Examkin

Question

Difficulty: Very hardSecurity Control Categories and Types

Following an enterprise risk assessment, an organization implements several new security measures: (1) automated Endpoint Detection and Response (EDR) agents configured to isolate compromised hosts and terminate malicious processes, (2) formal updates to the enterprise security governance document requiring multi-factor authentication (MFA) across all administrative accounts, (3) decoy honeypot servers deployed in an isolated subnet to attract and monitor threat actors, and (4) mandatory annual security awareness training for all software developers. Which of the following statements correctly classify the category and functional type of these security controls according to CompTIA Security+ standards? (Select TWO).

  1. Automated EDR host isolation and process termination represents a Technical control operating as a Corrective control type.Answer
  2. Formal updates to governance documentation mandating MFA enforcement represent a Managerial control operating as a Directive control type.Answer
  3. C
    Decoy honeypot servers deployed to monitor threat actor techniques represent a Technical control operating as a Preventive inline filtering control type.
  4. D
    Mandatory security awareness training programs for software developers represent a Physical control operating as a Deterrent control type.

Answer

The correct statements are that automated EDR host isolation represents a Technical control operating as a Corrective control type, and formal updates to governance documentation mandating MFA represent a Managerial control operating as a Directive control type.
Automated EDR scripts that isolate hosts and kill malicious processes utilize system technology (Technical category) to contain active threats and restore normal operations (Corrective type). Additionally, official updates to security policy documentation by leadership fall under governance (Managerial category) and dictate mandatory compliance requirements (Directive type).

Step-by-Step Solution

1
Analyze Control 1 (Automated EDR host isolation and process termination)
Categorized under Technical controls because it is executed via software agents and operating system APIs. Functionally classified as Corrective because host isolation actively mitigates an ongoing security event and contains damage.
Technical controls use technology/hardware/software; Corrective controls lessen the impact of an incident after or during occurrence.
2
Analyze Control 2 (Formal governance document updates requiring MFA)
Categorized under Managerial (Administrative) controls because it involves policy documentation and oversight framework design. Functionally classified as Directive because it specifies mandatory security practices and organizational expectations.
Managerial controls deal with security governance, policies, and risk oversight; Directive controls prescribe mandated behaviors.
3
Evaluate Distractor 1 (Honeypot servers as Preventive controls)
Incorrect. Honeypots capture intelligence and detect intrusion; they do not filter or prevent production traffic attacks inline.
Honeypots are Detective/Deception tools, not inline Preventive enforcement points like firewalls or IPS.
4
Evaluate Distractor 2 (Security awareness training as Physical controls)
Incorrect. Security awareness training governs human behavior and day-to-day user tasks, making it an Operational control.
Physical controls protect tangible assets and facilities (e.g., locks, fences, guards). Training is an Operational control.

Key Concept

Dual-axis classification of security controls by Category (Technical, Managerial, Operational, Physical) and Functional Type (Preventive, Detective, Corrective, Deterrent, Compensating, Directive).
Rate this question

Topics

Security Control Categories and Types

More questions from this topic