Which of the following is a detective control?

Question

Options

• ASmart card authentication
• BSecurity policy
• CAudit trail
• DContinuity of operations plan

• A
  3% (1)
• B
  3% (1)
• C
  86% (30)
• D
  9% (3)

Explanation

An audit trail (C) is a detective control because it records events and activities so that suspicious behavior can be identified after it occurs - detection is its core purpose, not prevention.

Why the distractors are wrong:

• A (Smart card authentication) is a preventive control - it stops unauthorized access before it happens.
• B (Security policy) is a preventive/administrative control - it sets rules to prevent misuse, not detect it.
• D (Continuity of operations plan) is a corrective control - it restores operations after a disruption.

Memory tip: Think of detective controls as anything that would help a detective solve a case after the fact - logs, audit trails, and intrusion detection systems all leave evidence trails. If a control catches something rather than stops it, it's detective.

No community discussion yet for this question.