SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Administrative: Security awareness training policy

  Why this is correct

  Security awareness training policy is an administrative control because it governs human behavior through formal organizational rules, procedures, and education. Unlike technical safeguards, it does not directly enforce a rule in software or hardware; instead, it reduces risk by teaching employees to recognize phishing, handle data properly, and follow incident reporting protocols. Administrative controls such as this are the foundation for ensuring that the other control types are used correctly.

• ✓

  Technical: Firewall

  Why this is correct

  A firewall is a technical control because it relies on software or hardware mechanisms to inspect and filter network traffic based on predetermined security rules. It actively blocks or permits packets at the network or host level, enforcing access control without requiring human action after it is configured. This distinguishes it from administrative controls like policy documents that depend on people to read and follow them.

• ✓

  Physical: Locked server room door

  Why this is correct

  A locked server room door is a physical control because it provides a tangible, real-world barrier that restricts unauthorized access to the facility housing critical systems. Physical controls such as locks, biometric readers, and mantraps are designed to prevent direct contact with hardware, reducing risks like theft, tampering, and environmental damage. They operate independently of user conduct or network settings.

• ✓

  Deterrent: Visible security cameras

  Why this is correct

  Visible security cameras are a deterrent control because their primary function is to discourage potential intruders from attempting unauthorized actions by increasing the perceived likelihood of detection. While cameras also serve a detective function by recording incidents, the distinguishing intent of a visible camera is to influence the decision-making of people before they act. Deterrent controls rely on psychological deterrence rather than physically blocking or immediately alerting.

• ✗

  Administrative: Firewall

  Why it's wrong here

  Classifying a firewall as an administrative control is incorrect because administrative controls consist of policies, procedures, and training that shape human behavior, not technology. A firewall is a technical control that automates network traffic filtering, whereas an administrative control would be the organization's firewall change-management policy that dictates how rules are approved and reviewed. Confusing the two could lead to overlooking the need for both a properly configured technical device and the human-governance process that oversees it.

• ✗

  Physical: Security awareness training policy

  Why it's wrong here

  A security awareness training policy is not a physical control because it has no tangible, material presence and does not protect assets by restricting physical access. Physical controls are hardware or environmental mechanisms such as locks, bollards, and security guards that secure facilities and equipment. Policies and training are administrative controls that mitigate risk through rules and education, not through interaction with the physical world.