After ransomware encrypts a file server, administrators wipe the server and restore the data from the previous night's immutable backup. Which control type does the restoration represent?
Select an answer to reveal the explanation.
Short Explanation
Corrective controls are the cleanup crew. The damage is already done, and they put things back the way they were. Restoring from backup doesn't stop or spot the attack, so don't let preventive or detective tempt you.
Full Explanation
Corrective controls reduce the impact of an incident after it occurs by restoring systems, data, or configurations to a known good state. Wiping the compromised server and restoring from an immutable backup is a textbook corrective action: the encryption has already happened, and the restoration repairs its effects. Preventive controls act before an incident to stop it, such as application allow lists, patching, or blocking malicious attachments; the backup did nothing to stop the ransomware from running or spreading. Detective controls identify that something has happened, such as endpoint alerts, file integrity monitoring, or log analysis; comparing restored data to encrypted data may reveal scope, but that is a by-product, not the purpose of restoration. Compensating controls substitute for a control that cannot be implemented; the backup was not adopted because endpoint protection was impossible, and backup restoration addresses recovery rather than providing equivalent protection. Exam caveat: the existence of backups is often described as a recovery capability, while the act of restoring after an incident is the corrective control; immutability supports this by preventing attackers from encrypting or deleting the backups. Operational check: confirm the restored data is free of the malware's persistence mechanisms, verify the restore point predates the initial compromise, and record the restoration time against the recovery objectives.