Fastest way to identify the control type
Focus on the verb in the scenario. If the control blocks or reduces risk, think preventive. If it alerts or discovers, think detective. If it repairs or restores, think corrective. If it warns or discourages, think deterrent.
Preventive vs detective vs corrective vs deterrent controls
| Control type | Main purpose | Typical timing | Key exam question | Common examples |
|---|---|---|---|---|
| Preventive | Block or reduce the likelihood of an incident | Before an event | How do we stop it? | MFA, firewall rules, ACLs, least privilege, door locks |
| Detective | Discover or alert on suspicious activity | During or after an event | How do we know it happened? | IDS, SIEM alerts, audits, log review, CCTV monitoring |
| Corrective | Repair damage or restore operations | After an event | How do we recover? | Restore from backup, reimage a system, reset accounts, remediate damage |
| Deterrent | Discourage undesirable behavior | Usually before an event | How do we make someone think twice? | Warning banners, visible guards, posted sanctions, security signage |
1. Preventive controls: stop the incident before it happens
Preventive controls are designed to reduce the likelihood or impact of an unwanted event before it occurs. In Security+ scenarios, look for language such as prevent, block, restrict, or reduce the chance.
Examples
MFA, firewall rules, least privilege, access control lists, secure configuration, and physical door locks can all function as preventive controls.
2. Detective controls: identify that something happened
Detective controls help organizations notice suspicious behavior, policy violations, attacks, or other events. They do not necessarily stop the event. Their primary purpose is visibility and detection.
Examples
Intrusion detection systems, SIEM alerts, audit logs, security monitoring, and log reviews commonly serve detective purposes.
3. Corrective controls: restore or repair after an incident
Corrective controls come into play after something has gone wrong. Their job is to reduce the damage, repair the affected environment, restore availability, or return the organization to normal operation.
Examples
Restoring a server from backup, reimaging an infected workstation, resetting compromised credentials, and repairing damaged configurations are typical corrective actions.
4. Deterrent controls: discourage the behavior
Deterrent controls try to influence behavior by making a potential attacker or violator believe that the action is risky, visible, or likely to result in consequences.
Examples
Security warning signs, visible guards, posted sanctions, warning banners, lighting, and visible cameras can act as deterrents.
Common CompTIA Security+ exam traps
- Deterrent does not mean preventive. A warning sign may discourage an attacker, but it does not physically stop the attack.
- Detective controls do not necessarily block anything. They provide visibility, alerts, or evidence.
- Corrective controls are usually tied to recovery. Look for restore, repair, rebuild, reset, or recover.
- Preventive controls match stop/block/restrict language.
- A single control may serve multiple purposes. Choose the category that best matches the primary purpose described in the question.
Mini Security+ scenarios
An organization requires MFA before employees can connect to the corporate VPN.
A SIEM generates an alert after detecting multiple failed logins followed by a successful administrator login.
After ransomware damages a server, administrators rebuild it and restore clean data from backup.
A data center displays prominent signs stating that access is monitored and unauthorized entry may result in prosecution.
A useful exam decision method
When you see a security control in a question, ask these four questions in order:
- Is it intended to stop or reduce the risk? → Preventive
- Is it intended to discover or alert? → Detective
- Is it intended to restore or repair? → Corrective
- Is it mainly intended to discourage? → Deterrent
This prevents you from classifying the control based only on the technology. For example, a camera may be detective when actively monitored for incidents, but its visible presence can also have a deterrent effect. The scenario determines which function CompTIA is emphasizing.
Frequently asked questions
What is the difference between preventive and detective controls?
Preventive controls try to stop or reduce an incident before it occurs. Detective controls identify, monitor, or alert when suspicious activity occurs or has occurred.
Is a security camera detective or deterrent?
It can serve either role depending on context. If it is used to monitor and identify activity, it is detective. If the scenario emphasizes that its visible presence discourages unauthorized behavior, it is deterrent.
Are backups preventive or corrective?
The act of restoring data from a backup after an incident is corrective because it helps recover operations. A scenario may describe backup processes in other control contexts, so focus on the purpose being tested.
Can one security control belong to more than one category?
Yes. Controls can have multiple effects. Security+ questions generally expect you to identify the primary function emphasized by the scenario.