Which control is used to detect an attack while it is occurring and to notify proper personnel?

• A. Deterrent Control
• B. Preventive Control
• C. Detective Control
• D. Compensating Control

Answer: (C)

Detective controls identify and report security incidents as they happen. They monitor activity, look for signs of an attack, and alert the right people so response can begin immediately. In this scenario you want something that can detect an attack while it’s occurring and notify personnel, which is exactly what a detective control does. Examples include intrusion detection systems, security information and event management (SIEM) systems, log monitoring, and surveillance cameras. This differs from preventive controls, which focus on stopping incidents before they happen, and from compensating controls, which provide alternatives when primary controls can’t be used. Because the emphasis here is on real-time detection and notification, the best fit is a detective control.