After ransomware hits the library, IT restores systems from backups and rebuilds servers. Which control type best describes those restoration actions?

Corrective controls remediate or restore after an adverse event to reduce impact and return systems toward a known-good state. After ransomware hits the library, restoring from backups and rebuilding compromised servers are corrective actions: the incident already occurred, and IT is repairing damage and re-establishing trustworthy service for patrons and staff.

Calling restoration preventive because "backups stop ransomware from encrypting files" confuses resilience preparation with the act being classified. Preventive controls aim to stop the incident from succeeding in the first place (patching, application allow-listing, least privilege, offline immutable backup design that denies ransomware write access). Having backups is valuable hygiene; the restoration workflow after encryption is still corrective. Labeling the rebuild deterrent because recovery "scares attackers away beforehand" invents a psychological effect that is not how deterrent controls are defined—deterrents discourage attempts through warning or visibility before or independent of successful compromise. Calling the work directive because rebuild steps appear in a city ordinance mistakes a mandatory instruction (directive type) for the remediation activity itself; an ordinance may direct departments to follow IR procedures, but restoring servers is corrective execution.

Exam caveat: Security+ often tests whether you classify the restoration moment, not the existence of backup technology. Backup systems support recovery; using them after ransomware is corrective.

Operational check: municipal IR plans should pre-stage backup verification, rebuild playbooks, and success criteria so corrective restoration is fast and trustworthy. Separately track preventive controls that reduce ransomware likelihood, and never treat "we have backups" as proof that prevention is adequate.