Hey, welcome to VoraPrep Audio. Glad you could tune in.
Today we're talking about something that feels really basic, but trips up so many people on exam day: classifying security controls. You might see a question about a new junior analyst, let's call her Alex, who's auditing a system. Alex has to look at everything from a firewall to a policy document and put it in the right bucket. If she gets it wrong, the company could misallocate resources. Or worse, they could fail a critical audit. All because of a security gap she didn't see.
This is exactly what the exam tests. It gives you a scenario, describes a security measure, and asks you to classify it. Get it right, and you bank easy points. Get it wrong, and you're second-guessing yourself for the next ten questions. So let’s make sure you get it right.
The key is to remember you're answering two different questions about any control: how is it implemented, and when does it act?
Think about securing your own house. The "how" is the category. You have the actual technology—the fancy alarm system with sensors on the windows. That’s a Technical control. Then you have the family rules, like "always lock the door when you leave." That's a Managerial control, sometimes called Administrative. It's about policies and procedures. Then there's the stuff you actually do every day, like walking around and checking that the windows are closed before you go to bed. That's an Operational control—a human process. And finally, the deadbolt on the door itself? That’s a Physical control. You can touch it.
See? Four categories, just answering how you're securing the house: Technical, Managerial, Operational, and Physical.
Now for the second question: when does the control act? This gives us the control type.
The lock on your door is a Preventive control. Its whole job is to stop someone from getting in in the first place. Simple.
But what if someone breaks a window? The alarm goes off. That alarm isn't preventing the break-in, but it's sure telling you it's happening. That’s a Detective control. It identifies an incident. Security cameras and audit logs work the same way.
Okay, so the alarm is blaring, the window is broken. What's your plan? You call the police, you restore from backups if it's a server, you re-image a machine. The part of your plan that helps you recover and fix the damage? That’s a Corrective control. It's all about mitigating the impact and getting back to normal.
Now, what about that big "Protected by A.D.T." sign you have in your front yard? It doesn't physically stop anyone. But it might make a burglar think twice and move on to an easier target. That's a Deterrent control. It discourages an attack.
There are a couple more. Let’s say you live in an old building and you can't install a fancy new lock. So, as a workaround, you put a heavy-duty security bar across the inside of the door every night. That bar is a Compensating control. It's an alternative you use when the main, preferred control isn't an option. The exam loves to test this. They'll describe a situation where a system is too old or can't be changed, and you have to spot the workaround. That's your compensating control.
And finally, sometimes a control is just a straight-up order. A policy that says "All employees MUST complete annual security training." That's a Directive control. It mandates behavior.
So, when you see a question, that’s your mental framework. First, figure out the category: is it technology, a policy, a human action, or a physical thing? That's the how. Then, figure out the type: is it stopping something, finding it, fixing it, discouraging it, serving as a workaround, or just telling people what to do? That's the when.
A single control can be a mix. A security camera is a Physical control—it's a tangible object. But its function is to record what happens, making it a Detective type. So it’s both. The exam will usually focus on the primary function described in the scenario.
Here’s the biggest trap: mixing up categories and types. A firewall is implemented with technology, so its category is Technical. Its job is to stop bad traffic before it gets in, so its type is Preventive. The exam might try to make you choose between "Technical" and "Preventive" as if they are competing options. They aren't. They answer different questions. A control has a category and a type.
Let's try a practice question, just like you'd see on the exam.
A company implements strict firewall rules to block unauthorized traffic. They also conduct quarterly security awareness training for all employees on phishing. How would you classify the firewall and the training?
Is it... A. Firewall: Technical, Detective; Training: Managerial, Corrective B. Firewall: Technical, Preventive; Training: Managerial, Directive C. Firewall: Operational, Preventive; Training: Technical, Preventive D. Firewall: Managerial, Detective; Training: Operational, Directive
Take a second.
Okay, let's break it down. The firewall. It's hardware and software, right? So its category is Technical. Its job is to block things before they happen. So its type is Preventive. Right away, we're looking at option B. Now let's check the training. Security awareness training comes from a management decision, a policy. So its category is Managerial. The training tells employees what they must do—or not do—to be secure. It mandates behavior. That makes its type Directive. So, B is the perfect fit. The firewall is Technical and Preventive; the training is Managerial and Directive.
Let's do one more. This one hits on a nuance.
An audit finds that a legacy system can't support modern multi-factor authentication, or M.F.A. As a workaround, the company requires a security analyst to manually review all access logs for that system every single day. What kind of control is this manual review?
Is it... A. Technical and Preventive B. Managerial and Directive C. Operational and Compensating D. Physical and Detective
The key word here is "workaround." The company wants to use M.F.A., which is a strong preventive control. But they can't. So they're doing something else instead. That screams Compensating control. And who is doing it? An analyst, performing a daily task. That’s a human action, a day-to-day process. So the category is Operational. That makes C, Operational and Compensating, our answer. The manual review is an operational task that compensates for the lack of a technical control.
You can see how thinking through this process makes the answer just pop out. By the way, these concepts aren't just theory. They're industry standard. They're laid out in frameworks from the National Institute of Standards and Technology. You'll find them in their special publication 800-53, and also in the CompTIA Security+ objectives.
So, to wrap it all up: always ask two questions. One: How is it built? Is it Technical, Managerial, Operational, or Physical? Two: What does it do? Is it Preventive, Detective, Corrective, Deterrent, Compensating, or Directive? Keep those two tracks separate in your head, watch for keywords like "workaround" or "policy," and you'll be in great shape.
VoraPrep is a full exam-prep app — lessons, practice questions, and an A.I. tutor in one place. Get started at Vora Prep dot com.