Security Controls and Technical Safeguards
What to know
Controls are categorized as administrative, technical, and physical, and by function as preventive, detective, corrective, and compensating. Candidates should understand defense in depth, least privilege, separation of duties, encryption in transit and at rest, key management, logging and monitoring, vulnerability and patch management, and identity controls including MFA and privileged access management. Know the difference between authentication (proving identity) and authorization (granting access), and between symmetric and asymmetric cryptography and where hashing fits (integrity, not confidentiality).
Traps
Questions often present a control that is detective but describe it as preventive (e.g., log monitoring does not stop an attack). Another trap: assuming encryption removes the need for access control - it does not. Be careful with MFA: it mitigates credential theft but not authorization flaws. Also distinguish backup (availability) from archive (retention) and replication (near-real-time copy).
Worked example / rule of thumb
A database holding customer records: encryption at rest with managed keys (preventive/confidentiality), role-based access with least privilege (preventive), audit logging with alerting (detective), tested restores (corrective/recovery). Rule of thumb: name the asset, the threat, the control function, and the property protected (confidentiality, integrity, availability). If a question asks for the "best" control, prefer the one that addresses the root cause and is verifiable.
Exam focus
Expect control classification, cryptographic purpose, and layered-defense scenarios.