At 11:40 on a Friday night, a phishing campaign carrying a ransomware loader reaches a company's mail gateway. The gateway blocks 43 copies, but one slips through to an accounts clerk, who opens it. Within seconds the endpoint agent spots files being renamed with a new extension, kills the process and cuts the laptop off the network, and on Monday the help desk restores the clerk's files from the previous night's backup. Every step in that story is a security control, and each one did a different job.
That job is what Security+ calls the control type. On the CompTIA Security+ SY0-801 exam, control types sit under objective 1.1, alongside the control categories from the previous lesson. The exam expects you to read a scenario and say whether a control directs, deters, prevents, detects, corrects or compensates. This lesson covers all six in roughly the order they act around an incident, and the wording that signals each one.
A control's type describes what it does around an incident
A control's category tells you how it is implemented. Its type tells you its function, and the clearest way to see function is to place the control on an incident timeline:
| Type | When it acts | What it does | Example |
|---|---|---|---|
| Directive | Before | Tells people what they must or must not do | Acceptable use policy |
| Deterrent | Before | Discourages an attacker from trying | Warning sign |
| Preventive | Before or at the attempt | Makes the attempt fail | Firewall deny rule |
| Detective | During or after | Identifies and records the event | IDS alert |
| Corrective | After | Limits damage and restores operation | Restore from backup |
| Compensating | Any time | Substitutes for a control that can't be used | Isolating an unpatchable host |
CompTIA's SY0-801 objectives call the second type deterring. Most texts, and this course, say deterrent; the meaning is identical, and you should recognize both words. Some other frameworks list recovery as a separate type. SY0-801 doesn't, so restoring systems and data counts as corrective on this exam.
Types and categories combine freely. A deterrent can be physical (a sign), technical (a login banner) or managerial (a published sanctions policy). Many controls also have more than one type. A security guard deters by being visible, prevents by refusing entry, and detects on patrol. When a question asks for one type, the scenario's wording tells you which function it means, and the next lesson practices that skill.
Preventive controls stop an action before it succeeds
A preventive control blocks a threat or makes an attack fail. It works whether or not the attacker is discouraged, because it doesn't depend on the attacker's choices. Firewall rules that deny inbound traffic, multifactor authentication, file permissions, encryption, application allow lists, an intrusion prevention system dropping malicious packets inline, door locks and access control vestibules are all preventive.
Account lockout is a typical example. With a lockout threshold of 10 failed attempts, a password-guessing tool gets about 10 guesses before the account locks, instead of thousands per hour. The threshold treats a curious teenager and a professional crew exactly the same: both are stopped.
People-focused controls can be preventive too. Separation of duties prevents one employee from both creating a new vendor and approving payments to it, and background checks keep known risks out of sensitive roles.
No preventive control is perfect. Users approve fraudulent MFA prompts, firewalls permit whatever their rules allow, and locks can be picked. That is why prevention is always paired with detection and correction. On the exam, verbs such as block, stop, deny, restrict and prevent point to preventive.