Examkin

Question

Difficulty: HardSecurity Control Categories and Types

A security architect is mapping newly implemented security controls across an enterprise network against CompTIA Security+ control categories (Technical, Managerial, Operational, Physical) and functional control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each enterprise security measure on the left to its corresponding dual-axis classification on the right.

  • An automated Network Access Control (NAC) policy engine that evaluates device health and blocks non-compliant endpoints from associating with production subnets.Technical Category / Preventive Type
  • A corporate governance policy mandating that all employees complete anti-phishing training and sign an acceptable use agreement upon onboarding.Managerial Category / Directive Type
  • A dual-custody biometric mantrap vestibule that physically isolates individuals between two interlocking doors at a data center entrance.Physical Category / Preventive Type
  • An out-of-band Network Intrusion Detection System (NIDS) analyzing mirrored core switch traffic to generate security warnings upon identifying signature anomalies.Technical Category / Detective Type

Answer

Automated NAC dynamic blocking corresponds to Technical / Preventive; Mandatory onboarding policies and agreements correspond to Managerial / Directive; Biometric mantrap vestibules correspond to Physical / Preventive; Out-of-band NIDS monitoring corresponds to Technical / Detective.
Each control measure accurately aligns across both axes: Automated NAC health checks use technological mechanisms to block non-compliant endpoints (Technical / Preventive). Corporate onboarding policies and acceptable use agreements set rules for human behavior through management governance (Managerial / Directive). Biometric mantrap vestibules physically stop unauthorized individuals from entering facility spaces (Physical / Preventive). Out-of-band NIDS sensors use monitoring software to inspect mirrored network traffic and alert on security anomalies without inline blocking (Technical / Detective).

Step-by-Step Solution

1
Determine the primary category for each mechanism based on how it is implemented.
NAC health checking and out-of-band NIDS monitoring rely on hardware/software systems (Technical). Training mandates and acceptable use agreements stem from management oversight and policy frameworks (Managerial). Mantraps rely on physical structures and access barriers (Physical).
Control categories differentiate whether controls are implemented via technology, administrative management, operational procedures, or physical security boundaries.
2
Determine the functional type for each mechanism based on its operational objective during an event.
Blocking non-compliant endpoints and physically stopping tailgating/unauthorized access prevent security incidents before occurrence (Preventive). Mandating behavior directs human actions to comply with organizational expectations (Directive). Identifying anomalous traffic and triggering alerts discovers active or past events (Detective).
Functional types define the specific role a security control plays in the timeline of a threat or security event.
3
Synthesize category and functional type classifications into pair assignments.
Match NAC to Technical / Preventive, onboarding mandates to Managerial / Directive, mantrap to Physical / Preventive, and out-of-band NIDS to Technical / Detective.
Combining category and type provides a complete security control classification.

Key Concept

Dual-Axis Security Control Categorization (Category vs. Functional Type)
Rate this question

Topics

Security Control Categories and Types

More questions from this topic