Question 1,037 of 1,013
SY0-701 General Security Concepts Practice Question
During routine checks, configuration management finds several branch firewalls drifted from the approved baseline because a contractor changed settings locally. An automation job now compares each device nightly and automatically reapplies the approved configuration without waiting for a human ticket. Which control type is the automation?
⚠ Common exam trap
The trap here is that candidates see 'compares each device nightly' and mistakenly classify the entire process as detective, ignoring that the automatic reapplication is the corrective action that distinguishes the control type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Corrective control
The automation job corrects a detected drift by automatically reapplying the approved configuration, which is a classic corrective control. Corrective controls are designed to remediate or reverse an unwanted change or security event after it has been detected. In this scenario, the nightly comparison is detective, but the automatic reapplication is the corrective action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Directive control
Why it's wrong here
Directive controls are administrative mechanisms that specify expected behavior through policies, standards, and procedures. They guide people, such as requiring that firewall rules be approved before deployment, but they do not take any automated action when configuration drift occurs. In this scenario, the tool actively restores the approved baseline, which is technical enforcement rather than passive instruction. Therefore, it is not a directive control.
- ✗
Detective control
Why it's wrong here
A detective control identifies and alerts on security events or configuration drift, such as by logging a mismatch between current firewall rules and the approved baseline. However, detection alone leaves the system in a non-compliant state until someone manually intervenes. The automation here not only detects but also remediates by applying the known-good configuration, which goes beyond the monitoring function of a detective control. Thus, while detection may be involved, the core behavior is corrective.
- ✓
Corrective control
Why this is correct
The automation runs after drift is detected and restores the approved baseline, which means it is correcting the affected system back to a known-good state. It does more than report the problem; it remediates the configuration. That is why the best answer is corrective control rather than detective or preventive control.
- ✗
Deterrent control
Why it's wrong here
Deterrent controls are designed to discourage individuals from performing unauthorized actions by creating fear of consequences, such as warning banners or visible auditing. These controls target human behavior before an action occurs, not the technical state of a misconfigured system. The automated restoration of firewall rules is a machine-driven reaction to a drift event, with no role in influencing someone's decision to make changes. Since it neither deters nor punishes, it is not a deterrent control.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.