SY0-701 General Security Concepts Practice Question
A small company wants all employees to lock their screens after 10 minutes of inactivity, and the rule is included in the formal security policy. What type of control is this?
⚠ Common exam trap
Test-takers frequently confuse a directive control (policy-based) with a preventive control (technical enforcement); candidates often pick a wrong option because they assume the policy itself enforces the lock, but the question states the rule is 'included in the formal security policy,' not implemented via a technical mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Directive control, because it tells users what behavior is required.
A directive control is designed to guide or mandate user behavior through policies or procedures. In this case, the security policy explicitly requires employees to lock their screens after 10 minutes of inactivity, which is a directive that tells users what they must do. This is a procedural control, not a technical enforcement mechanism, so it falls under directive controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detective control, because it discovers misuse after it happens.
Why it's wrong here
Detective controls operate after an event to reveal unauthorized activity, typically through log review, monitoring alerts, or periodic audits. A screen-lock policy does not perform any monitoring or analysis; it prescribes an action employees must take. Misclassifying it as detective confuses the procedural act of setting a rule with the technological function of discovering misuse.
- ✓
Directive control, because it tells users what behavior is required.
Why this is correct
A directive control is an authoritative instruction that defines required behavior, often implemented through corporate policy, standards, or acceptable-use agreements. Mandating that all employees lock their screens when leaving workstations is exactly this type of guidance, as it establishes a behavioral expectation and provides the basis for accountability. It does not physically enforce the action, but it directs users and management on the required practice.
- ✗
Corrective control, because it repairs damage after an incident.
Why it's wrong here
Corrective controls are reactive measures that repair, restore, or reduce damage after a security incident has occurred, such as activating backups, applying patches, or running incident response processes. A screen-lock policy is a proactive safeguard that attempts to prevent unauthorized access in the first place. It cannot repair or mitigate anything because it has no effect after a breach; it only influences behavior beforehand.
- ✗
Compensating control, because it replaces a missing technical safeguard.
Why it's wrong here
Compensating controls are alternative safeguards deployed when the preferred control is infeasible or cannot be implemented, such as using stricter monitoring when a technical patch is unavailable. A requirement that employees lock their screens is not serving as a fallback for a missing security mechanism; it is a direct management directive. Implementing an automatic screen-lock setting on devices would be a preventive technical control, whereas the policy itself is the directive.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.