1.1 Security controls explained

Objective 1.1 is about vocabulary, but it is vocabulary you will use on almost every other objective. Security+ describes any control along two separate axes, and most questions on this objective test whether you can keep them apart.

The first axis is the category: what the control is made of. A technical control is enforced by technology, such as a firewall rule, encryption or an access control list. A managerial control is a decision or document that directs security from above, such as a risk assessment, a security policy or a hiring standard. An operational control is carried out by people as part of daily work, such as a guard checking badges, a backup rotation or awareness training. A physical control acts on the physical world: fences, locks, bollards, cameras and mantraps.

The second axis is the type: what the control does. A preventive control stops something from happening, like a locked door or a firewall block. A deterrent control discourages an attacker without physically stopping them, like warning signs or visible lighting. A detective control notices that something happened, like log review, motion alerts or an intrusion detection system. A corrective control fixes things after an event, like restoring from backup or reimaging a host. A compensating control is an alternative used when the normal control can't be applied, such as isolating an unpatchable system. A directive control tells people what to do and relies on them to comply, like a policy that says to lock your screen.

Because the axes are independent, one control has both a category and a type. A security guard is a physical (or operational) control that can be deterrent, preventive and detective at the same moment. Exam questions often name a control and ask for the best pair, so read every word of the scenario: a camera that only records is detective, but a sign announcing the camera is deterrent.

A good habit is to ask two questions of every control you meet: what is it made of, and when does it act? Before the event (preventive, deterrent, directive), during it (detective) or after it (corrective). Compensating sits outside that timeline because it is defined by why it exists: the primary control isn't possible.