Question 136 - CCAK discussion

A corrective control is a measure taken to correct or reduce the impact of an error, deviation, or unwanted activity1. Corrective control can be either manual or automated, depending on the type of control used.Corrective control can involve procedures, manuals, systems, patches, quarantines, terminations, reboots, or default dates1. A Business Continuity Plan (BCP) is an example of a corrective control.

Unsuccessful access attempts being automatically logged for investigation is an example of a corrective control because it is a response to a potential security incident that aims to identify and resolve the cause and prevent future occurrences2. Logging and investigating failed login attempts can help detect unauthorized or malicious attempts to access sensitive data or systems and take appropriate actions to mitigate the risk.

The other options are examples of preventive controls, which are designed to prevent problems from occurring in the first place3. Preventive controls can include:

A central antivirus system installing the latest signature files before allowing a connection to the network: This is a preventive control because it prevents malware infection by blocking potentially harmful connections and updating the antivirus software regularly4.

All new employees having standard access rights until their manager approves privileged rights: This is a preventive control because it prevents unauthorized access by enforcing the principle of least privilege and requiring approval for granting higher-level permissions5.

Privileged access to critical information systems requiring a second factor of authentication using a soft token: This is a preventive control because it prevents credential theft or compromise by adding an extra layer of security to verify the identity of the user.

What is a corrective control?- Answers1, section on Corrective control

Detective controls - SaaS Lens - docs.aws.amazon.com2, section on Unsuccessful login attempts

Internal control: how do preventive and detective controls work?3, section on Preventive Controls

What Are Security Controls?- F54, section on Preventive Controls

The 3 Types of Internal Controls (With Examples) | Layer Blog5, section on Preventive Controls

What are the 3 Types of Internal Controls? --- RiskOptics - Reciprocity, section on Preventive Controls