Control categories by nature: Technical (firewall, AV, encryption), Administrative (policies, training, procedures), Physical (locks, guards, cameras). By function: Preventive, Detective, Corrective, Deterrent, Recovery, Compensating.
Both categorization systems appear on exams. A camera is Physical + Detective + Deterrent simultaneously. MFA is Technical + Preventive. Security awareness training is Administrative + Preventive. Understand overlaps.