and availability, and the control types map onto them in a way that helps with selection questions. Confidentiality is mostly protected by preventive controls (encryption, access control) and checked by detective ones (access logs, DLP alerts). Integrity leans on detective controls to notice change (hashing, file integrity monitoring) and corrective ones to reverse it (restore from a known-good copy). Availability is where corrective controls do most of the work (failover, backups, redundant power) and where preventive controls look like capacity planning. Non-repudiation is almost purely detective: digital signatures and audit trails exist to prove after the fact who did what.

When a question asks you to pick a control for a stated property, this mapping narrows the answers before you read them. A stem about proving a transaction happened wants a detective control for non-repudiation, not a preventive one for confidentiality, however strong the encryption in the distractor sounds.

Five scenarios, answered in two steps

Practice the method on the shapes the exam actually uses.

1. A bank posts a notice that all transactions are logged and reviewed. Verb: discourages. Owner: management wrote the notice. Managerial deterrent. (The logging itself would be technical detective, but the stem is about the notice.)
2. A hospital installs badge readers on every ward door. Verb: blocks. Owner: hardware on a door. Physical preventive.
3. After a breach, the team restores a database from the previous night's backup. Verb: restores. Owner: staff performing a procedure. Operational corrective.
4. A firm cannot enforce separation of duties in a two-person finance team, so every payment is reviewed by the CFO. Verb: cannot, therefore instead of. Owner: a management-imposed review. Managerial compensating.
5. A new hire is required to complete security training before receiving credentials. Verb: requires. Owner: policy and HR process. Managerial directive, delivered operationally.

Notice how often the category is the harder half. Candidates find the type in the verb quickly and then guess the category from the noun, which is why example five trips people: training feels operational, but the requirement that creates it is managerial.

Why the grid is the foundation of the exam

The rest of Security+ is, in a sense, a long list of controls, and every later objective assumes you can place them. Zero Trust is a set of preventive and detective technical controls arranged around identity. A PKI is a preventive technical control for confidentiality and a detective one for integrity. An incident response plan is a corrective managerial control until the moment it is executed, when it becomes corrective operational. When a Domain 4 or Domain 5 question asks what kind of control something is, it is testing objective 1.1 again with a harder example.

That is also why the outline lists the categories and types first. Everything after them is about selecting the right control for a risk, and you cannot select what you cannot classify.

Control categories and types are objective 1.1 of Security+ Domain 1, General Security Concepts, the foundation every later domain assumes. Work all 22 Domain 1 topics, from the CIA triad and change management through every cryptographic solution on the exam, with our free Security+ Domain 1 study guide.

#SecurityPlus #SY0701 #SecurityControls #ControlTypes #CompensatingControls #DefenseInDepth #ExamPrep #CompTIA #InfoSec #CyberSecurity