Most candidates who fail CompTIA Security+ control questions make the same mistake: they try to memorize lists of examples. This strategy collapses under exam pressure because the test isn't about recall. It's about applying a decision-making framework to a scenario you've never seen before.
CompTIA Security+ (SY0-701) classifies controls by their nature (Technical, Managerial, Operational, Physical) and by their function (Preventive, Detective, Corrective, Deterrent, Compensating, Directive). To pass, you must analyze a control's mechanism and its timing relative to a threat, not just match keywords from a list.
Key facts
- Exam Code
- SY0-701
- Official Body
- CompTIA
- Pass Rate
- Industry estimates suggest the pass rate is approximately 65-75%, as CompTIA does not publish official numbers.
- Control Categories
- Technical, Managerial, Operational, Physical define the nature of the control.
- Control Types
- Preventive, Detective, Corrective, Deterrent, Compensating, Directive define the function.
- Relevant Domain
- General Security Concepts (12% of the SY0-701 exam).
Security Controls Cheat Sheet: The 10 Terms You Must Know
The single biggest mistake candidates make is getting bogged down in long paragraphs of definitions. For the exam, you need a quick-reference model. This table is your starting point.
| Control Category / Type | Primary Function (The 'What' or 'When') | Classic SY0-701 Example |
|---|---|---|
| Technical | Implemented through technology (software, hardware). | Firewall, Antivirus, Encryption |
| Managerial | High-level policies and procedures from management. | Security Policy, Risk Assessment |
| Operational | Day-to-day procedures executed by people. | Backups, Patch Management |
| Physical | Tangible items you can physically touch. | Fences, Locks, Security Guards |
| Preventive | Stops an incident before it happens. | Strong Passwords, Firewall Rules |
| Detective | Identifies an incident after it has started. | Intrusion Detection System (IDS) |
| Corrective | Fixes damage after an incident is detected. | Restoring from a backup |
| Deterrent | Discourages an attacker from even trying. | "Beware of Dog" sign, Visible Cameras |
| Compensating | An alternative control when the main one isn't possible. | Strict IP whitelisting for a legacy app |
| Directive | A mandatory rule or policy people must follow. | Clean Desk Policy, Acceptable Use Policy |
This framework is a simplified industry model. It's worth noting that official standards like NIST SP 800-53 use a much more granular set of control families (e.g., Access Control, Audit and Accountability) which map to these broader CompTIA categories. You don't need to memorize the NIST families, but knowing they exist provides helpful context.
Studying for CompTIA Security+? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
What is the Core Framework for Classifying Controls?
Classifying controls correctly on the exam requires a simple, two-question framework that you can apply to any scenario in under 30 seconds. Forget memorizing dozens of examples. Internalize this process.
For any control described in a question, ask yourself:
- What is its fundamental mechanism? This determines the Category.
- Is it technology (software, hardware, firmware)? It's Technical.
- Is it a high-level plan, policy, or risk management decision? It's Managerial.
- Is it a day-to-day process performed by people? It's Operational.
- Is it a tangible object in the real world? It's Physical.
- What is its primary purpose and timing? This determines the Type.
- Does it stop something before it happens? It's Preventive.
- Does it find something after it happens? It's Detective.
- Does it fix something after it's found? It's Corrective.
- Does it try to scare someone away before they act? It's Deterrent.
- Is it a backup plan for a missing control? It's Compensating.
- Does it tell someone what to do? It's Directive.
This method forces you to analyze the control based on its function within the scenario, which is exactly what the examiner is testing. Test your ability to apply this framework with some adaptive CompTIA Security+ practice questions.
Worked Example: Applying the Framework Under Exam Conditions
You are a security analyst at a fictional company. Your manager presents a list of recently implemented security measures and asks you to classify them for a compliance report.
Scenario: The company has implemented:- A Web Application Firewall (WAF) to block SQL injection attacks.
- A new corporate policy that mandates quarterly security awareness training for all staff.
- A CCTV system that records all activity at the server room entrance.
- An automated system that restores a database from the previous night's snapshot if corruption is detected.
- A sign at the data center entrance stating, "Unauthorized Access Prohibited. All activity is monitored."
Let's apply the two-question framework.
Step 1: Web Application Firewall (WAF)
- Mechanism? It's a hardware/software appliance. Verdict: Technical Control.
- Purpose/Timing? It blocks attacks before they hit the server. Verdict: Preventive Control.
