Which option is an example of an operational control?

• A. Security awareness training for users
• B. Firewall configuration
• C. Antivirus software
• D. Intrusion detection system

Answer: (A)

Operational controls are the human-centered practices and processes that keep security functioning on a day-to-day basis. Security awareness training for users fits here because it changes how people behave, establishes expected procedures, and builds the capability to recognize and respond to threats. It’s a people-driven activity, not a device or software.

Firewall configuration, antivirus software, and an intrusion detection system are technical controls. They are implemented through hardware or software that automatically enforces rules, monitors for threats, or blocks harmful activity. They operate independently of ongoing human action beyond maintenance, whereas training relies on people to apply security practices.