Security controls: prevent, detect, respond

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A firewall that blocks suspicious traffic is mainly which type of control?

A Preventive control

B Recovery control

2. Which statement about a security control is correct?

A It is a measure that reduces risk

B It is a measure that removes all risk

3. A school's CCTV cameras record who enters the server room. What do they mainly do?

A Encrypt the data on the servers

B Detect and record unauthorised entry

4. Which of these is a procedural control?

A Antivirus software that scans files

B A rule that staff must report suspicious emails

5. A business keeps regular backups of its files. Which job does this control do best?

A Help recovery after ransomware

B Stop ransomware reaching the computer

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Firewall blocks unknown traffic		ADoor lock + CCTV + password + backup
2Daily backup to offline storage		BThe control does not match the threat. A physical lock does not stop phishing emails. Use email filtering or staff training instead.
3A detective control spots an attack that is happening or has already happened		CA control that helps recovery by letting you restore data after ransomware or a failure
4Layering controls means using several different types so one failure does not leave you exposed		DRelying on one control is risky because it can fail or be bypassed. Layer several controls, such as updates, MFA and backups.
5Threat: phishing emails. Control: server room lock		EA technical control that prevents attacks by stopping unwanted connections before they reach the network
6We installed antivirus, so no other controls are needed		FAlert on 5 failed logins

Definitions

security control

Fill in the Blanks

Complete each line of code by filling in the missing parts.

control = "firewall" type = "technical" purpose = _______

control = "access log review" type = "procedural" purpose = ______

control = "restore from backup" type = "procedural" purpose = _______

control = "locked server room" type = ________ purpose = "prevent"

firewall = 1 mfa = 1 layers = firewall _ mfa

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A control ← server room lock

B type ← physical

C threat ← unauthorised entry

D purpose ← detect

Question 2

A control ← audit log

B purpose ← prevent

C type ← technical

D threat ← account misuse

Question 3

A control ← daily backup

B type ← technical

C purpose ← prevent

D threat ← ransomware

Question 4

A threat ← phishing email

B control ← server room lock

C type ← procedural

Question 5

A control ← security guard

B type ← technical

C purpose ← prevent

Answer Key

Security controls: prevent, detect, respond

Section A: Quick Questions

A — Preventive control

A — It is a measure that reduces risk

B — Detect and record unauthorised entry

B — A rule that staff must report suspicious emails

A — Help recovery after ransomware

Section B: Match the Pairs

Firewall blocks unknown traffic → A technical control that prevents attacks by stopping unwanted connections before they reach the network

Daily backup to offline storage → A control that helps recovery by letting you restore data after ransomware or a failure

A detective control spots an attack that is happening or has already happened → Alert on 5 failed logins

Layering controls means using several different types so one failure does not leave you exposed → Door lock + CCTV + password + backup

Threat: phishing emails. Control: server room lock → The control does not match the threat. A physical lock does not stop phishing emails. Use email filtering or staff training instead.

We installed antivirus, so no other controls are needed → Relying on one control is risky because it can fail or be bypassed. Layer several controls, such as updates, MFA and backups.

Section C: Definitions

security control — A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

Section D: Fill in the Blanks

control = "firewall"
type = "technical"
purpose = prevent

control = "access log review"
type = "procedural"
purpose = detect

control = "restore from backup"
type = "procedural"
purpose = recover

control = "locked server room"
type = physical
purpose = "prevent"

firewall = 1
mfa = 1
layers = firewall + mfa

Section E: Spot the Error

D — A lock stops people getting in, so it prevents the attack. It does not just detect it. The line should be purpose ← prevent.

B — An audit log records what happened so problems can be spotted later. It detects attacks but does not stop them. The line should be purpose ← detect.

C — A backup does not stop ransomware, but it lets you restore your files afterwards. It helps recovery. The line should be purpose ← recover.

B — A server room lock does nothing against phishing emails. The control must match the threat, so staff training is the right choice.

B — A security guard is a person controlling access to a place, so this is a physical control, not a technical one. The line should be type ← physical.