🎯 Trick 1 — The Overlap Trap
A security guard sits at the reception desk and checks employee IDs before allowing entry. The exam asks: "What type of control is this?" You see the answer option "Preventive" and also "Deterrent." Which do you choose?
If the guard checks IDs and physically allows/denies entry → Preventive.
If the guard's visible presence is what the question emphasizes (making attackers reconsider) → Deterrent.
The key is reading what the question highlights. CompTIA will usually give you a clue: "The guard discourages unauthorized entry" = Deterrent. "The guard validates ID before granting access" = Preventive.
🎯 Trick 2 — The "Also Correct" Distractor
A firewall blocks specific malicious IP addresses. The exam offers: A. Technical-Preventive, B. Technical-Detective, C. Operational-Preventive, D. Physical-Preventive. You know firewalls can log traffic (detective). Which is BEST?
The question says the firewall "blocks" IPs — that is the primary function described. Blocking = Preventive. While firewalls CAN also be detective (logging), the question describes a preventive action. CompTIA always tests the primary purpose described, not all possible uses.
🎯 Trick 3 — Category vs. Type Confusion
"An organization uses security cameras to monitor server room access." A student answers "Detective Control." Their teacher marks it partially wrong. Why?
"Detective Control" is the TYPE. But the full classification is Physical + Detective. Cameras are physical devices placed in a physical space. The exam may ask for category AND type. Always identify both when possible: Physical Detective control.
🎯 Trick 4 — Compensating vs. Corrective
A server was infected by malware. The admin blocks all outbound traffic from the server using a firewall rule, then restores the server from a clean backup. Which action is compensating, and which is corrective?
The firewall rule doesn't fix the problem — it limits damage while a real fix is applied. That's compensating.
Restoring from backup actually corrects the damage and returns the system to a known-good state. That's corrective.
Memory tip: Compensating buys time. Corrective fixes the damage.
🎯 Performance Task — Design a Control Set
You are hired as a security consultant for a small bank. You must recommend at least one control of each type (preventive, deterrent, detective, corrective, compensating, directive) AND specify their categories. The bank has limited budget.
• Preventive (Technical): Firewall with strict ACLs blocking unauthorized access
• Deterrent (Physical): Visible security camera signage at entrances
• Detective (Technical): Log aggregation/SIEM for anomaly alerts
• Corrective (Technical): Offsite encrypted backups for rapid recovery
• Compensating (Technical): Network segmentation isolating legacy ATM systems from core banking
• Directive (Managerial): Security policy requiring employees to lock screens when away from desks
This creates overlapping protection: if the preventive control fails, detective finds the breach; corrective restores operations; compensating limits blast radius.
🎯 Trick 5 — The Timing Clue
On the exam, pay close attention to WHEN a control acts. Which of these timing clues map to which type?
"…before the attack occurs" — "…after the attack is detected" — "…to notice the attack" — "…to discourage the attack"
• "Before the attack occurs" → Preventive
• "To discourage / make think twice" → Deterrent
• "To notice / identify / log the attack" → Detective
• "After the attack is detected / to recover" → Corrective
• "When primary control isn't possible / temporary" → Compensating
• "To guide / instruct / train / tell someone" → Directive
This timing framework will help you eliminate wrong answers in seconds on exam day.