nerdexam
Isaca

CCAK · Question #81

Which of the following is a corrective control that may be identified in a SaaS service provider?

The correct answer is D. Vulnerability scan. Caution: The stated answer appears to be incorrect based on standard security frameworks. Vulnerability scans (D) are universally classified as detective controls - they identify existing vulnerabilities but do not fix anything. Similarly, log monitoring (A) detects anomalies…

Cloud Auditing for Infrastructure, Platform, and Software as a Service (IaaS, PaaS, SaaS)

Question

Which of the following is a corrective control that may be identified in a SaaS service provider?

Options

  • ALog monitoring
  • BPenetration testing
  • CIncident response plans
  • DVulnerability scan

How the community answered

(19 responses)
  • A
    5% (1)
  • C
    11% (2)
  • D
    84% (16)

Explanation

Caution: The stated answer appears to be incorrect based on standard security frameworks.

Vulnerability scans (D) are universally classified as detective controls - they identify existing vulnerabilities but do not fix anything. Similarly, log monitoring (A) detects anomalies, and penetration testing (B) probes for weaknesses - both are detective (or preventive) in nature.

Incident response plans (C) is the correct corrective control. Corrective controls act after an incident to restore systems, contain damage, and return operations to normal - which is exactly what an IR plan does.

OptionActual TypeWhy
A. Log monitoringDetectiveIdentifies threats; doesn't fix them
B. Penetration testingDetective/PreventiveFinds weaknesses; doesn't remediate
C. Incident response plansCorrectiveGuides recovery after an incident
D. Vulnerability scanDetectiveFinds vulnerabilities; doesn't patch them

Memory tip: Corrective = Correct the damage after the fact. Think CPR - you use it after someone collapses, just like an incident response plan activates after a breach.

Recommendation: Flag this question to your instructor or exam prep source - the listed answer (D) conflicts with CISSP, CompTIA Security+, and NIST frameworks. If this is from an official exam bank, it may contain an error.

Topics

#corrective controls#SaaS controls#vulnerability management#cloud security auditing

Community Discussion

No community discussion yet for this question.

Full CCAK Practice