Which statement about security controls is true?

Which statement about security controls is true?

• A. Controls only prevent incidents.
• B. Controls only detect incidents.
• C. Controls can be preventive, detective, or corrective.
• D. Controls are optional.

Answer: (C)

Security controls come in three broad categories: preventive, detective, and corrective. Preventive controls stop unwanted events before they happen, such as firewalls that block unauthorized access or strong access controls that prevent unauthorized entry. Detective controls identify when something has already occurred, like intrusion detection systems, security monitoring, and log analysis that reveal breaches or policy violations. Corrective controls take action to restore systems and bring things back to normal after an incident, including backup restore procedures, patching, and incident response steps. The best statement is that controls can be preventive, detective, or corrective because a well-rounded security program uses all three types to reduce risk. The other ideas—that controls only prevent incidents, or only detect them, or are optional—don’t capture the full role of security controls in protecting systems and enabling recovery.

Security controls come in three broad categories: preventive, detective, and corrective. Preventive controls stop unwanted events before they happen, such as firewalls that block unauthorized access or strong access controls that prevent unauthorized entry. Detective controls identify when something has already occurred, like intrusion detection systems, security monitoring, and log analysis that reveal breaches or policy violations. Corrective controls take action to restore systems and bring things back to normal after an incident, including backup restore procedures, patching, and incident response steps.

The best statement is that controls can be preventive, detective, or corrective because a well-rounded security program uses all three types to reduce risk. The other ideas—that controls only prevent incidents, or only detect them, or are optional—don’t capture the full role of security controls in protecting systems and enabling recovery.