Domain 3 · Objective reference 3B1 · Chapter 18 of 35
Design and select controls for a stated objective
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Choose the objective before the product.
Explore the anchors
State the failure to prevent or detect.
Concept matching activity
Match this task or description to its concept:
Compare control options and constraints.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Design for a requirement
Management concept and decision mechanism
Control selection begins with the scenario and required outcome, not a favored product. Evaluate preventive, detective, corrective and recovery mechanisms, their independence, failure modes, cost, usability and operational dependencies. Administrative, technical and physical categories describe implementation rather than effectiveness. Document how each selected safeguard changes likelihood or consequence and what evidence will verify that effect. Consider compensating measures where the preferred design is impractical, but obtain appropriate authority and retain any gap against binding requirements.
Design for a requirement
Select a control because it addresses a requirement or risk scenario. Describe the intended result, the owner, how it will operate, and how effectiveness will be assessed. Control catalogs offer useful options; choosing every item without considering context can consume resources without improving the most important outcomes.
Combine capabilities where needed. Access restrictions may reduce unauthorized activity, monitoring may identify misuse, and recovery arrangements may limit disruption. Check interactions: a safeguard that blocks legitimate recovery personnel during an outage may undermine the broader design.
Worked example
A high-risk editing process combines role authorization, independent approval, protected change evidence and recovery rather than buying four overlapping detection products.
Check your understanding
What should a design review establish before installation?
Show explanation
Whether the proposed mechanism can address the objective under stated assumptions and how its success and failure will be verified.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.