Exam SY0-601 topic 1 question 207 discussion

This question can be interpreted as: Preventative = preventing this previous issue from happening again Corrective = correcting this issue that has happened FUCK YOU COMPTIA

Corrective is correct

he control type that fixes a previously identified issue and mitigates a risk is typically referred to as a corrective control.

To avoid confusion, preventative (or prevent) shouldn’t be in the same sentence as corrective.

C - key words "previously identified issues". Corrective is used after. Preventative is before an event occurs.

It has been identified, now it is time to correct it. Corrective.

Preventative Controls: Preventative controls are implemented to proactively reduce the likelihood of incidents or risks occurring in the first place. These controls are meant to prevent problems from happening. Examples include access controls, encryption, security awareness training, and security policies. Preventative controls aim to stop issues from arising rather than addressing issues that have already occurred. B is the right answer

Corrective controls are put in place to address and fix previously identified issues or vulnerabilities in order to mitigate the risk they pose. These controls are reactive in nature and are applied after a problem has been detected or an incident has occurred. They aim to correct the root cause of the issue and prevent its recurrence in the future. Examples of corrective controls include patching software vulnerabilities, restoring data from backups after a data loss event, or reconfiguring a system to address a security misconfiguration.

If you understand the Incident Response Process, IMO corrective make sense to me.

B. Corrective. for Fixing previous issues: Corrective for Not allowing to happen at all: Preventive.

preventive because it doesn't say that the vulnerability was exploited before it was corrected, so the remediation it was implemented as a preventive action, not a corrective one.

For me, the keyword here is "fixes" , thus Corrective must be the right choice.

I am assuming is B, even thogh they use misleading words like "previously" which could mean something that happened in the past.

Answer: Corrective Corrective controls that remediate security issues that have already occurred. Restoring backups after a ransomware attack is an example of a corrective control.

Preventative A preventative control is one that prevents specific actions from occurring, such as a mantrap prevents tailgating. Preventative controls act before an event, preventing it from advancing. A firewall is an example of a preventative control, as it can block access to a specific resource.

so which is going to be the correct answer according to the marking scheme... cos its becoming confusing now

A corrective control is designed to mitigate any damage that was occurred because of a security event. ...pro messer