Which security control is designed to identify security events as they occur?

Which security control is designed to identify security events as they occur?

• A. Preventive
• B. Directive
• C. Detective
• D. Corrective

Answer: (C)

This question centers on how security controls are categorized by what they do. Detective controls are designed to identify security events as they occur by monitoring activity and analyzing data for signs of anomalies or intrusions. They alert security teams so we can respond quickly, often in real time. Examples include intrusion detection systems, security information and event management (SIEM) systems, and ongoing log analysis. In contrast, preventive controls try to stop events from happening in the first place, such as firewalls and access controls; directive controls govern behavior through policies and procedures; and corrective controls help restore or recover after an incident, like backups and incident response processes. Because the key task described—identifying events as they occur to enable timely response—fits detective controls best, this type is the appropriate match.

This question centers on how security controls are categorized by what they do. Detective controls are designed to identify security events as they occur by monitoring activity and analyzing data for signs of anomalies or intrusions. They alert security teams so we can respond quickly, often in real time. Examples include intrusion detection systems, security information and event management (SIEM) systems, and ongoing log analysis. In contrast, preventive controls try to stop events from happening in the first place, such as firewalls and access controls; directive controls govern behavior through policies and procedures; and corrective controls help restore or recover after an incident, like backups and incident response processes. Because the key task described—identifying events as they occur to enable timely response—fits detective controls best, this type is the appropriate match.