Exam SY0-601 topic 1 question 522 discussion

The administrator used detective controls by reviewing the log files after the ransomware attack. Detective controls are designed to detect and identify potential security incidents or policy violations that may have occurred within an organization's systems or network. In this case, the log files were analyzed to identify signs of the ransomware attack and understand how the incident occurred. Detective controls help in identifying security breaches or other issues so that appropriate actions can be taken to respond to and mitigate the impact of the incident. They are an essential part of a comprehensive cybersecurity strategy, alongside preventive and corrective controls.

Detective Controls ● Used during the event to find out whether something bad might be happening

an admin would want to review the logs in order to correct the vulnerabilities to prevent the similar attack from happening again. but since the question doesn't provide enough details on what the admin is trying to do after reviewing the logs, I'll just go with B since the log exists because it was detected. thoughts? anyway, a bad question again from comptia... makes me want to just stop reading these questions.

"The important point is that detective controls discover the event after it has occurred. Some examples of detective controls are: Log Monitoring, SIEM, Security Audit, Video Surveillance, Motion Detection, IDS" - Darril Gibson