Security Controls

SY0-701 Objective 1.1 asks you to compare and contrast ten control words it names in one breath: "technical, preventive, managerial, deterrent, operational, detective, physical, corrective, compensating, and directive"^[1], and the trick is seeing that they are not one flat list but two independent axes. The overview established that split: four categories (technical, managerial, operational, physical) crossed with six types (preventive, deterrent, detective, corrective, compensating, directive), so every control gets one label from each. This section fills in the full grid so you can place any control the exam throws at you into exactly one cell on each axis, with a concrete example for every combination that actually occurs. The matrix below lays out those two axes as a grid: the four categories run down the side, the six types across the top, and every control occupies exactly one cell.

Why every control needs both labels

The category answers how is this control implemented, and CompTIA pins each category to an implementer. Technical (sometimes called logical) controls are enforced by hardware, software, or firmware with no human in the loop at execution time. Managerial controls are administrative: they are the policies, risk assessments, and planning documents that govern the program. Operational controls are executed by people as part of day-to-day work. Physical controls are tangible barriers in the real world. The type answers what does this control do relative to an incident: stop it, discourage it, discover it, repair it, substitute for a missing control, or instruct people. Because the axes are orthogonal, the same purpose shows up across multiple categories, and the same category hosts multiple purposes.

The grid, with one worked example per realistic cell

	Preventive	Deterrent	Detective	Corrective	Compensating	Directive
Technical	Firewall rule / ACL; MFA enforcement	Login banner warning of monitoring	IDS, SIEM alert, log review	IPS resets the session; restore from backup; patch the exploited flaw	Network segmentation while a patch is pending; extra monitoring	System-enforced password-policy prompt
Managerial	Pre-employment background check; security policy that mandates an architecture	Published sanction / disciplinary policy	Periodic access review; internal audit	Updated risk-treatment plan after an incident	Documented exception with added oversight	Acceptable-use policy; standards & procedures
Operational	Security-awareness training before access; guard who refuses tailgaters	Visible guard patrol	Guard watching CCTV; log monitoring shift	Incident-response team executing the runbook	Manual review step replacing an unavailable automated check	Posted operating procedure staff must follow
Physical	Locked door, bollard, mantrap, fence	"Beware of dog" / no-trespassing sign, visible fence	CCTV recording, motion sensor, door-contact alarm	Fire suppression discharging; backup generator starting	Security guard in place of a broken badge reader	Signage directing visitors to check in

Read the grid as examples, not as the only valid answer per cell. A stem supplies the emphasis that fixes the type. The cells that trip people up are the duplicates, where one mechanism lands in several type columns of the same category row. A guard, for instance, sits in three operational cells at once (preventive, deterrent, and detective) and how to pick between them is Classifying any control on both axes (Step 4). CompTIA expects you to name the type the scenario stresses.

CCTV is the canonical "category fixed, type varies" trap

A closed-circuit camera is technical by category in CompTIA's framing (it is a hardware/software system), and that does not change. What changes is its type: a camera that merely records for later review is detective; a prominently visible camera meant to make attackers think twice is deterrent; it is never preventive on its own, because recording an intrusion does not stop it. The frequent wrong answer marks CCTV as preventive. Recognise that recording is after-the-fact discovery, so the type is detective (or deterrent if visibility is the point), never preventive.

Compensating is not "a second layer"

The single most over-selected wrong type is compensating. A compensating control is a deliberate substitute chosen because the required primary control genuinely cannot be implemented, for example, isolating a legacy server on its own VLAN with heightened monitoring because the vendor patch breaks the application. It is not just "another preventive control you added for depth." If the primary control is present and you are merely layering, the added control is preventive/detective/etc. in its own right, not compensating. The exam tell for compensating is explicit infeasibility language: "cannot patch right now," "the vendor no longer supports," "in place of," "as an alternative to."

Given an arbitrary control, you should be able to assign its category and its type mechanically, then sanity-check the pair against how CompTIA frames the control families. This section is the four-step procedure plus the framework anchor; the figure below traces the same Step 1 to Step 4 path.

Step 1 - category from the implementer

Ask who or what enforces this at the moment it acts:

• Enforced by hardware/software/firmware with no person required at execution -> technical (firewall, MFA, encryption, ACL, IDS/IPS, antivirus).
• A document, policy, plan, or governance activity -> managerial (risk assessment, security policy, background-check policy, change-management approval gate).
• A person performing a task -> operational (awareness training delivery, log-review shift, incident-response execution, a guard's actions).
• A tangible real-world barrier or device -> physical (fence, lock, bollard, mantrap, badge reader, CCTV hardware, fire suppression).

Watchpoints: a policy that mandates a firewall is managerial (the document), while the firewall itself is technical. Awareness training is operational because people deliver and consume it, even though its subject is technical. A badge-reader system is physical (the door hardware) even though software drives it. CompTIA classifies access-control hardware at the door as physical.

