Risk mitigation and risk reduction controls for providing information security are classified within three main categories, which of the following are being used?

The correct answer is C. Physical, technical, and administrative. The three universally recognized categories of information security controls are Physical, Technical (also called Logical), and Administrative. Physical controls protect tangible assets (locks, fences, guards). Technical/Logical controls are implemented in hardware or software…

Submitted by hassan_iq· Apr 18, 2026Risk Identification, Monitoring and Analysis

Question

Risk mitigation and risk reduction controls for providing information security are classified within three main categories, which of the following are being used?

Options

Apreventive, corrective, and administrative
Bdetective, corrective, and physical
CPhysical, technical, and administrative
DAdministrative, operational, and logical

How the community answered

(34 responses)

A
3% (1)
C
94% (32)
D
3% (1)

Explanation

The three universally recognized categories of information security controls are Physical, Technical (also called Logical), and Administrative. Physical controls protect tangible assets (locks, fences, guards). Technical/Logical controls are implemented in hardware or software (firewalls, encryption, access control lists). Administrative controls are policies, procedures, and training (security policies, background checks, awareness programs). Option A mixes control types (preventive, corrective) with a category (administrative) - those are control functions, not categories. Option B is similarly a mix of functions and categories. Option D uses 'logical' correctly but replaces 'physical' with 'operational,' which is not the standard three-category framework.

Topics

#Security Controls Classification#Risk Mitigation#Physical Controls#Technical Controls

Community Discussion

No community discussion yet for this question.

Full SSCP Practice