Security Controls

Part A — Multiple Choice

Q1

A company installs firewalls, enables antivirus, and configures OS-level permissions. Which category of security control does this represent?

A. Managerial B. Operational C. Technical D. Physical

✅ Correct: C — Technical. Firewalls, antivirus, and OS controls are all technology-based systems — the defining characteristic of technical controls.

Q2

An organization posts "Warning: All activity on this system is monitored" on its login screen. What type of control is this?

A. Preventive B. Detective C. Corrective D. Deterrent

✅ Correct: D — Deterrent. The warning discourages malicious activity but does NOT actually prevent access. Key clue: the attacker can still log in — it just makes them think twice.

Q3

After a ransomware attack, the IT team restores all affected systems from clean backups. What type of security control is this?

A. Preventive B. Compensating C. Corrective D. Directive

✅ Correct: C — Corrective. Corrective controls are applied AFTER an incident to restore systems and minimize downtime.

Q4

A security team cannot patch a legacy application but adds a firewall rule to block specific exploits targeting it. This is an example of which control type?

A. Directive B. Compensating C. Detective D. Physical

✅ Correct: B — Compensating. Compensating controls are used when the ideal control (patching) can't be applied. The firewall blocks the threat through an alternative means.

Q5

Which of the following is the WEAKEST type of security control?

A. Corrective B. Deterrent C. Directive D. Detective

✅ Correct: C — Directive. Directive controls (signs, training, policies) only guide behavior — they don't physically or technically prevent, detect, or correct anything.

Part B — Matching

Match each scenario (left column) to its control type (right column). Click a scenario, then click its matching type.

SCENARIOS

CCTV cameras record entry attempts

Security awareness training for employees

Locked server room door

Incident response contacts law enforcement

CONTROL TYPES

Detective

Directive

Preventive

Corrective

Part C — Analysis Questions

Q6 — Analyze

An organization has badge readers on all exterior doors (physical), a policy requiring badge use at all times (managerial), guards who verify ID at the entrance (operational), and cameras inside the building (technical). Which control type is MOST likely missing from this setup to create a complete lifecycle?

A. Deterrent — no visible warning signs or consequences B. Corrective — no incident response plan for when someone gains unauthorized access C. Preventive — locks don't technically prevent someone with a copied badge D. Detective — cameras don't alert in real time

✅ Best Answer: B — Corrective. The scenario has preventive, deterrent, detective, and directive elements. The missing piece is a corrective response plan: what happens AFTER an unauthorized access occurs? Without it, the organization can't recover and resume operations efficiently.

Q7 — Analyze

A CISO argues that security awareness training is the most important investment the company can make. From a security controls perspective, what is the strongest argument AGAINST this being the primary security strategy?

A. Training is expensive and hard to measure B. Training is a directive control — it only guides behavior and cannot technically prevent, detect, or correct threats C. Not all employees attend training sessions D. Automated controls are always superior to human-based ones

✅ Correct: B. Training is a directive control — the weakest type. It guides behavior but doesn't technically stop, detect, or fix threats. Layering stronger controls (technical preventive, detective) must accompany any training initiative.

Part D — Evaluation Questions

Q8 — Evaluate

A security team is evaluating whether to deploy multi-factor authentication (MFA), install a SIEM system, or create a more detailed incident response policy. If the organization has NO existing incident detection capability, which should be the highest priority and why?

A. MFA — prevents unauthorized access before detection is needed B. SIEM — without detection, the organization is blind to active threats; other controls have limited value if breaches go unnoticed C. Incident response policy — defines how the organization reacts to any event D. All three are equally important and should be deployed simultaneously

✅ Best Answer: B — SIEM. Without detective capability, the organization cannot know when a breach occurs. MFA is valuable, but attackers bypass it. An IR policy (directive/corrective) is useless if you don't know you've been attacked. Detection enables all other responses — it's the prerequisite for a functioning security lifecycle.

Security Controls Quiz

Part A — Multiple Choice

Part B — Matching

Part C — Analysis Questions

Part D — Evaluation Questions