CCAK · Question #81
Which of the following is a corrective control that may be identified in a SaaS service provider?
The correct answer is D. Vulnerability scan. Caution: The stated answer appears to be incorrect based on standard security frameworks. Vulnerability scans (D) are universally classified as detective controls - they identify existing vulnerabilities but do not fix anything. Similarly, log monitoring (A) detects anomalies…
Question
Which of the following is a corrective control that may be identified in a SaaS service provider?
Options
- ALog monitoring
- BPenetration testing
- CIncident response plans
- DVulnerability scan
How the community answered
(19 responses)- A5% (1)
- C11% (2)
- D84% (16)
Explanation
Caution: The stated answer appears to be incorrect based on standard security frameworks.
Vulnerability scans (D) are universally classified as detective controls - they identify existing vulnerabilities but do not fix anything. Similarly, log monitoring (A) detects anomalies, and penetration testing (B) probes for weaknesses - both are detective (or preventive) in nature.
Incident response plans (C) is the correct corrective control. Corrective controls act after an incident to restore systems, contain damage, and return operations to normal - which is exactly what an IR plan does.
| Option | Actual Type | Why |
|---|---|---|
| A. Log monitoring | Detective | Identifies threats; doesn't fix them |
| B. Penetration testing | Detective/Preventive | Finds weaknesses; doesn't remediate |
| C. Incident response plans | Corrective | Guides recovery after an incident |
| D. Vulnerability scan | Detective | Finds vulnerabilities; doesn't patch them |
Memory tip: Corrective = Correct the damage after the fact. Think CPR - you use it after someone collapses, just like an incident response plan activates after a breach.
Recommendation: Flag this question to your instructor or exam prep source - the listed answer (D) conflicts with CISSP, CompTIA Security+, and NIST frameworks. If this is from an official exam bank, it may contain an error.
Topics
Community Discussion
No community discussion yet for this question.