MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. What is the primary purpose of a detective control in cybersecurity?
   a. To stop attacks before they happen
   b. To identify and alert on incidents after they occur
   c. To recover from security incidents
   d. To provide user training
   Answer: baws.amazon+1
2. Which of the following is an example of a detective control?
   a. Firewall
   b. Security camera footage review
   c. Regular software patching
   d. User password complexity policy
   Answer: bpathlock+1
3. What is a common tool used for detective controls in network monitoring?
   a. Intrusion Detection System (IDS)
   b. Access badge
   c. Antivirus update
   d. Encryption certificate
   Answer: ayoutube
4. Which type of security control is designed to spot incidents that bypass other defenses?
   a. Preventive control
   b. Detective control
   c. Corrective control
   d. Directive control
   Answer: baws.amazon+1
5. When does a detective control operate in the sequence of a security incident?
   a. Before the incident occurs
   b. During incident occurrence
   c. After the incident has happened
   d. Instead of preventive measures
   Answer: cpurplesec+1
6. What is the function of log monitoring as a detective control?
   a. Block network intrusions automatically
   b. Analyze and report on unusual activity
   c. Remove malicious files
   d. Lock out users after failed login
   Answer: bcycognito+1
7. Security audits serve primarily as which type of control in cybersecurity?
   a. Detective
   b. Preventive
   c. Corrective
   d. Directive
   Answer: apurplesec+1
8. Which of the following best describes a detective control?
   a. Prevents unauthorized access
   b. Deters users from malicious acts
   c. Flags and reports suspicious activity
   d. Repairs systems after attacks
   Answer: ccyberpedia.reasonlabs+1
9. A Security Information and Event Management (SIEM) system is an example of:
   a. Corrective control
   b. Preventive control
   c. Detective control
   d. Directive control
   Answer: cyoutubepurplesec
10. What is a key output of detective controls?
    a. Disabling malicious users
    b. Alerting security personnel about suspicious events
    c. Encrypting sensitive files
    d. Setting password policies
    Answer: bcyberpedia.reasonlabs+1
11. Which of these can NOT be classified as a detective control?
    a. Log analysis
    b. Security policy training
    c. Event alerts after incidents
    d. Surveillance video review
    Answer: biosentrix+1
12. What is the ultimate goal of detective controls in a security program?
    a. Prevent all incidents from happening
    b. Identify and alert on incidents for timely response
    c. Eliminate all security threats
    d. Replace preventive controls
    Answer: bscrut+1
13. Reviewing failed login attempts in a system log is an example of:
    a. Preventive control
    b. Detective control
    c. Deterrent control
    d. Corrective control
    Answer: byoutube
14. How do detective controls contribute to incident response?
    a. By fixing security flaws automatically
    b. By providing information to investigate incidents
    c. By deploying new firewalls
    d. By disabling all user accounts
    Answer: bscrut+1
15. Which activity is most often associated with detective controls?
    a. Continuous surveillance
    b. Initial risk assessment
    c. Policy enforcement
    d. Encryption management
    Answer: apathlock+1
16. Which of the following is NOT a detective control?
    a. Patch updates
    b. SIEM alerting
    c. Log analysis
    d. Security audits
    Answer: apurplesec+1
17. Motion detection sensors used in physical security are what type of cyber control?
    a. Preventive
    b. Detective
    c. Corrective
    d. Directive
    Answer: bpurplesec
18. Which element do detective controls provide that is critical for compliance audits?
    a. Preventative reporting
    b. Real-time blocking
    c. Documented evidence of monitoring activity
    d. Automatic system recovery
    Answer: cipkeys+1
19. The immediate action taken upon receiving an alert from a detective control is usually:
    a. Investigating the cause and impact
    b. Changing all passwords
    c. Installing new hardware
    d. Deleting all suspicious files
