Security controls practice questions
Fifteen free security controls practice questions with explained answers. Security controls are classified in two ways: by category (technical, managerial, operational or physical) and by type (preventive, deterring, detective, corrective, compensating or directive). The same control can be described on both axes, so each stem states which one it asks for. Both appear in objective 1.1 of Security+ SY0-801.
How to use these questions
- Attempt each question before opening the answer, then read why each wrong option fails.
- Note whether the stem asks for the category, the type, or both.
- Ask what the control does at the moment of an incident: stops it, discourages it, spots it, repairs it, or stands in for a missing control.
- The topic guide security control categories explains both axes with examples.
Warm-up: categories and basic types
Question 1. A firewall rule drops inbound traffic to the database port from every network except the application servers. In which control category does this fall?
- A. Managerial
- B. Technical
- C. Operational
- D. Physical
Show answer
Answer: B
A control implemented through systems, software or configuration is a technical control. Managerial controls are policies, risk assessments and oversight. Operational controls are carried out by people in daily procedures. Physical controls act on the real-world environment, such as locks and fences.
Question 2. The company publishes an acceptable use policy that every employee must sign. In which control category does the policy belong?
- A. Technical
- B. Physical
- C. Managerial
- D. Operational
Show answer
Answer: C
Policies, standards and governance set by management are managerial controls. A technical control would be the software that enforces a rule. An operational control is a procedure performed by people day to day. A physical control protects facilities and equipment.
Question 3. Concrete bollards are installed in front of a building entrance to stop vehicles from ramming the doors. Which category and type describe them best?
- A. Technical and detective
- B. Managerial and preventive
- C. Operational and corrective
- D. Physical and preventive
Show answer
Answer: D
Bollards are part of the physical environment, and they stop the attack from succeeding, so they are physical and preventive. Technical controls work through systems. Detective controls discover an event after or during it, and bollards only block. Managerial controls are governance measures.
Question 4. A hidden camera in a storage room records who removes equipment so the footage can be reviewed after a theft is reported. Which control type is the camera in this use?
- A. Detective
- B. Preventive
- C. Deterring
- D. Corrective
Show answer
Answer: A
Recording evidence to identify what happened is a detective control; it does not stop the removal. It is not preventive, because it blocks nothing. It is not deterring, because the camera is hidden and cannot discourage anyone. It is not corrective, because it does not repair or restore anything.
Question 5. After a ransomware infection, the team restores the affected servers from last night's backup. Which control type does the restore represent?
- A. Preventive
- B. Detective
- C. Corrective
- D. Directive
Show answer
Answer: C
Restoring systems and data after an incident to return to a working state is a corrective control. Preventive controls aim to stop the incident from happening. Detective controls identify it. Directive controls tell people what they must do, as policies do.
Scenarios: choosing the right classification
Question 6. The badge reader on a server room door has failed, and the replacement part will take two weeks. In the meantime, a guard is posted at the door and keeps a sign-in log. Which control type is the guard and log?
- A. Preventive
- B. Compensating
- C. Corrective
- D. Directive
Show answer
Answer: B
A control put in place to meet the intent of another control that cannot currently operate is a compensating control. Preventive describes the original badge reader; the guard and log are a temporary substitute for it, which is what makes them compensating. It is not directive, because no policy is being issued. It is not corrective, because nothing is being repaired by the guard.
Question 7. Warning stickers on server cabinets state that tampering is monitored and will be prosecuted. The stickers do not lock anything. Which control type are they?
- A. Deterring
- B. Preventive
- C. Detective
- D. Corrective
Show answer
Answer: A
Controls that discourage an attacker by raising the perceived risk are deterring controls. They block nothing, so they are not preventive. They do not record or alert, so they are not detective. They do not repair damage, so they are not corrective.
Question 8. A data center entrance uses an access vestibule (mantrap) where the outer door must close and lock before the inner door opens. Which category and type describe this control?
