Security+ ForgeSY0-701 learning engine
Local-first
Dashboard
Security Controls & Zero TrustObjective 1.1

Learn · Build the rule

Control functions

A control's functional type describes what it does: directive controls state required behavior, deterrent controls discourage, preventive controls stop an event, detective controls reveal it, corrective controls restore or limit damage, and compensating controls provide alternative protection when the preferred control is not feasible.

What must stay in working memory

  • Category and function are independent axes: a technical control can be preventive, detective, or corrective.
  • Classify by the immediate effect, not by every possible secondary benefit.
  • A compensating control should address the original risk with comparable protection and be documented as an exception.

Concrete examples

  • MFA is usually preventive; a failed-login alert is detective; restoring a known-good image is corrective.
  • A warning banner deters, while a required-handling policy directs.

Decision rules you’ll retrieve

Classify a control's primary function

Use the control's immediate primary effect: instruct, discourage, block, discover, restore, or substitute for an unavailable requirement.

Retrieval cue: Name the six common functional control types and give a one-verb test for each.

Choose a defensible compensating control

When the required control cannot be used, choose a documented, time-bounded alternative that reduces the same risk—not merely a convenient unrelated safeguard.

Retrieval cue: State the test that makes an alternative safeguard a compensating control rather than an unrelated extra control.

Distinguish deterrent, preventive, and detective effects

Discouragement is deterrent, enforced blocking is preventive, and evidence or alerting that reveals an event is detective.

Retrieval cue: For one attempted intrusion, describe what a deterrent, preventive, and detective control would each do at a different moment.