Every Security+ Control Answer Needs Two Labels

Objective 1.1 seems to focus on vocabulary. There are four categories and six types to memorize, and then you progress. Then, an exam scenario about a badge reader or a written policy asks which control it is, and half the group picks something the other half has already dismissed.

Why do people disagree on that? Because the question demands two labels, while most study materials present everything as a single list of ten terms.

Two axes, not one list

A control belongs to a category and a type. Categories are about who or what enforces it. There are four:

• Technical. A system does it.
• Managerial. Someone decides and writes it down.
• Operational. People do it as part of their job.
• Physical. You can walk into it.

The type is about timing. It's where the control fits relative to the potential problem:

• Preventive stops it.
• Deterrent makes someone decide not to try.
• Detective notices it.
• Corrective cleans it up afterward.
• Directive tells someone what to do.
• Compensating replaces a control that can't be used.

Every control has one label from each side. A fence is physical and deterrent. Encryption at rest is technical and preventive. A quarterly access review is managerial and detective. Practice answering with both words even when the question asks for just one, as the second word often clarifies the first.

The same control can move between boxes

This is where it feels unfair. A security guard is always physical. The type changes with whatever the question says the guard is doing.

A guard standing at the entrance where everyone can see him, in a question about people deciding not to walk in, is a deterrent. A guard checking badges and turning people away is preventive. A guard watching a camera feed and phoning it in is detective.

Nothing about the guard changes; the surrounding sentence does, and that's what's being tested. Cameras and logging work the same way.

Compensating does not mean extra

Compensating is what people grab for when they are unsure, and using it out of uncertainty is usually wrong.

A compensating control exists when a required control can't be used. The need still stands, though the usual way to meet it is blocked, so something else steps in to cover the same risk. Think of a legacy server that can't handle the current patch; it's isolated on its own network segment with stricter firewall rules and enhanced logging, and that setup compensates for the patch that can't be applied.

Directive is the one that gets skipped

A directive control tells someone what to do. An acceptable use policy, a documented procedure for handling customer records, and a sign by the door reading "one person at a time" are all directive.

The key difference is enforcement. A policy saying laptops must be encrypted is directive and managerial, as it's a policy that controls behavior. Full disk encryption pushed by the MDM that users can't disable is preventive, because it's a technical control that stops something before it happens.

Both aim at the same goal. They are different types though, and the exam will hand you both in the same question set.

Reading the question for the right cue

Verbs are key here.

• Stops it from happening: preventive.
• Makes someone decide not to try: deterrent.
• Notices or alerts or reviews: detective.
• Restores or rebuilds after the fact: corrective.
• Instructs or requires or trains: directive.
• Covers a requirement that can't be met the intended way: compensating.

The category is often clear. A device or a firewall rule is technical. A policy or an audit cycle is managerial. Awareness training and a process someone runs by hand are operational. Locks and cameras and fences and guards are physical.

Practice with pairs

The fix is boring, and it works. When you encounter a control in a practice question or a lesson, say both labels before checking the choices. A badge reader: technical and preventive. A warning banner at login: directive, and technical if the system forces you to click it, managerial if it's just in a handbook.

Do twenty of these and the question stops feeling like vocabulary. Is that tedious? Very. It is also the whole trick. Go through the exam objectives and work down the list instead of relying on someone else's table.

The drag and match performance-based questions ask you to put controls in the right buckets, too. There's a free one on this site if you want to see the format before exam day.