A security manager is cataloging three controls: a locked server-room door, a firewall rule that blocks inbound Telnet, and a written acceptable use policy. Which classification of these controls, in that order, is correct?

Control categories describe how a control is implemented. Physical (environmental) controls are tangible barriers such as doors, locks, and fences; a locked server-room door is therefore physical. Technical, also called logical, controls are implemented through hardware or software, such as firewall rules and encryption; a rule blocking inbound Telnet is technical. Managerial, also called administrative, controls set direction and oversight through documents and decisions, such as policies, risk assessments, and standards; an acceptable use policy is managerial. The classification beginning with operational misreads the door: operational controls are activities carried out by people, such as guards patrolling or staff performing procedures, while a lock is a physical object. The classification that labels the firewall rule operational confuses a software-enforced rule with a human-executed process, and it calls the policy technical even though it is a document. The ordering that starts with technical swaps the lock and firewall rule and labels the policy operational, again ignoring that policies are managerial. Exam caveat: categories (technical, managerial, operational, physical) are different from types (preventive, deterring, detective, corrective, compensating, directive), and each control has one of each. Operational check: when building a control inventory, record both the category and the type for every control so gaps in either dimension become visible.