(ISC)2 Certified in Cybersecurity Practice Exam

Which of the following aims to reduce the likelihood or impact of a risk and also help identify issues?

1. Preventive Control

2. Detective Control

3. Security Controls

4. Recovery Control

The correct answer is: Security Controls

The focus on reducing the likelihood or impact of a risk, along with identifying issues, highlights the broad definition of security controls. These controls encompass a variety of measures that organizations implement to protect their information and systems from potential threats. Security controls are categorized into preventive, detective, and recovery mechanisms designed to address different aspects of risk management. Preventive controls are aimed specifically at stopping incidents before they occur, while detective controls are designed to identify incidents as they happen, allowing for timely responses. Recovery controls come into play after an incident has already occurred, aiding in the restoration of systems and operations. Security controls, however, are comprehensive and include measures that serve to mitigate risks, enhance awareness, and facilitate the identification of vulnerabilities. Thus, they encompass both reduction of risk and identification of issues effectively. In this context, the term "security controls" sufficiently captures the intent behind the question by encompassing the preventive, detective, and recovery aspects of risk management.