Step 2: Mandatory Security Awareness Training Policy
- Mechanism? This is a high-level rule from management about risk. Verdict: Managerial Control.
- Purpose/Timing? It tells people what they must do (attend training). Verdict: Directive Control.
- Note the nuance: The policy itself is Managerial and Directive. The act of conducting the training is an Operational control, and its goal is Preventive. The exam will test if you can spot this distinction.
Step 3: CCTV System
- Mechanism? It's a tangible camera system. Verdict: Physical Control.
- Purpose/Timing? It records an event as it happens for later review. It doesn't stop it. Verdict: Detective Control. The visible presence of the camera also serves a secondary purpose: to discourage intruders. This makes it a Deterrent as well. The primary function for evidence is Detective.
Step 4: Automated Backup Restoration
- Mechanism? It's a software-driven process. Verdict: Technical Control.
- Purpose/Timing? It fixes a problem (data corruption) after it has occurred. Verdict: Corrective Control.
Step 5: Data Center Warning Sign
- Mechanism? It's a policy statement. Its physical form is incidental to its function. Verdict: Managerial Control.
- Purpose/Timing? It aims to influence behavior and scare off intruders before they attempt entry. Verdict: Deterrent Control. It also explicitly states a rule, making it a Directive control.
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What Are the Most Common Control Traps on the SY0-701 Exam?
The exam writers know exactly where candidates get confused. They build questions specifically to exploit these gray areas. Here are the traps to watch for.
- Confusing Deterrent vs. Preventive: This is the #1 trap.
- Preventive: Physically or logically stops an action. Think of a locked door.
- Deterrent: Psychologically discourages an action. Think of a warning sign.
- Memory Hook: Preventive = Physically stops. Deterrent = Discourages.
- Misclassifying Managerial vs. Operational: This is a close second.
- Managerial: The plan. This is about governance, risk assessment, and policy creation. "We will have an incident response plan."
- Operational: The action. This is about the day-to-day execution of the plan by people. "The team is now executing the incident response plan."
- Memory Hook: Managerial is the Map. Operational is the On-foot journey.
- Forgetting Compensating Controls: Exam questions love to describe a situation where a best-practice control (like MFA on a server) isn't possible due to a legacy system. The question will then ask you to identify the alternative measure put in place. That alternative is the compensating control.
- Ignoring the "Primary" Purpose: A single tool can serve multiple functions. A security guard (Physical) is Preventive (stops intruders), Deterrent (scares them off), and Detective (reports incidents). The question's context will always point to one of these as the primary function you need to identify.
How Can You Master Security Controls for the Exam?
A structured, active-recall approach is far more effective than passively re-reading definitions. Here is a practical plan.
Days 1-2: Build the Foundation- Use the cheat sheet table in this article as your source of truth. Create your own flashcards for the 10 terms using a spaced-repetition system like VoraPrep's FSRS flashcards.
- For 20 common security measures (e.g., VPN, biometric scanner, change management process), classify each into its primary category and type. Write down your reasoning.
- Focus on scenario analysis. Work through practice questions specifically on security controls. VoraPrep's adaptive learning engine is perfect for this, as it will automatically surface questions from your weaker areas within the General Security Concepts domain.
- For every question, apply the two-question framework: "What is its mechanism?" and "What is its purpose/timing?" Say it out loud.
- Intentionally seek out difficult questions. When you get one wrong, don't just look at the right answer. Read the explanation for why your choice was wrong. This is how you learn to spot distractors.
- If you're stuck on why a control is classified a certain way, use Vory, your 24/7 personal tutor, to get a step-by-step breakdown. Ask it "Why is this corrective and not preventive?" to deepen your understanding.
- Take a timed mock exam using VoraPrep's 1:1 test-center simulators. This simulates the pressure of exam day and forces you to apply the framework quickly and accurately.
- Review your results, paying special attention to any control-related questions you missed. Solidify these concepts before your exam. A solid grasp of controls is essential, given the difficulty and pass rate of the Security+ exam.
Ready to Pass Your CompTIA Exam? Stop struggling with passive video lectures and generic notes. VoraPrep provides a complete, interactive course with 1,500+ adaptive practice questions, textbook-grade lessons, and Vory, your 24/7 personal tutor. Our 6-pillar system is designed to help busy professionals pass efficiently.
Visit voraprep.com to get started
Start Your Free 14-Day Trial at voraprep.com →