Which type of security control acts during an incident to identify or record that the incident is happening?

Which type of security control acts during an incident to identify or record that the incident is happening?

• A. Deterrent
• B. Detective
• C. Directive
• D. Compensating

Answer: (B)

Detective security controls identify and record events as they occur. They monitor the environment and generate alerts or logs when something suspicious happens, so an incident can be detected in real time and evidence can be collected. Examples include intrusion detection systems, security information and event management (SIEM), access logs, and continuous monitoring. Deterrent controls aim to discourage attacks before they happen and do not provide real-time identification. Directive controls are policies and procedures that guide how people should behave, rather than actively detecting incidents. Compensating controls provide an alternative safeguard when the primary control isn’t feasible, but they’re not defined primarily by their ability to detect incidents.

Detective security controls identify and record events as they occur. They monitor the environment and generate alerts or logs when something suspicious happens, so an incident can be detected in real time and evidence can be collected. Examples include intrusion detection systems, security information and event management (SIEM), access logs, and continuous monitoring.

Deterrent controls aim to discourage attacks before they happen and do not provide real-time identification. Directive controls are policies and procedures that guide how people should behave, rather than actively detecting incidents. Compensating controls provide an alternative safeguard when the primary control isn’t feasible, but they’re not defined primarily by their ability to detect incidents.