nerdexam
(ISC)2

CSSLP · Question #326

Audit trail or audit log is a chronological sequence of audit records, each of which contains evidence directly pertaining to and resulting from the execution of a business process or system…

The correct answer is B. Detective controls. Audit trails and audit logs fall under detective controls because they record events, allowing for subsequent review and identification of suspicious activities or policy violations after they have occurred.

Secure Software Concepts

Question

Audit trail or audit log is a chronological sequence of audit records, each of which contains evidence directly pertaining to and resulting from the execution of a business process or system function. Under which of the following controls does audit control come?

Options

  • AReactive controls
  • BDetective controls
  • CProtective controls
  • DPreventive controls

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    90% (18)
  • C
    5% (1)

Why each option

Audit trails and audit logs fall under detective controls because they record events, allowing for subsequent review and identification of suspicious activities or policy violations after they have occurred.

AReactive controls

Reactive controls respond to an event after it has been detected, such as incident response, rather than solely detecting it.

BDetective controlsCorrect

Detective controls are designed to identify and alert about undesirable events that have already occurred or are currently happening. Audit trails and logs function as detective controls by recording system activities, enabling security professionals to review these records to discover intrusions, policy breaches, or anomalous behavior after the fact.

CProtective controls

Protective controls is a less common classification, but typically refers to mechanisms that safeguard assets, which can overlap with preventive or corrective controls.

DPreventive controls

Preventive controls aim to stop an undesirable event from occurring in the first place, whereas audit trails log events that have already transpired.

Concept tested: Security control types - audit trails

Source: https://learn.microsoft.com/en-us/azure/architecture/framework/security/design-controls

Topics

#Security controls#Detective controls#Audit trails#Audit logs

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CSSLP Practice