    Answer: acyberpedia.reasonlabsyoutube
20. After a security breach, what is most helpful for a forensic investigation?
    a. Audit logs from detective controls
    b. Unused firewall rules
    c. Outdated backup copies
    d. User training records
    Answer: acycognito+1
21. Why are detective controls essential in layered security models?
    a. They are less costly than other controls
    b. They identify gaps missed by preventive controls
    c. They are more effective than encryption
    d. They stop all unauthorized access
    Answer: bisaca+2
22. What is the main difference between detective and preventive controls?
    a. Detective controls are not monitored regularly
    b. Detective controls identify, while preventive controls stop
    c. Detective controls are proactive
    d. Detective controls require user interaction
    Answer: b6clicks+2
23. Which task best fits a detective control?
    a. Record all user activity for review
    b. Reset compromised passwords
    c. Block malicious incoming emails
    d. Update software automatically
    Answer: acyberpedia.reasonlabs+1
24. Scheduled vulnerability scans are classified as:
    a. Preventive controls
    b. Detective controls
    c. Deterrent controls
    d. Corrective controls
    Answer: btotalprosource+1
25. Security configuration management that reviews settings for compliance is an example of:
    a. Detective control
    b. Preventive control
    c. Corrective control
    d. Administrative control
    Answer: atotalprosource
26. Which of the following would NOT be considered a detective control?
    a. Monitoring employee internet usage
    b. Access badge requirement for entry
    c. Reviewing audit trails regularly
    d. SIEM event alerting
    Answer: bpathlock+1
27. Detective controls are crucial for which aspect of cybersecurity?
    a. Detecting network intrusions
    b. Preventing attacks altogether
    c. Encrypting data at rest
    d. Patch management
    Answer: ayoutube
28. Detective controls help organizations meet:
    a. Regulatory and compliance obligations
    b. Encryption requirements only
    c. Hiring needs for security staff
    d. Proactive advertising guidelines
    Answer: aipkeys+1
29. File Integrity Monitoring (FIM) is used to:
    a. Block file access automatically
    b. Alert on unauthorized file changes
    c. Provide user password resets
    d. Encrypt files in storage
    Answer: btotalprosource
30. A security camera in a data center is best classified as:
    a. Preventive control
    b. Detective control
    c. Corrective control
    d. Deterrent control
    Answer: bpathlock+1
31. Which detective control best helps spot a brute force attack on a login system?
    a. Password complexity requirement
    b. Log monitoring for failed attempts
    c. Network segmentation
    d. Data backup
    Answer: bpurplesecyoutube
32. The process of reviewing network traffic logs is an example of:
    a. Preventive control
    b. Detective control
    c. Deterrent control
    d. Directive control
    Answer: bcycognitoyoutube
33. Why can’t detective controls stop an incident before it happens?
    a. They only monitor and report incidents after they occur
    b. They operate in real time
    c. They are disconnected from core systems
    d. They require user approval
    Answer: aaws.amazon+1
34. Which item is a benefit of using detective controls?
    a. Minimizing damage through rapid response
    b. Reducing system performance
    c. Preventing software bugs
    d. Eliminating user errors permanently
    Answer: acyberpedia.reasonlabsyoutube
35. Trend analysis as a detective control helps in:
    a. Patching outdated systems
    b. Finding patterns in logs to spot threats
    c. Forcing password changes
    d. Disabling user accounts
    Answer: bpurplesec
36. Reviewing SIEM reports every week is an example of:
    a. Corrective control
    b. Detective control
    c. Deterrent control
    d. Preventive control
    Answer: byoutubepurplesec
37. Post-incident analysis supported by detective controls helps organizations:
    a. Improve future prevention strategies
    b. Hire new staff
    c. Replace all software
    d. Ignore prior incidents
    Answer: acycognito
