During a review, an analyst is asked to sort security awareness training, a documented patch policy, and an intrusion detection sensor into control categories. Which statement correctly describes how these map to managerial, operational, and technical control types?
- AAwareness training is technical, the patch policy is operational, and the IDS sensor is managerial.
- BThe patch policy is managerial, the awareness training is operational, and the IDS sensor is technical. Correct
- CAwareness training is managerial, the patch policy is technical, and the IDS sensor is operational.
- DAll three are operational controls because each one supports the day-to-day vulnerability management programme.
Why A is wrong: Tempting because policies feel operational and training feels hands-on, but the categories are swapped: a written policy is managerial and a sensor is technical.
Why B is correct: Correct: policies and governance are managerial, human-executed processes such as training are operational, and system-enforced mechanisms such as an IDS are technical.
Why C is wrong: This mislabels the policy and the sensor; a policy is a managerial document and a sensor is a technical mechanism, so two of the three assignments are wrong.
Why D is wrong: Supporting daily operations does not make every control operational; the category reflects how a control is enacted, and a policy and a sensor clearly fall outside the operational type.