Match each control type to the best description.
Drag a concept onto its matching description — or click a concept then click the description.
Stops a threat before it succeeds.
Identifies an event after or while it is happening.
Fixes a problem after it has occurred.
Discourages an attacker from trying.
Provides an alternate safeguard when the preferred control is not possible.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Administrative: Policies, procedures, and rules
Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Administrative: Policies, procedures, and rules
Why this is correct
Administrative controls are management-driven policies, procedures, and rules that define expected behavior and establish the governance framework for security. They are often called directive controls because they guide human conduct rather than enforce it through hardware or software mechanisms. Examples include security awareness training, access control policies, incident response plans, and background checks. These controls form the foundation upon which technical and physical controls are selected and implemented.
Technical: Physical locks and fences
Why it's wrong here
Technical controls are implemented through technology components such as firewalls, encryption, intrusion detection systems, or access control lists. Physical locks and fences are tangible barriers that restrict physical access to a facility or asset, so they fall under physical controls, not technical. While both types enforce access restriction, technical controls operate in the digital domain (data, networks, software), whereas locks and fences work in the physical environment. This misclassification is common because both are implemented to prevent unauthorized access but through different mechanisms.
Physical: Tangible barriers like fences
Why this is correct
Physical controls are tangible, hardware-based measures designed to protect assets from physical harm or unauthorized physical access. Examples include fences, bollards, guards, locks, and closed-circuit television systems. Their primary purpose is to deter, delay, or deny direct contact with protected resources, often serving as the first layer in a defense-in-depth strategy. Unlike technical controls, they do not rely on software or network logic; they operate entirely in the physical world.
Logical: Hardware security modules
Why it's wrong here
Logical controls are implemented in software, data, or abstract rules, such as user access permissions, encryption algorithms, and database schemas. Hardware security modules (HSMs) are specialized physical devices that securely generate, store, and manage cryptographic keys; they are categorized as technical or physical controls because they involve tamper-resistant hardware. While HSMs support logical functions like key management, calling them 'logical' overlooks the dedicated hardware component and the physical security they provide. The best classification for an HSM is technical (or sometimes physical), not logical, owing to its tangible architecture.
Operational: Software-based authentication
Why it's wrong here
Operational controls are the day-to-day processes and human activities that keep security functioning, such as incident response procedures, log monitoring, and patch management. Software-based authentication, such as a password prompt or a software token for multi-factor authentication, relies on algorithmic verification and is a logical/technical control. The distinction lies in the mechanism: operational controls depend on human behavior and routines, whereas software-based authentication executes via code. Mislabeling it as operational confuses the 'how' (technology) with the 'who' (people performing ongoing tasks).
Legal/Regulatory: Compliance with laws
Why this is correct
Legal/regulatory controls are externally imposed requirements that organizations must satisfy to meet statutory, regulatory, or contractual obligations. Examples include compliance with GDPR, HIPAA, PCI-DSS, and SOX, which are enforced by government bodies or industry auditors. Unlike administrative controls, which are internally chosen policies, legal/regulatory controls carry the force of law and failure to comply can result in fines, legal action, or revocation of operating privileges. They shape administrative policies but are distinct because their mandate originates outside the organization.
Go deeper
Learn chapter
Access Control Models (DAC, MAC, RBAC)
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,030 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Match each security control type to the best example in a small office environment.
easyWhy A: These matches classify security controls by type: administrative involves policies, technical uses technology, physical secures premises, deterrent discourages violations, preventive stops incidents, and detective identifies occurrences.
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.