During a control mapping exercise, the information security manager must label each control by its function. Which of the following controls is primarily DETECTIVE?
Select an answer to reveal the explanation.
Short Explanation
Preventive controls are the locked door, detective controls are the camera, and corrective controls are the locksmith who fixes things afterward. Ask what each control does at the moment of the event and you'll sort them quickly. The trap is lockout: it reacts to failed logins, but it stops access rather than spotting it.
Full Explanation
Controls are commonly classified by function: preventive controls stop an undesired event from occurring, detective controls identify that an event has occurred or is occurring, and corrective controls reduce impact and restore normal operation afterward. Reviewing alerts generated from logs of repeated failed administrator logins is detective, because it identifies suspicious activity so that someone can respond. Account lockout is triggered by failed logins, which makes it look detective, but its effect is to block further attempts, so its function is preventive. Restoring altered files from backup after a confirmed intrusion repairs the damage and returns systems to a known good state, which is the defining purpose of a corrective control. Requiring manager approval before administrator rights are granted stops inappropriate privilege from being assigned in the first place and is therefore preventive. Exam caveat: some controls serve more than one function, and some taxonomies add deterrent, compensating or recovery categories, so classify by the primary effect described in the question. Operational check: when mapping a control set, confirm that each significant risk has at least one preventive and one detective control, and that corrective procedures exist and are tested for the events those controls would detect.