Which option is NOT listed as a type of control in the material?

• A. Management controls
• B. Operational controls
• C. Technical controls
• D. Physical controls

Answer: (D)

In this material, security controls are organized into three categories: management controls, operational controls, and technical controls. Management controls define the governance framework—policies, risk management, and compliance. Operational controls cover the day-to-day safeguards used in running the system—procedures, training, and ongoing security practices. Technical controls are the automated safeguards implemented through technology—encryption, access control systems, authentication, and logging.

The option describing physical controls does not appear as its own category in this material’s taxonomy. While physical security is important, it isn’t listed as a separate control type here, so that choice is the one that is not listed as a type of control in the material. The other options align with the three listed control types.