Introduction (0.1)

How to pass your SY0-701 Security+ Exam

• CompTIA stands for the Computing Technology Industry Association
• It is the largest provider of vendor-neutral IT certifications.
• Members include:
  • IT Resellers
  • IT Distributors
  • IT Manufacturers
  • IT Training Centers.
• The exam is 90 minutes long and you can get a maximum of 90 questions.
• The passing score: 750 on a scale of 100-900
• There are 5 areas of focus (Domains)
  • 1.0 - General Security Concepts - 12%
  • 2.0 - Threats, Vulnerabilities, and Mitigations - 22%
  • 3.0 - Security Architecture - 18%
  • 4.0 - Security Operations - 28%
  • 5.0 - Security Program Management and Oversight - 20%
  • Total - 100%
• Majority of questions will be multiple choice, but there may be questions that involve matching, drag-n-drop, or some other type of format questions classified as Performance-based questions.

🛡️ Security Controls: Types & Categories (1.1)

📅 Last Updated: June 4, 2025

✅Summary of control categories and types used in IT security for the Security+ exam or real-world application.

🔧 Control Categories

• Technical - Controls implemented through technology: firewalls, system configs, AV
• Managerial - Policies, procedures, and documentation that govern operations
• Operational - Controls enforced by people: awareness training, guards, patrols
• Physical - Tangible barriers: fences, locks, guard shacks, badge readers

🧩 Control Types

Preventive – Stops events before they occur

• 🔧 Technical: Firewall rule
• 🧑‍💼 Managerial: Hiring/onboarding policy
• 👮 Operational: Guard shack checking IDs
• 🔒 Physical: Door locks

Deterrent – Discourages attackers without directly stopping them

• 💻 Technical: Splash screen warning
• ⚠️ Managerial: Threat of demotion
• 💁 Operational: Receptionist desk
• 🚫 Physical: Warning signs

Detective – Identifies and alerts on active incidents

• 📜 Technical: Log collection and alerts
• 📊 Managerial: Periodic report reviews
• 🚶 Operational: Property patrols
• 🕵️ Physical: Motion detectors

Corrective – Mitigates impact after an incident

• 💾 Technical: Restore from backup
• 🛎️ Managerial: Issue reporting policy
• 📞 Operational: Contacting law enforcement
• 🧯 Physical: Fire extinguishers

Compensating – Temporary workaround for insufficient controls

• 🛡️ Technical: Firewall block in place of patch
• 📂 Managerial: Separation of duties
• 👥 Operational: Multiple guards on shift
• ⚡ Physical: Power generator

Directive – Guides secure behavior; relies on compliance

• 🔐 Technical: Encrypted folder use policy
• 📘 Managerial: Compliance documentation
• 👨‍🏫 Operational: Security awareness training
• 📍 Physical: 'Authorized Personnel Only' sign

🧠 Final Notes

• Controls may overlap categories depending on implementation.
• Real-world organizations mix these depending on threat models.
• Control effectiveness evolves with technology and user behavior.