312-50V10 · Question #569
Which of the following is a detective control?
The correct answer is C. Audit trail. A detective control identifies and records security events after they occur; an audit trail fits this definition by logging user and system activity for later review and investigation.
Question
Which of the following is a detective control?
Options
- ASmart card authentication
- BSecurity policy
- CAudit trail
- DContinuity of operations plan
How the community answered
(33 responses)- A6% (2)
- B3% (1)
- C91% (30)
Why each option
A detective control identifies and records security events after they occur; an audit trail fits this definition by logging user and system activity for later review and investigation.
Smart card authentication is a preventive control because it enforces identity verification to block unauthorized access before it occurs.
A security policy is an administrative preventive control that establishes rules intended to stop security incidents rather than detect them.
An audit trail is a detective control because it captures a timestamped record of system and user actions, enabling security personnel to identify unauthorized or anomalous activity after the fact. It does not prevent events from occurring but provides the evidence trail necessary for detection and forensic analysis. This reactive, after-the-fact visibility is the defining characteristic of detective controls.
A continuity of operations plan is a corrective and recovery control focused on restoring operations after a disruption, not on detecting incidents.
Concept tested: Security control classification - detective controls
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.