An auditor walking a branch office lists what she sees: a fence around the parking lot, a guard at the front door, a camera over the loading dock, a sign reading "Authorized personnel only", a badge reader on the server room, and a firewall in the rack behind it. Her report has to say what each control is and what it does. Security+ tests the same skill with short scenario questions, usually offering four answers that are all real categories or types.
On the CompTIA Security+ SY0-801 exam this sits under objective 1.1, which expects you to classify a control by its category and its type. The two previous lessons defined both lists. This one is practice: worked examples across physical, technical and people-based controls, the four confusions that cost the most points, a method for breaking ties, and a single grid of category by type.
Every control has one category and at least one type
Classify any control in two steps.
First, the category: what carries the control out? A system enforcing it is technical, a management decision or document is managerial, a person performing a task is operational, and a barrier or environmental protection is physical. A control has one category. If something seems to belong to two, you are almost always looking at two controls. The camera is physical, and the guard watching its feed is operational. The policy is managerial, and the Group Policy setting that enforces it is technical.
Second, the type: what does the control do relative to an incident? Here more than one answer can be true. A guard at a front desk deters by being seen, prevents by refusing entry to someone without a badge, and detects when she finds a propped-open fire door on patrol. That isn't a flaw in the model. Types describe functions, and one control can perform several.
So exam questions about type are really questions about emphasis. The scenario describes the control doing one thing, and the right answer names that function. If the guard turns a visitor away, the answer is preventive. If her presence discourages people from loitering by the entrance, it is deterrent. If she notices and reports a broken window, it is detective.
Physical controls show how one device can serve several types
Physical controls are where multiple types are easiest to see. Here are the common ones, each with its category and type:
- Fence: physical. Common physical-security guidance treats a 3- to 4-foot fence as a deterrent to casual trespassers, and an 8-foot fence topped with barbed wire as a barrier that even determined intruders struggle to cross, which makes it preventive as well.
- Door lock or badge reader: physical, preventive. The reader's access log adds a detective function.
- Bollards: physical, preventive. They stop a vehicle from reaching the building.
- Access control vestibule: physical, preventive. It stops tailgating by admitting one person at a time.
- Warning sign: physical. "No trespassing, violators will be prosecuted" is deterrent. "Authorized personnel only" is directive.
- Lighting: physical, deterrent. It also helps cameras and guards see, which supports detection.
- CCTV: physical. Recording and live monitoring make it detective, and a visible camera also deters. On its own it is not preventive, because a camera can only watch a theft happen.
- Motion sensor wired to an alarm: physical, detective.
- Smoke detector: physical/environmental, detective. Fire suppression: physical/environmental, corrective.
The camera is the classic trap. If a question asks which control would have stopped a break-in and offers cameras alongside a lock or bollards, the camera is wrong. If it asks which control would identify who broke in, the camera is right.