Free Security Controls: Categories and Types practice questions
10 free SY0-801 questions on Security Controls: Categories and Types, each with a full explanation — no account needed. This section sits in the Security Foundations part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
Which control category does CompTIA also call logical controls?
Technical controls are also called logical controls; they are enforced by hardware, software and firmware, such as permissions, ACLs and authentication. Managerial controls are also called administrative, physical controls are grouped with environmental ones, and operational controls have no alternate name.
Every employee must read and sign the company's acceptable use policy before receiving a laptop. Which category does the policy belong to?
A policy is a management decision recorded in a document, which makes it managerial, also called administrative. It enforces nothing by itself, so it isn't technical, and although people follow it day to day, the policy itself is management's direction rather than a task someone performs.
A security engineer configures the domain so that any account locks after 10 failed sign-in attempts. Which category BEST describes the lockout setting?
Once configured, the operating system enforces the lockout on every sign-in attempt without anyone deciding each time, so it is technical. Operational is tempting because a person set it up, but a control's category comes from what enforces it, not from who configured it.
Each new hire attends a one-hour security awareness session delivered by the security team during their first week. Which category BEST describes the sessions themselves?
Training delivered to people, changing what they do, is carried out by people as part of daily work, which makes it operational. The decision that training is mandatory is managerial, which makes managerial the tempting answer, but the question asks about the sessions, not the decision to require them.
A fingerprint reader controls the door to a company's records storage room. Which category does this control belong to?
The reader protects physical access to a room, so it is a physical control even though it contains electronics and firmware. Technical is the tempting choice, and it would be right for fingerprint sign-in on a laptop, where the same kind of sensor protects logical access to a system instead of a space.
Which control type makes an attempted attack fail even when the attacker isn't discouraged at all?
A preventive control blocks the threat or makes the attempt fail, so it works no matter what the attacker decides. A deterrent works only on someone who notices it and chooses not to try, a directive relies on people complying, and a detective control records the event without stopping it.
A bank requires each wire-transfer clerk to take two consecutive weeks off every year while a colleague handles their work. Which control type does this requirement provide?
Mandatory vacation is a detective control: when someone else does the job for a while, irregularities the regular employee was hiding tend to surface. It doesn't stop fraud from being attempted, so it isn't preventive, and it neither repairs damage nor substitutes for a control that can't be used.
After a string of car break-ins, a company installs bright floodlights across its parking lot so that thieves will see it as a riskier target and go elsewhere. Which control type do the lights provide in this scenario?
The lights work by changing a would-be thief's mind, which is deterrence; someone who ignores them can still break into a car, so they aren't preventive. Directive controls tell people what they must or must not do, and corrective controls act after an event to limit damage.
After an analyst confirms malware on a workstation, the help desk wipes the drive and reimages it from the standard build. Which control type is the reimaging?
Reimaging acts after the event to remove the damage and return the workstation to normal operation, which is corrective. Confirming the malware was the detective step, and a compensating control stands in for a required control that can't be used rather than responding to an incident.
A sign on the door to a company's data center reads "Authorized personnel only." Which control type BEST describes the sign?
The sign states who may enter and relies on people to comply, which is directive. Deterrent is the close distractor: a sign that warns of consequences, such as one threatening prosecution, deters, while one that states the rule directs. A sign stops no one who ignores it, so it isn't preventive.
Study this section
Every lesson that covers Security Controls: Categories and Types on the SY0-801 exam.