CRISC Practice Questions
Control Types: Detective, Preventive, Corrective and Deterrent
30 Questions - Interactive Quiz
Question 1 of 30
0%
Score: 0
Correct: 0
Wrong: 0
1 A company installs security cameras in its data center. This is an example of which type of control?
Answer: B - Detective
Security cameras are detective controls because they record and monitor activity to identify security incidents after or during occurrence. Note: If the primary purpose is to discourage (visible cameras), it could be deterrent - but in CRISC, cameras are typically classified as detective.
2 A firewall that blocks unauthorized traffic is which type of control?
Answer: C - Preventive
A firewall prevents unauthorized access by blocking traffic before it reaches the network.
3 A warning banner on a login screen stating "Unauthorized access is prohibited" is which type of control?
Answer: D - Deterrent
Warning banners are deterrent controls - they discourage potential attackers by warning of consequences.
4 A backup restoration procedure is which type of control?
Answer: C - Corrective
Backup restoration is corrective because it restores systems/data after an incident has occurred.
5 Intrusion Detection System (IDS) is which type of control?
Answer: B - Detective
IDS detects and alerts on potential intrusions but does not block them (that would be IPS - preventive).
6 Which control type is designed to discourage an attacker BEFORE an incident occurs?
Answer: C - Deterrent
Deterrent controls aim to discourage potential attackers from attempting an attack.
7 A guard dog patrolling a facility is BEST classified as:
Answer: D - Deterrent
A visible guard dog primarily deters potential intruders. (Though it can also detect, its primary purpose in most exam contexts is deterrence.)
8 Which of the following is a corrective control?
Answer: C - Corrective
Incident response and recovery procedures correct/restore after an incident.
9 Separation of duties is which type of control?
Answer: B - Preventive
Separation of duties prevents fraud or errors by ensuring no single person controls an entire process.
10 A checksum or hash verification performed after file transfer is which type of control?
Answer: C - Detective
Checksums/hashes detect whether data has been altered or corrupted during transfer.
11 Which control type provides the MOST value AFTER an incident has occurred?
Answer: C - Corrective
Corrective controls are applied after an incident to restore operations and minimize impact.
12 Motion sensors that trigger alarms are PRIMARILY:
Answer: B - Detective
Motion sensors detect movement and trigger alerts - they are detective controls.
13 A mantrap (access control vestibule) is which type of control?
Answer: C - Preventive
A mantrap prevents unauthorized individuals from following authorized personnel into a secure area (anti-tailgating).
14 Which of the following is BOTH a deterrent and a preventive control?
Answer: C - Visible security guard
A visible security guard deters attackers (deterrent) and can physically prevent unauthorized access (preventive).
15 Log monitoring and review is which type of control?
Answer: B - Detective
Log review detects anomalies, unauthorized activity, or policy violations after they occur.
16 Which control type is MOST cost-effective to implement FIRST in a defense-in-depth strategy?
Answer: C - Preventive
Preventive controls are typically implemented first to stop incidents before they occur, reducing overall risk and cost.
17 A disaster recovery plan (DRP) is which type of control?
Answer: C - Corrective
DRP is corrective - it restores operations after a disaster.
18 Which of the following is a detective control?
Answer: C - Detective
File integrity monitoring detects unauthorized changes to files.
19 Anti-malware software that quarantines a virus is performing which control function?
Answer: C - Corrective
Quarantining/removing malware after detection is corrective. (Note: Real-time blocking would be preventive.)
20 Which control type would be MOST appropriate to address the risk of employees making errors?
Answer: D - Preventive
Training, procedures, and input validation (preventive controls) reduce the likelihood of errors.
21 A fence around a data center perimeter is PRIMARILY:
Answer: C - Preventive
A fence physically prevents unauthorized access. (It also has deterrent value, but its primary function is prevention.)
22 Which of the following BEST describes a deterrent control?
Answer: B - It discourages potential attackers from attempting an attack
Deterrent controls discourage attackers by increasing the perception of risk of detection or consequences.
23 A hot site is which type of control?
Answer: C - Corrective
A hot site is a corrective/recovery control that restores operations after a disruption.
24 Which of the following is an example of a preventive control?
Answer: C - Preventive
Encryption prevents unauthorized access to data by making it unreadable.
25 Reviewing access logs to identify unauthorized access attempts is:
Answer: D - Detective
Log review is a detective control that identifies unauthorized activity.
26 Which control type is associated with "lessons learned" and improving future responses?
Answer: B - Corrective
Corrective controls include post-incident activities like lessons learned that improve future prevention and response.
27 A "Beware of Dog" sign is which type of control?
Answer: D - Deterrent
The sign is a deterrent - it discourages intruders by implying consequences.
28 Which of the following pairs correctly matches a control with its type?
Answer: C - Backup - Corrective
Backup is corrective (restores data). IDS is detective, firewall is preventive, warning banner is deterrent.
29 An organization wants to ensure it can identify a security breach as quickly as possible. Which control type should it focus on?
Answer: C - Detective
Detective controls are designed to identify incidents as quickly as possible.
30 Which of the following is the BEST example of a corrective control?
Answer: C - Corrective
Patching after exploitation corrects the vulnerability and restores the system to a secure state. (Note: Routine patching is preventive; emergency patching after exploitation is corrective.)
🏆
Quiz Complete!
0 / 30
0
Correct
0
Wrong
30
Total
Quick Reference Summary
| Control Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop incidents before they occur | Firewalls, encryption, locks, separation of duties, IPS |
| Detective | Identify incidents during/after occurrence | IDS, cameras, log review, motion sensors, FIM |
| Corrective | Restore after an incident | Backups, DRP, incident response, patching after breach |
| Deterrent | Discourage attackers | Warning banners, signs, visible guards, guard dogs |
Exam Tips
- Ask "WHEN does it act?" - Before (preventive/deterrent), During/After detection (detective), After (corrective).
- Deterrent vs. Preventive - Deterrent discourages (psychological); Preventive stops (physical/technical).
- Detective vs. Corrective - Detective identifies; Corrective fixes.
- Some controls serve multiple purposes - choose the PRIMARY function based on the scenario.
- CRISC often tests "BEST" or "PRIMARY" - look for the control's main intent in the given context.
0 $type={blogger}:
Post a Comment