An enterprise security team is categorizing various security controls according to CompTIA Security+ framework classifications. Match each security control implementation on the left with its corresponding control category and functional type on the right.
- Developing and enforcing an enterprise Information Security Policy that specifies mandatory data handling rules.Managerial Category / Directive Type
- Deploying web application firewalls (WAF) to automatically block SQL injection attempts against web applications.Technical Category / Preventive Type
- Restoring system configurations and databases from isolated backups following a malware encryption incident.Operational Category / Corrective Type
- Installing high-visibility warning signs along the perimeter fencing of a secure data center facility.Physical Category / Deterrent Type
Answer
Developing security policies matches Managerial Category / Directive Type; Web application firewalls match Technical Category / Preventive Type; Restoring systems from backups matches Operational Category / Corrective Type; Installing perimeter warning signs matches Physical Category / Deterrent Type.
Each control is correctly classified based on CompTIA Security+ standards: Enterprise policies are governance-driven (Managerial) rules (Directive); WAFs are technology safeguards (Technical) that proactively block attacks (Preventive); data restoration is a procedural task (Operational) that remedies post-incident damage (Corrective); and physical warning signs are tangible facility measures (Physical) meant to discourage intruders (Deterrent).
Step-by-Step Solution
Key Concept
Dual-axis classification of security controls by category (Managerial, Technical, Operational, Physical) and functional type (Preventive, Deterrent, Detective, Corrective, Compensating, Directive).