38. Which of these control types performs investigation and documentation after incidents?
    a. Preventive control
    b. Detective control
    c. Deterrent control
    d. Physical control
    Answer: bcyberpedia.reasonlabs
39. Detective controls are LEAST likely to:
    a. Identify violations
    b. Document suspicious activities
    c. Repair damaged systems
    d. Provide audit trails
    Answer: cipkeys+1
40. Security configuration reviews are done to:
    a. Block unauthorized access instantly
    b. Find unintended system changes after the fact
    c. Recover lost passwords
    d. Lock user accounts after three failures
    Answer: btotalprosource
41. Which detective control may alert on changes in network device configuration?
    a. Preventive firewall
    b. Network monitoring tool
    c. Data encryptor
    d. User reminder system
    Answer: byoutube
42. Detective controls are part of what cybersecurity framework principle?
    a. Defense-in-depth
    b. Single-layer protection
    c. Open access
    d. User-only authentication
    Answer: aiosentrix+1
43. Reviewing physical access logs at a facility is an example of which control type?
    a. Detective
    b. Deterrent
    c. Preventive
    d. Corrective
    Answer: aiosentrix+1
44. How do detective controls help in risk management?
    a. Mitigate risks by alerting about breaches and misuse
    b. Stop all threats completely
    c. Remove need for backup procedures
    d. Eliminate need for employee training
    Answer: atrustpair+1
45. How do detective controls differ from corrective controls?
    a. Detective controls notify, corrective controls fix
    b. Detective controls are more expensive
    c. Detective controls always come before preventive controls
    d. Detective controls replace backup systems
    Answer: apathlock+1
46. Reviewing system change logs can help an organization:
    a. Spot accidental or malicious changes
    b. Encrypt their network automatically
    c. Block remote connections in advance
    d. Train users more quickly
    Answer: atotalprosourceyoutube
47. Who primarily responds to the alerts from detective controls?
    a. IT security team
    b. Untrained end users
    c. Marketing staff
    d. Sales personnel
    Answer: aaws.amazon+1
48. Periodic internal audits in information security are an example of:
    a. Detective control
    b. Preventive control
    c. Organizational control
    d. None of these
    Answer: apathlock+1
49. Which scenario BEST illustrates the use of detective controls?
    a. Intrusion attempts logged and reviewed daily
    b. Antimalware software blocking a virus
    c. Security training for all staff
    d. Restricting system privileges
    Answer: acycognitoyoutube
50. The process of continuously examining and reviewing records to identify potential threats belongs to:
    a. Detective controls
    b. Corrective controls
    c. Physical controls
    d. Administrative controls
    Answer: apurplesec+1youtube

1. https://docs.aws.amazon.com/prescriptive-guidance/latest/aws-security-controls/detective-controls.html
2. https://cyberpedia.reasonlabs.com/EN/detective%20controls.html
3. https://pathlock.com/blog/internal-controls/types-of-internal-controls/
4. https://www.cycognito.com/learn/exposure-management/security-controls.php
5. https://www.youtube.com/watch?v=PAkVdbBacZo
6. https://purplesec.us/learn/security-controls/
7. https://www.scrut.io/post/security-control-types
8. https://iosentrix.com/blog/types-of-security-controls
9. https://ipkeys.com/blog/security-controls/
10. https://www.isaca.org/resources/isaca-journal/issues/2015/volume-5/cybersecurity-detective-controlsmonitoring-to-identify-and-respond-to-threats
11. https://www.6clicks.com/resources/answers/what-are-the-three-types-of-security-controls-nist
12. https://blog.totalprosource.com/6-detective-security-controls-your-business-should-implement
13. https://trustpair.com/blog/why-are-detective-controls-crucial-to-fight-fraud-in-your-company/
14. https://www.investopedia.com/terms/d/detective-control.asp
15. https://destcert.com/resources/types-security-controls/
16. https://www.youtube.com/watch?v=puRXMXOtmXc
17. https://www.janbasktraining.com/blog/types-of-security-controls/
18. https://financialcrimeacademy.org/risk-control-techniques-pcdd/