Security control categories and types
Domain 1: General Security Concepts · Not started
Main exam topics
Security controls; confidentiality, integrity and availability; authentication and authorization; zero trust; physical security; change management; non-repudiation; encryption, hashing, certificates and digital signatures.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Categories: who or what implements it
Technical controls are implemented by systems, such as firewalls and encryption. Managerial controls are policies and risk decisions, such as an acceptable use policy or a risk assessment. Operational controls are carried out by people, such as security guards or awareness training. Physical controls protect facilities, such as fences, locks, and bollards.
Types: what it accomplishes
Preventive controls stop an event, like a door lock. Deterrent controls discourage it, like a warning sign. Detective controls identify it, like an IDS or log review. Corrective controls fix it afterward, like restoring from backup. Compensating controls provide alternative protection when the preferred control is not possible, such as extra monitoring on a legacy system that cannot be patched. Directive controls tell people what to do, like a policy requiring badges to be worn.
One control, two labels
Each control has both a category and a type. A CCTV camera is physical and detective. A firewall rule is technical and preventive. Questions usually ask for one label, so read carefully whether the answer should be a category or a type.
Know the difference: Preventive vs. detective
| Aspect | Preventive | Detective |
|---|---|---|
| Goal | Stop the event | Identify the event |
| Examples | Firewall, lock, IPS | IDS, CCTV, log review |
| Timing | Before | During or after |
Saved