Security controls explained for CompTIA Security+ (SY0-701)

Why do security controls feel so confusing?

Because the exam does not simply ask what a control is. It asks you to place it in a category and name its type, and those are two different questions about the same thing. A firewall is both a technical control and a preventive control. Neither answer is wrong. They describe different axes.

Study notes often blur the two lists together, which leaves you memorizing roughly a dozen words with no mental model holding them in place. Then a question offers technical and preventive as two options for one control, both look correct, and the guessing starts. The fix is to keep the axes separate in your head from the very beginning: one axis for who enforces the control, one axis for what job it does.

This all maps to Domain 1.0, General Security Concepts, which carries 12% of the SY0-701 exam and is where objective 1.1 lives. The weight looks small, but this vocabulary threads through the other four domains, so the return on getting it solid is much larger than the percentage suggests.

What are the four security control categories?

Categories describe the nature of a control: what kind of thing it is and who or what carries it out. SY0-701 objective 1.1 lists four categories. Think of this as the who enforces it axis.

A quick self-test sorts most of them. If a machine enforces it, lean technical. If a document or a decision drives it, lean managerial. If a person performs it as part of their job, lean operational. If you can physically touch it, it is physical.

• Technical: enforced by technology and configuration. A firewall rule, disk encryption, or a multifactor prompt. These are sometimes called logical controls.
• Managerial: the decisions and paperwork that direct security. A written risk assessment, a security policy, or a vendor review process. Often called administrative controls.
• Operational: carried out by people doing day to day work. Security awareness training, shift handover checks, or an on-call rotation that reviews alerts.
• Physical: the tangible world. Locks, fences, bollards, badge readers, and cameras.

What are the six security control types?

Types describe the job a control does in the moment. Where categories tell you who enforces a control, types tell you what it accomplishes against a threat: does it stop the event, discourage it, notice it, repair the damage, stand in for something else, or tell people what to do. SY0-701 objective 1.1 lists six types. This is the what job does it do axis.

Deterrent and preventive feel similar and get mixed up constantly. A deterrent works on a person's decision to try. A preventive works whether or not anyone tries. That distinction alone clears up a lot of exam questions.

• Preventive: stops an event before it happens. A firewall blocking a port, or an access control list denying a login.
• Deterrent: discourages someone from trying. A warning banner, a visible camera, or a posted notice that the area is monitored.
• Detective: identifies and records an event, usually after it starts. Log monitoring, an intrusion detection system, or a smoke detector.
• Corrective: fixes or limits damage after an event. Restoring from backup, isolating an infected host, or a patch that closes the hole.
• Compensating: an alternative when the primary control is not possible. Extra monitoring on a legacy server that cannot be patched.
• Directive: instructs or mandates behavior. An acceptable use policy, a posted procedure, or a compliance requirement.

Why does one control belong on both axes?

Because the two axes are independent, every control has a category and at least one type. A firewall is technical (a machine enforces it) and preventive (it blocks traffic before harm). Both labels are true at once. That is the whole trick behind objective 1.1.

Some controls wear several type hats. A security guard is physical by category. By type, that same guard can be a deterrent, since their presence discourages a would-be intruder, preventive, since they stop someone at the door, and detective, since they notice and report something wrong. One control, one category, three types. Exam questions lean on this because it separates students who memorized lists from students who understand the model.

When a question gives you a scenario, run two passes. First ask who or what enforces the control to get the category. Then ask what job it does against the threat to get the type. If the job could be described more than one way, the answer choices can point you to the one the scenario emphasizes. This same layered thinking shows up in zero trust, where many small controls stack to cover one another.

How does the SY0-701 exam actually test this?

Objective 1.1 reads compare and contrast various types of security controls, and it sits in Domain 1.0, General Security Concepts, which carries 12% of the exam. Expect scenario questions, not flashcard definitions. The exam wants you to read the situation, decide what the control does, then match the closest word.

A prompt might describe a company that cannot patch an old system and ask which control best fits added monitoring. The answer is compensating. Another might describe a warning banner and ask for its type. That is deterrent, or directive if it states a rule. Notice how the same reasoning, who enforces it and what job it does, resolves both.

Frameworks like NIST SP 800-53 organize hundreds of real controls into families, and CompTIA's model is the simplified, exam sized version of that same thinking. To drill the classification until it is automatic, work short scenario reps in Study mode rather than rereading lists, and keep the Security+ certification page handy for the current objectives.

Which controls get miscategorized most?

A handful of controls get sorted the wrong way again and again, so it pays to lock these in on sight. Run the two questions, who enforces it and what job it does, and the tricky ones fall into place.

• Encryption is technical and preventive. A machine enforces it and it stops exposure before it happens, so it is not a physical control even though it protects data on a disk.
• A written security policy is managerial and directive. It is a decision on paper that mandates behavior, not something a lock or a machine carries out.
• A backup is technical and corrective. It repairs damage after an incident, so it does not count as preventive no matter how much it saves you.
• Multifactor authentication is technical and preventive, the same pair as a firewall, because technology enforces it and it blocks the bad login before it lands.
• Security awareness training is operational and, by type, preventive or directive. People perform it, and it heads off mistakes before they happen.
• A visible camera is physical, and by type it is a deterrent when it discourages someone and detective when it records what happened.
• A compensating control is not a weaker control. It is a substitute you use when the primary control is not possible, such as extra monitoring on a server you cannot patch.

Security controls come down to two questions

Security controls stop feeling like a memory test once you hold the two axes apart. Category answers who or what enforces the control: technical, managerial, operational, or physical. Type answers what job it does: preventive, deterrent, detective, corrective, compensating, or directive. Every control has one category and at least one type, and some, like a security guard, carry several types at once. For the SY0-701 exam, practice classifying real world controls with both questions until it is reflexive. That habit carries past the test into the actual work, where you will need to explain why a control exists and what it buys you. Short scenario reps and a timed practice exam beat cramming every time.