Compare and contrast various types of security controls
Every safeguard an organization deploys — a firewall rule, a policy document, a fence, a log review — is a security control. This objective gives you the two-axis classification system CompTIA uses everywhere else on the exam: category (how the control is implemented and by whom) and type (what the control does relative to an incident).
A security control is any measure put in place to reduce risk — to prevent, detect, or recover from a security event, or to discourage or redirect the behavior that causes one. Because organizations deploy hundreds of controls, security professionals classify them along two independent axes. The category answers "who implements this, and through what mechanism?" The type answers "when does this act relative to an incident, and what does it accomplish?" Every control has exactly one obvious category on the exam, but a single control can serve different types depending on how it's used — a camera detects intrusions and deters intruders who can see it.
Control categories — how a control is implemented
CompTIA defines four categories. Learn them by their implementation mechanism, not by memorizing example lists: technical controls are enforced by systems, managerial controls by governance and planning, operational controls by people executing day-to-day processes, and physical controls by the tangible world.
Both involve people, so use this test: managerial controls decide and plan (writing the risk assessment, approving the policy, designing the training program), while operational controls execute (the guard walking the patrol, the analyst reviewing logs, the employee attending the training). A policy document is managerial; following the procedure it mandates is operational. When a badge reader enforces the rule, it has become technical or physical.
Control types — when a control acts
The six control types describe a control's function relative to an incident timeline. Preventive, deterrent, and directive controls operate before an incident; detective controls operate during (or immediately after) one; corrective controls operate after. Compensating controls sit outside the timeline — they are substitutes deployed when the preferred control isn't feasible.
Deterrent — discourages the attempt (warning banners, visible cameras, guards)
Preventive — blocks the attempt outright (firewall, locks, MFA, encryption)
Category = WHO/HOW it's implemented (technical, managerial, operational, physical). Type = WHEN/WHY it acts relative to an incident (preventive, deterrent, detective, corrective, compensating, directive). Exam questions often combine both — "a fence is a physical preventive control," "an IDS is a technical detective control," "an AUP is a managerial (or directive) control." If the question asks for the category, don't answer with a type, and vice versa.
Putting the axes together — the classification matrix
Any control can be placed in a category × type grid. You don't need to memorize this table cell-by-cell; you need to be able to generate it. Given any control, identify its mechanism (category) and its function (type).
| Type ↓ / Category → | Technical | Managerial | Operational | Physical |
|---|---|---|---|---|
| Preventive | Firewall rules, MFA, disk encryption | Hiring background checks, onboarding policy | Guard verifying IDs at the door, separation of duties in a process | Fences, locks, bollards, access control vestibule |
| Deterrent | Login warning banner | Published sanction/discipline policy | Visible guard presence, "you are being logged" reminders | Warning signs, bright lighting, visible cameras |
| Detective | IDS, SIEM alerts, file integrity monitoring | Internal audits, mandatory vacation to expose fraud | Log review, patrol rounds, incident reporting | Motion sensors, CCTV recording |
| Corrective | Backup restore, patching, AV quarantine | Updated policy after lessons learned | Incident response procedure execution | Fire suppression, repairing a breached fence |
| Compensating | Segmentation + extra monitoring for unpatchable host | Cyber insurance where risk can't be reduced | Manual log review where automated monitoring isn't available | Security guard where a badge system isn't feasible |
| Directive | Configuration standards pushed as policy templates | AUP, security policies, SOPs | Posted procedures, mandatory training attendance | "Authorized personnel only" signage, escape-route maps |
No single control type is sufficient. Preventive controls fail (misconfigurations, zero-days), so you need detective controls to catch what slips through and corrective controls to recover. Layering controls of different types and categories so that the failure of one is caught by another is defense in depth — the design philosophy behind almost every "which control should be added?" exam scenario.
Compensating controls — the exam's favorite scenario
Compensating controls deserve extra attention because they're tested through scenarios rather than definitions. The pattern: a primary control is required but infeasible — a medical device runs an OS the vendor won't patch, a legacy application breaks under modern authentication, a small office can't afford a 24/7 guard. The organization must still address the risk, so it deploys an alternative that achieves a comparable level of protection.
PCI DSS (the payment card standard) formalizes this: if a business can't meet a requirement as written, it may document a compensating control that meets the intent and rigor of the original. That's exactly the meaning CompTIA tests.
Four categories: technical (enforced by systems), managerial (governance/planning), operational (people's day-to-day processes), physical (tangible barriers). Six types: preventive (blocks), deterrent (discourages), detective (identifies/records), corrective (restores after), compensating (substitute when the primary is infeasible), directive (mandates behavior). Deterrent ≠ preventive: a deterrent can be ignored; a preventive control physically or logically stops the action. "Legacy/unpatchable" in a stem almost always signals compensating. A single control can serve multiple types (visible camera = deterrent + detective) — read the scenario for the function being described.
Knowledge check15 questions
Tap an answer to check it instantly and read the explanation.
1. A company installs a chain-link fence topped with razor wire around its data center property. Which control category does this represent?
2. A security analyst deploys an intrusion detection system (IDS) that generates alerts when suspicious traffic patterns are observed on the network. Which control type BEST describes the IDS?
3. A login screen displays a banner warning that unauthorized access is prohibited and that all activity is monitored and may be prosecuted. The banner does not technically block any login attempt. Which control type is this?
4. A manufacturing plant runs a legacy control system whose vendor no longer issues security patches. Because the system cannot be patched, the security team places it on an isolated network segment with strict firewall rules and enhanced monitoring. Which control type BEST describes the isolation and monitoring?
5. An organization publishes an acceptable use policy (AUP) requiring all employees to lock their workstations when stepping away and prohibiting the use of personal USB drives. Which control type does the AUP MOST directly represent?
6. After a ransomware infection encrypts a file server, administrators restore the data from the previous night's backup and re-image the server. Which control type do these recovery actions represent?
7. A CISO commissions an annual risk assessment and uses the results to prioritize the security budget and update the incident response plan. Which control category do these activities fall into?
8. Every morning, a help-desk technician reviews the previous night's authentication logs for failed login spikes, following a documented checklist. Which control category BEST describes this daily log-review activity?
9. An administrator enables full-disk encryption on all company laptops so that data cannot be read if a device is stolen. How should this control be classified?
10. Following a weekend break-in, investigators review recorded video surveillance footage to identify how the intruder entered the building. In this scenario, the recorded footage is serving as which control type?
11. A retail store wants to discourage shoplifting and break-in attempts without physically blocking anyone. Which combination BEST achieves a purely deterrent effect?
12. An organization already uses a next-generation firewall to block malicious traffic. Management wants to add a layer that will identify attacks that succeed in getting past the firewall. Which addition BEST fulfills this defense-in-depth goal?
13. A bank requires employees in sensitive financial roles to take two consecutive weeks of vacation each year, during which another employee performs their duties. What is the PRIMARY control function of this policy?
14. After a vehicle crashed through the front of a nearby store, a company installs concrete bollards in front of its building entrance. How is this control BEST classified?
15. A compliance framework requires automated 24/7 security monitoring, but a small firm cannot afford a SOC or SIEM this year. Instead, a senior administrator performs a structured manual review of critical logs twice daily, and the exception is documented for reassessment next budget cycle. Which statement BEST describes the manual review?