Security Control Types for Security+
Short answer
Control types answer the question, "What is this control trying to accomplish?" Preventive controls act before or during an attempt to keep the event from succeeding. A locked door, network allow list, account lockout threshold, or permission restriction can be preventive because it blocks access or action.
Why it appears on the exam
SY0-701 1.1: Differentiate preventive, deterrent, detective, corrective, compensating, and directive controls by their purpose in a scenario.
Key concepts
Concept 1
Required terms
Control type: a classification that describes what a security control is intended to do to a risk event. Preventive control: a control intended to stop or block an unwanted action before it succeeds. Deterrent control: a control intended to discourage someone from attempting an unwanted action. Detective control: a control intended to identify, log, alert on, or reveal that an unwanted action occurred or is occurring.
Example
A network filter blocks inbound traffic to a disallowed service. Type: preventive control, because it stops the traffic before the service is reached.
Concept 2
How Security Control Types works
Control types answer the question, "What is this control trying to accomplish?" Preventive controls act before or during an attempt to keep the event from succeeding. A locked door, network allow list, account lockout threshold, or permission restriction can be preventive because it blocks access or action.
Example
A sign states that activity is monitored and unauthorized access is prohibited. Type: deterrent control, because it discourages misuse.
Concept 3
Common confusion
Deterrent and preventive controls are often mixed up. A preventive control blocks the action; a deterrent control discourages the attempt. Detective and corrective controls are also commonly confused. A detective control reveals a problem; a corrective control addresses the problem after discovery.
Example
A monitoring rule sends an alert after repeated failed logins. Type: detective control, because it identifies suspicious activity.
Concept 4
What to recognize
Given a control, identify its type from the intended purpose; Distinguish deterrent from preventive when a control warns versus blocks; Distinguish detective from corrective when a control alerts versus fixes; Recognize compensating controls from phrases such as "cannot implement the required control" or "alternate safeguard.".
Example
A restore process returns a corrupted server to a known good state. Type: corrective control, because it helps recover after damage.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.On the exam, this detail appears: A network filter blocks inbound traffic to a disallowed service. Type: preventive control, because it stops the traffic before the service is reached. Which answer matches it?
Q2.A Security+ scenario describes this situation: A network filter blocks inbound traffic to a disallowed service. Type: preventive control, because it stops the traffic before the service is reached. Which answer fits best?
Q3.A security team needs to decide what this situation represents: A sign states that activity is monitored and unauthorized access is prohibited. Type: deterrent control, because it discourages misuse. Which option fits?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8