- A. Technical and detective
- B. Managerial and directive
- C. Operational and deterring
- D. Physical and preventive
Show answer
Answer: D
A vestibule is a physical structure that stops tailgating by letting only one authenticated person through at a time, so it is physical and preventive. A technical and detective control would be a log or alert. A managerial control would be a policy requiring such entrances. An operational and deterring control would rely on people’s behavior or fear of penalty.
Question 9. A security information and event management (SIEM) platform correlates log data from servers and firewalls and raises alerts on suspicious patterns. Which category and type describe it best?
- A. Technical and preventive
- B. Managerial and detective
- C. Technical and detective
- D. Operational and corrective
Show answer
Answer: C
A SIEM is software, so it is a technical control, and its job is to identify suspicious activity, which makes it detective. A preventive control would block the activity. A managerial control sets governance, and a SIEM is not a policy. An operational control is performed by people, and a SIEM only supports analysts.
Question 10. A written standard states that all company laptops must use full-disk encryption. Which control type describes the written standard itself, not the encryption it requires?
- A. Preventive
- B. Directive
- C. Deterring
- D. Compensating
Show answer
Answer: B
A document that tells people what they must or must not do is a directive control. The encryption it requires is a preventive technical control, but the question asks about the standard. A deterring discourages through perceived consequences. A compensating control substitutes for another control that is unavailable.
Edge cases and traps
Question 11. The security team runs quarterly phishing simulations and holds awareness sessions for all staff. Which category fits this activity best?
- A. Technical
- B. Managerial
- C. Physical
- D. Operational
Show answer
Answer: D
Controls that rely on people carrying out procedures and activities, such as training and awareness programs, are operational controls. Technical controls work through systems. Managerial controls are governance such as policies and risk assessments. Physical controls protect the facilities and equipment.
Question 12. Which pairing of control and type is INCORRECT?
- A. Warning sign - corrective
- B. Restoring data from backup - corrective
- C. Door lock - preventive
- D. Log review - detective
Show answer
Answer: A
A warning sign discourages and is deterring, so calling it corrective is the error. Restoring data from backup is corrective. A door lock is preventive. Reviewing logs to find unauthorized activity is detective.
Question 13. A legacy appliance cannot support multifactor authentication, which policy requires for administrators. The team allows access only through a hardened jump host that enforces MFA and records every session, and documents this as an exception. Which category and type describe the jump host arrangement?
- A. Managerial and directive
- B. Operational and corrective
- C. Technical and compensating
- D. Physical and preventive
Show answer
Answer: C
The jump host is a technical measure, and it replaces the MFA control the appliance cannot provide, so it is technical and compensating. Managerial and directive describes the policy requiring MFA. Operational and corrective would be a staff procedure that repairs damage. Physical and preventive describes controls such as locks.
Question 14. A company protects its data with a perimeter fence, a network firewall, endpoint protection and annual security training. What principle does the use of multiple layers of different controls illustrate?
- A. Zero Trust
- B. Defense in depth
- C. Separation of duties
- D. Least privilege
Show answer
Answer: B
Stacking independent controls across categories so that the failure of one does not expose the asset is defense in depth. Zero Trust removes implicit trust based on location. Separation of duties splits a task between people. Least privilege limits the rights an identity has.
Question 15. The data center racks have locking doors, and a company standard requires the doors to be locked at all times. Which choice classifies the lock and the standard correctly?
- A. Lock: technical and detective; standard: operational and corrective
- B. Lock: managerial and directive; standard: physical and preventive
- C. Lock: operational and deterring; standard: technical and detective
- D. Lock: physical and preventive; standard: managerial and directive
Show answer
Answer: D
The lock is a physical control that stops access, so it is physical and preventive. The standard is written by management and tells people what to do, so it is managerial and directive. The other options mix up the two. Calling the lock technical or detective, or the standard operational or corrective, does not match what each one does.
Where to go next
Read the topic guide security control categories, then practise Zero Trust and IAM and risk calculation. For a longer set, take the free 20-question SY0-801 practice test. Wording traps are covered in multiple-choice exam tips.