Control Intent Matching for Security+
Short answer
Control intent matching requires two separate questions. First ask, "What form does the control take?" That gives the category. Technology points to technical. Management direction, approval, or oversight points to managerial. Repeated staff action or procedure execution points to operational. Protection of a tangible location or asset points to physical.
Why it appears on the exam
SY0-701 1.1: Given a simple risk or failure scenario, choose the control category and type that best matches the intended security outcome.
Key concepts
Concept 1
Required terms
Control intent: the security outcome a control is meant to produce in a scenario. Category: the form or organizational lane of a control, such as technical, managerial, operational, or physical. Type: the purpose of a control, such as preventive, deterrent, detective, corrective, compensating, or directive. Best match: the answer that most directly fits the scenario's main cue, even if another label could apply in a broader real-world discussion.
Example
A company adds an automated rule that rejects connections from unauthorized network ranges. Category: technical. Type: preventive. The rule is system-enforced and blocks the unwanted connection.
Concept 2
How Control Intent Matching works
Control intent matching requires two separate questions. First ask, "What form does the control take?" That gives the category. Technology points to technical. Management direction, approval, or oversight points to managerial. Repeated staff action or procedure execution points to operational. Protection of a tangible location or asset points to physical.
Example
A facility posts signs warning that unauthorized entry is monitored. Category: physical. Type: deterrent. The sign is part of the physical environment and discourages the attempt.
Concept 3
Common confusion
The most common mistake is answering with a familiar control name instead of classifying the scenario. Another common mistake is treating examples as fixed labels. The same broad example can change type when the scenario changes: a camera used as a visible warning is deterrent, while a camera used to record evidence is detective.
Example
A policy requires a manager to approve all privileged access requests. Category: managerial. Type: directive. The control is management direction and instructs required behavior.
Concept 4
What to recognize
Choose the category and type for a one- or two-sentence scenario; Select the best type when multiple side effects are possible but one primary purpose is stated; Interpret signal words such as block, warn, alert, restore, substitute, require, and instruct; Explain why a plausible alternate answer is weaker because it describes category instead of type, or a side effect instead of primary purpose.
Example
A security analyst reviews daily access reports to find inappropriate permissions. Category: operational. Type: detective. A person follows a recurring process to identify a condition.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.A security team sees this situation: A company adds an automated rule that rejects connections from unauthorized network ranges. Category: technical. Type: preventive. The rule is system-enforced and blocks the unwanted connection. Which concept applies?
Q2.A Security+ scenario describes this situation: A company adds an automated rule that rejects connections from unauthorized network ranges. Category: technical. Type: preventive. The rule is system-enforced and blocks the unwanted connection. Which answer fits best?
Q3.For this Security+ objective, the scenario says: A company adds an automated rule that rejects connections from unauthorized network ranges. Category: technical. Type: preventive. The rule is system-enforced and blocks the unwanted connection. Which concept should you choose?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8