From class (Day 1): Managerial = also known as administrative controls. Technical = tech solutions used to enforce security (logical controls). Operational = day-to-day activities. Physical = locks, fences, video surveillance, security guards, K-rated fence (vehicle-rated). Control types: preventive; directive; detective → "like monitoring, cameras"; corrective → "minimize the harm — what to do to make it less worse"; deterrent → "a sign, 'beware of mines/dog'". Compensating control → "same or better" alternative control. Class question to think about: what type of control is a security assessment? (Managerial category; detective type — it finds gaps.)
The big idea
A security control is anything that reduces risk. The exam describes every control along two axes and expects you to place any example on both at once:
- Category — who/what implements it (technical, managerial, operational, physical).
- Type — what it does to the threat timeline (preventive, deterrent, detective, corrective, compensating, directive).
Read a scenario, ask "what does it do?" then "how is it implemented?" — that answers almost every question in this objective.
Breakdown 1 — Control categories (how it is implemented)
| Category | Implemented by | Typical examples |
|---|---|---|
| Technical | Hardware/software systems | Firewalls, ACLs, encryption, IDS/IPS, antivirus, MFA, VPN |
| Managerial (administrative) | Policies, planning, oversight | Risk assessments, security policies, vulnerability management program, awareness program design |
| Operational | People doing day-to-day work | Security guards, awareness training delivery, change management execution, backups run by staff, incident response |
| Physical | Tangible barriers and devices | Locks, fences, bollards, badges, lighting, cameras, mantraps (access control vestibules) |
Managerial vs. operational trip-up: managerial is the plan/decision (a policy that says "review logs weekly"); operational is the person doing it (the analyst reviewing logs). Same control area, different category.
Breakdown 2 — Control types (what it does)
| Type | Goal | Timing | Examples |
|---|---|---|---|
| Preventive | Stop the incident from happening | Before | Firewall rules, door locks, least privilege, encryption, disabling unused ports |
| Deterrent | Discourage the attacker (psychological) | Before | Warning signs, visible cameras, login banners, lighting, guards in view |
| Detective | Discover that it happened / is happening | During / after | IDS, log review, SIEM alerts, motion sensors, audits, CCTV review |
| Corrective | Fix or restore after the incident | After | Restoring backups, patching after exploit, IPS blocking an active attack, re-imaging a host |
| Compensating | Alternative control when the primary one isn't feasible | Any | Network segmentation for an unpatchable legacy system; extra logging when MFA can't be deployed |
| Directive | Tell people what to do (mandates behavior) | Before | Acceptable use policy, signage ("authorized personnel only"), procedures, training |
Preventive vs. deterrent: a preventive control works even if the attacker doesn't know it's there (the lock). A deterrent only works because the attacker sees it (the "Beware of dog" sign). A camera can be both: visible = deterrent, recording = detective.
Detective vs. corrective: detective tells you; corrective fixes it. An IDS is detective; an IPS that drops the traffic is preventive/corrective.
Breakdown 3 — Putting both axes together
The exam loves the combination. Practice reading each as category + type:
| Example | Category | Type |
|---|---|---|
| Firewall rule blocking inbound Telnet | Technical | Preventive |
| SIEM alert on impossible-travel logins | Technical | Detective |
| Restoring a server from backup | Operational (staff) / Technical (tool) | Corrective |
| "Authorized personnel only" sign | Physical (sign) | Deterrent / Directive |
| Acceptable use policy | Managerial | Directive |
| Bollards outside the data center | Physical | Preventive |
| Security guard watching a lobby | Operational | Deterrent + Detective |
| Segmenting an unpatchable SCADA host | Technical | Compensating |
| Annual risk assessment | Managerial | Detective (finds gaps) |
| Security awareness training | Operational (delivery) / Managerial (program) | Directive / Preventive |
Breakdown 4 — How the question is usually asked
- "Which control type BEST describes…" → think timeline (before/during/after) and intent.
- "Which control category…" → think who implements it: machine, manager, worker, or wall.
- "The primary control cannot be implemented because… Which is the BEST compensating control?" → pick the alternative that addresses the same risk.
- "A sign warning that the area is monitored…" → deterrent (and it's physical category). If the sign instructs ("Badge in before entering"), it's directive.
Exam tip: When two answers seem right, the more specific control type wins. A visible camera is deterrent; a hidden one recording to a DVR is detective. An IPS is both detective and preventive, but the exam will usually key "preventive" for IPS and "detective" for IDS.
Quick self-check
- Can you name two controls in each of the 4 categories?
- Can you explain deterrent vs. preventive in one sentence?
- What makes a control "compensating" rather than just "another preventive control"? (It substitutes for a required control that can't be implemented.)
Sources: 20260917_173145.jpg, 20260917_173205.jpg