Identifying Operational Controls in Code Deployment
Short answer
D This control is operational because it relies on human procedures and policies rather than automated technical mechanisms.
Question
Key Takeaways
The exam often confuses 'technical' safeguards with 'operational' policies; this scenario describes a procedural policy (dual approval) which is inherently operational, not technical.
This question tests the ability to classify security controls based on implementation method. The requirement for two people to agree on changes is an operational control because it relies on human procedure rather than technology.
Common mistake: Candidates frequently select 'Technical' because code repositories are software tools, failing to recognize that the specific control mechanism (human agreement/policy) defines the control type.
Expert Analysis
Why the Answer Is Correct
A dual-approval process requiring two individuals to agree is a classic example of an operational control. Operational controls are those that depend on people and their execution of procedures, policies, and rules. Since the control mechanism here is the human decision-making process enforced by policy, it falls squarely under the operational category.
Why the Other Options Are Wrong
Detective controls identify incidents after they occur, whereas this is a preventative step. Technical controls involve hardware or software mechanisms (like encryption or firewalls); while a repository is technical, the control described is the policy of human consent. Physical controls relate to tangible barriers like locks or guards, which are irrelevant to software deployment processes.
Community Comment Notes
Community consensus strongly supports D, with users noting that operational controls depend on persons for implementation. One commenter highlighted that operational controls govern day-to-day activities, distinguishing them from purely technical or physical safeguards.
Exam Strategy
When analyzing control types, focus on the primary enforcement mechanism. If the control relies on a person following a rule or procedure, it is operational. If it relies on a device or software function, it is technical. If it detects an event, it is detective.
Frequently Asked Questions
Why isn't this a technical control since it involves a repository?
What distinguishes operational from administrative controls?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Hs1208 👍 3 Answered DOperational Control: This policy is an operational control that governs the operational procedures related to code deployments
-
Mizzcoors 👍 2 Answered DDetective • May not prevent or deter access, but it will identify and record any attempted or successful intrusion • Operates during an attack Technical • Controls implemented in operating systems, software, and security appliances Physical • Controls such as alarms, gateways, and locks that deter access to premises and hardware Operational • Controls that depend on a person for implementation So has to be D. Operational
-
salah112 👍 2 Answered DD. Operational The control type described, where two people are required to agree before pushing changes from the test codebase repository into production, falls under the category of Operational controls. Operational controls involve the procedures, policies, and measures put in place to manage and govern the day-to-day operations and activities of an organization.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.