Certified Information Systems Security Professional (CISSP) Practice Exam

What does a detective technical control aim to achieve?

1. To proactively stop attacks

2. To monitor and detect security incidents

3. To conduct regular system audits

4. To ensure data privacy compliance

The correct answer is: To monitor and detect security incidents

A detective technical control is specifically designed to monitor and detect security incidents as they occur within a system or network. The primary goal of these controls is to provide visibility into potential security breaches or abnormal activities, allowing organizations to respond appropriately to mitigate any damage. Detective controls implement mechanisms such as intrusion detection systems, security information and event management (SIEM) solutions, and monitoring tools that continuously analyze event logs and network traffic. This real-time monitoring helps in identifying suspicious behavior, thereby enabling security teams to react swiftly and investigate incidents further. While proactive measures, regular audits, and compliance efforts are crucial elements of an organization's security posture, they fall under different categories of security controls. Proactive measures seek to prevent attacks, audits focus on evaluating security processes and controls over time, and compliance ensures adherence to legal and regulatory requirements. In contrast, the essence of detective controls is centered entirely on recognizing and responding to security incidents after they have occurred, making the objective of monitoring and detection paramount.