What is the difference between the Positive Control Model and the Negative Control Model?
A.
The Positive Control Model allows is what routers use and simply route traffic with no security rules. The Negative Control Model is what firewalls use and they require explicit rules to allow and route traffic.
B.
The Positive Control Model allows specific, approved actions or traffic and blocks everything else. The Negative Control Model begins by blocking specific, known threats, or unwanted actions and allows everything else.
C.
The Positive Control Model begins by blocking specific, known threats, or unwanted actions and allows everything else. The Negative Control Model allows specific, approved actions or traffic and blocks everything else.
D.
The Positive Control Model aims to keep administrators in a positive mind set. The Negative Control Model results in administrators having a negative mind set.
The correct answer is B. A Positive Control Model is allow-list oriented: the administrator explicitly permits approved traffic or behavior, and everything else is blocked by default or by cleanup. This is the classic firewall access-control model and is stronger for minimizing attack surface. A Negative Control Model is block-list oriented: the system blocks known bad or unwanted traffic while allowing what is not explicitly blocked. This model is common in controls such as Application Control, URL Filtering, and Threat Prevention categories where known applications, sites, malware, bots, or exploit signatures are identified and blocked. Option A reverses and distorts the model. Option C reverses the definitions. Option D is nonsense and not a technical security model. The exam lesson is that firewall Access Control is primarily positive-control driven, while many inspection/prevention features use negative-control logic against known bad categories or signatures. Reference topics: Security Policy Management, Access Control design, Cleanup Rule, allow-list versus block-list enforcement.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit