Question 92 - SY0-701 discussion

Detective controls are security measures that are designed to identify and monitor any malicious activity or anomalies on a system or network. They can help to discover the source, scope, and impact of an attack, and provide evidence for further analysis or investigation. Detective controls include log files, security audits, intrusion detection systems, network monitoring tools, and antivirus software. In this case, the administrator used log files as a detective control to review the ransomware attack on the company's system. Log files are records of events and activities that occur on a system or network, such as user actions, system errors, network traffic, and security alerts. They can provide valuable information for troubleshooting, auditing, and forensics.

Security+ (Plus) Certification | CompTIA IT Certifications, under ''About the exam'', bullet point 3: ''Operate with an awareness of applicable regulations and policies, including principles of governance, risk, and compliance.''

CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 1, page 14: ''Detective controls are designed to identify and monitor any malicious activity or anomalies on a system or network.''

Control Types -- CompTIA Security+ SY0-401: 2.1 - Professor Messer IT ..., under ''Detective Controls'': ''Detective controls are security measures that are designed to identify and monitor any malicious activity or anomalies on a system or network.''