CompTIA CASP+ Practice Test

What should a security advisor explain about the differences between desirable security controls?

1. Preventative controls minimize risk, detective controls identify incidents, and corrective controls fix issues post-incident.

2. Preventative controls are inexpensive, detective controls are comprehensive, and corrective controls restore operations.

3. Preventative controls are always required, whereas detective controls are optional.

4. Corrective controls apply only to technical incidents, detective controls apply to all areas.

The correct answer is: Preventative controls minimize risk, detective controls identify incidents, and corrective controls fix issues post-incident.

The chosen answer accurately describes the fundamental roles of different categories of security controls. Preventative controls are designed to prevent security incidents from occurring in the first place, thereby minimizing risk to the organization. Examples of preventative controls include firewalls, encryption, and access control mechanisms. These measures aim to stop potential threats before they can exploit vulnerabilities. Detective controls, on the other hand, serve to identify and alert organizations to ongoing or past security incidents. They provide visibility into what is happening within the system and can help in recognizing anomalies or breaches. Examples include intrusion detection systems and log monitoring tools. Corrective controls come into play after an incident has occurred. These controls are intended to restore systems and data to normal operations following a security breach or failure. They may include restoring backups, applying patches, or implementing changes to prevent future incidents based on the lessons learned from the event. This clear differentiation highlights the lifecycle of security management, showcasing the complementary nature of these controls in forming a robust security posture. The incorrect choices either mischaracterize the controls, inaccurately express financial implications, or misstate the necessity and applicability of the different types of controls within a security framework.