Which of the following is NOT typically considered a security control?

• A. Authentication
• B. Authorization
• C. Open ports
• D. Encryption

Answer: (C)

Security controls are mechanisms that enforce security properties in a system. Authentication is the process that confirms who a user is, and authorization determines what that authenticated user is allowed to do. Encryption protects data by making it unreadable to anyone who shouldn’t access it. Open ports, on the other hand, are not a protective measure themselves; they’re a condition that can increase risk by exposing services to the network. To mitigate that risk you’d apply controls like firewall rules to close or restrict unused ports, plus network segmentation and monitoring. So, open ports describe a potential vulnerability rather than a control, which is why they’re not considered a security control.