Exam CISM topic 1 question 643 discussion

OFCOUUUUURSE NOT PREVENTIVE, have redundant power supply doesnt prevent power to cut off but it provides with a corrective action when it happens

Corrective actions fix issues after something happens (ie backups for corrupted databases). If a server lost power and shuts down, a redundant power supply does not turn it back on. A redundant power supply "prevents" the server from shutting down.

Preventive control implemented to avoid potential problem and managing risk. Eg. Add firewall, redundant firewall, redundant power supply, fence, locks, segregation of duties etc. Corrective control to correct the issue or problem that had been found. Eg. patching, reboot system, replace faulty hard disk etc.

key word is redundant, never jump to a conclusion just because of power outage phrase

Preventative – An internal control that is used to avoid undesirable events, errors and other occurrences that an enterprise has determined could have a negative material effect on a process or end product Corrective – Designed to correct errors, omissions and unauthorized uses and intrusions once they are detected >> Preventative

OMG, soo many comments on this easy question. Of course it's D - Corrective, because corrective controls work after the fact (in this case power outage). Preventive means "to prevent" power outage in this case. How are they going to prevent it? They are trying to correct the thing that already occurred.

Preventive controls are proactive measures designed to stop unwanted or unauthorized activities from occurring in the first place. In this case, redundant power supplies are preventing system outages.

Option C

D When detective control activities identify an error or irregularity, corrective control activities should then kick in to see what could or should be done to fix it. Here it got detected that there is a business risk with 1 Power supply , so they corrected it with 2 Power Supply. It could have been preventive if they did this in first place ie 2Power Supplies are implemented for first time

Corrective

D. Corrective

Interesting question. Correct Answer D: Because Preventive means, prevent the occurrence of the incident (i.e. power OFF). In this case, power off occurred; after power off the backup power start which means correction activity.

A redundant power supply is when a single piece of computer equipment operates using two or more physical power supplies. Each of the power supplies will have the capacity to run the device on its own, which will allow it to operate even if one goes down. For normal operation, each of the power supplies will provide half (assuming there are two) of the power that is needed. If one is powered off for some reason, the other one will immediately compensate to provide full power to the device so there is no downtime at all.

By having redundant power supplies in place, the organization can correct the situation by providing backup power sources to minimize the impact of outages and restore normal operations. The focus is on addressing the consequences of the risk event rather than preventing it from happening in the first place.

How this is a corrective control makes no sense to. Foreseeing a risk and implementing controls in place to prevent an incident is the literal definition of a preventative risk.

preventive! C

IMO, the answer is C - Preventative. Per ISACA manual, page 196, Preventative controls directly address risk, which is what this is, the risk of a power outage. Corrective controls, per ISACA manual, page 196, "...remediate impact". Which means an incident has occurred and it is AFTER the fact, you are fixing/correcting something that has occurred, past tense. So NOT D.