23. After a recent ransomware attack on a company's system, an administrator reviewed the log files. Which of the following control types did the administrator use?
Answer: B
The administrator used a Detective control type.
The administrator reviewed the log files to identify any unauthorized access or activities that occurred during the ransomware attack, which is characteristic of a Detective control. Detective controls are specifically designed to detect and alert on security incidents.
A) Compensating
Compensating controls are alternative measures implemented to fulfill the requirement of a primary control that is not feasible. In this scenario, the administrator did not implement an alternative measure but instead investigated existing logs, so this option is incorrect.
B) Detective
Detective controls are intended to identify and detect any incidents or breaches after they have occurred. The review of log files falls directly under this category, as it seeks to uncover evidence of the ransomware attack, making this the correct choice.
C) Preventive
Preventive controls are designed to stop security incidents before they occur, such as firewalls or antivirus software. Since the administrator's action involved reviewing logs after an attack had already taken place, this option does not apply.
D) Corrective
Corrective controls are implemented after an incident to restore systems to normal operation and mitigate damage. The administrator was not taking corrective actions but rather assessing what happened, thus this option is not applicable.
Conclusion
The review of log files is a clear example of a Detective control, as it focuses on identifying previous security incidents. In contrast, the other options—Compensating, Preventive, and Corrective—do not accurately describe the administrator's actions in response to the ransomware attack. Therefore, the choice of Detective is definitively correct.