Step 2 - type from the timing word

Ask what does it do relative to the incident, and match the scenario's verb:

Scenario language	Type
"stop / block / prevent before it happens"	Preventive
"discourage / make them think twice / warn off"	Deterrent
"detect / alert / discover / identify after the fact"	Detective
"recover / restore / remediate / fix the damage"	Corrective
"instead of / cannot implement the required control, so we..."	Compensating
"policy / procedure / standard that tells staff what to do"	Directive

Step 3 - cross-check against the control framework

The SY0-701 taxonomy is the security-industry vocabulary CompTIA tests, and it maps cleanly onto the catalog in NIST's Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5)^[2], which organises every control into named families such as Access Control, Audit and Accountability, Contingency Planning, Incident Response, and Physical and Environmental Protection. The mapping is intuitive: NIST's Physical and Environmental Protection family is where most CompTIA physical controls live; Access Control and System and Communications Protection hold technical preventive controls; Audit and Accountability holds technical detective controls; Contingency Planning and Incident Response hold corrective controls; and the Planning, Program Management, and policy families hold managerial/directive controls. You do not need the two-letter family identifiers for SY0-701, but recognising that a real control catalog spreads controls across the whole threat lifecycle reinforces why defense in depth wants a deliberate mix of types rather than a stack of preventive controls.

Step 4 - resolve multi-membership by emphasis

Many real controls satisfy more than one type. The rule is: the category is usually fixed, the type follows the scenario's stated objective. A guard is always operational; whether you label the guard preventive (turning people away at the gate), deterrent (visibly patrolling), or detective (spotting an anomaly) depends on the verb the sentence emphasises. A backup is always technical; it is preventive against data loss in principle but the exam almost always frames restoring from backup as corrective (it acts after the incident). When two types seem to fit, pick the one the verb in the stem emphasises. Treat the result as compensating only when it is a substitute for a primary control the scenario says is infeasible; otherwise it is not compensating and keeps the type it earned in Step 2.

Objective 1.1 is part of Domain 1, which is 12% of the scored SY0-701 exam^[1], and control-classification items follow a handful of repeatable shapes. Naming the pattern lets you answer on recognition rather than recall; each pattern just reuses the category step and type step from Classifying any control on both axes above.

Pattern 1 - "What category is this control?"

The stem names one mechanism and the four options are the categories (technical / managerial / operational / physical). Decide by the implementer (Step 1 above), and watch the two classic traps: (a) a policy that mandates a technical control is managerial, not technical (the document is the control, not the firewall it requires); (b) security-awareness training is operational, not technical, because people deliver and perform it. A fence, lock, or bollard is physical; encryption, ACLs, and MFA are technical.

Pattern 2 - "What type is this control?"

The stem names a mechanism plus its purpose, and the options are the six types. Match the timing word (Step 2 above). The highest-frequency distractors all dress an after-the-fact or warn-only control as preventive:

• CCTV / a camera offered as preventive -> wrong; recording is detective, visibility is deterrent (see the CCTV trap in The full category x type matrix).
• A login banner / warning sign offered as preventive -> wrong; it only discourages, so it is deterrent.
• Restore-from-backup or patch-the-flaw offered as preventive -> wrong; it acts after the incident, so it is corrective.
• Any "extra layer" offered as compensating when no primary control is infeasible -> wrong; it keeps its own type. Compensating needs the explicit "cannot implement the required control" / "in place of" language from The full category x type matrix.

Pattern 3 - "Pick the BEST control for this objective"

The stem states a goal and asks which control fits. Translate the goal into a type first, then a category, then to the specific option:

• "We need to discourage people from entering the data center" -> deterrent -> a visible sign or guard, not a lock (a lock is preventive).
• "We need to detect unauthorised changes" -> detective -> file-integrity monitoring / audit logging, not a firewall.
• "We cannot apply the vendor patch but must reduce exposure" -> compensating -> segmentation or added monitoring, explicitly because the patch (the primary control) is infeasible.
• "We need staff to know what is and is not allowed" -> directive -> an acceptable-use policy, not a technical block.

Pattern 4 - the "two correct-sounding" multi-membership item

The stem describes a guard, a camera, or a backup, and two of the six types both look right. Apply the Step 4 rule from Classifying any control on both axes: the category is fixed, so read the verb the stem emphasises to pick the type. A visible guard at the gate is deterrent; the same guard checking badges and turning people away is preventive; the same guard noticing and reporting an anomaly is detective. There is no single universally-correct type. A backup follows the same test: it is corrective when the scenario is about recovering after data loss, because the exam rewards the after-the-incident framing.

Pattern 5 - the framework / coverage question

A stem describes an environment that relies entirely on preventive technical controls and asks what is missing or weakest. The exam-correct instinct is defense in depth: a healthy program deliberately spans the threat lifecycle, so the gap is usually detective controls (you cannot see an incident you failed to prevent) and corrective controls (you cannot recover from one). This mirrors how the NIST SP 800-53 catalog^[2] spreads controls across families covering identification, protection, detection, response, and recovery rather than concentrating them in one place. The wrong answer adds yet another preventive control; the right answer adds the missing lifecycle stage.