CompTIA Security+ guideHigh-value skills
Security+ Security Controls: Categories vs Types
Classify a control on two axes at once: how it is implemented, and what security function the scenario says it performs.
Short answer
SY0-701 uses two lists. Categories are technical, managerial, operational, and physical. Types are preventive, deterrent, detective, corrective, compensating, and directive. A camera is not always detective. A firewall is not always preventive. The stem has to say what the control is doing in that situation. A compensating control fills a gap when the preferred control cannot be used. It is not another name for recovery.
Two axes, not one list
The objectives put control categories and control types on separate lines. Category is how the control is carried out. Type is the security function in the scenario.
| Preventive | Detective | Corrective | Other function | |
|---|---|---|---|---|
| Technical | Firewall drop | Log alert | Automated restore | Compensating allow-list |
| Managerial | Change approval | Access review | Recovery plan | Directive policy text |
| Operational | Same-day disable checklist | Guard log | Technician rebuilds a laptop | Deterrent sign |
| Physical | Locked door | Camera recording | New lock after a break | Same lock, different job |
A control can serve more than one function. Classify the function the question asks about, using the detail it gives. Do not assign every camera, guard, policy, or firewall a permanent type.
The threats guide says what the weakness is. This page says how to label the control. Pricing a control is the risk calculation.
Eight scenarios
1. A host firewall drops inbound traffic to a closed port. Category: technical. Function: preventive. The drop happens before the connection is accepted.
2. The same firewall writes a log, and an analyst reads it the next morning. Category: technical for the log. Function: detective. The connection already happened. Wording change: if the question says the rule blocked the traffic, the function is preventive. If it says the team learned about the attempt from the log, the function is detective. Same product, different job.
3. A sign on a fence says the yard is under video monitoring. Category: physical, if you are classifying the sign in the yard. Function: deterrent. The sign is meant to discourage. The camera behind it, if the question is about the recording, is detective. Do not collapse the sign and the camera into one answer.
4. A manager’s written standard says administrators must use just-in-time access. Category: managerial. Function: directive. The document directs behavior. It does not, by itself, prevent a logon. The technical control that actually expires the permission is a different control.
5. Help-desk staff follow a checklist to remove a departed employee’s badge and account the same day. Category: operational, because people carry out the procedure. Function: preventive for the future logon. If the question is only about the checklist existing, you still need the stem to say the people perform it. A checklist in a binder that nobody runs is closer to directive.
6. A preferred full-disk product cannot run on one medical device. The team isolates that device on its own network segment and documents the exception. Category: technical for the segment. Function: compensating. The isolation stands in for the control they cannot deploy. It is not recovery. Recovery would put a service back after a loss.
7. After ransomware is removed, a technician restores the file share from backup. Category: operational if a person performs the restore, or technical if an automated job does. Function: corrective. It fixes the damaged state. Calling it compensating would be wrong unless the stem says this restore replaces a control that could not be used.
8. A door lock fails. Facilities installs a new lock. Category: physical. Function: corrective. Wording change: before the failure, the working lock was preventive. After the failure, replacing it is corrective. “There is a lock” is not enough context.
Sort a control in an original Security+ question when you want the same two-axis habit in a stem. The free set will not list every product.
Trust the source
Official sources
Exam policies can change. Use these primary sources for the most current details.