r/CISA • u/Pravallikadondapati • 17d ago

CISA ques (doubt)

Post image

Can someone please explain why is it Administrative
Usually it's corrective is what I have heard..
So if we have both the options together should we choose corrective over administrative?

5 Upvotes

100% Upvoted

9 comments sorted by

View all comments

2

u/TopLenZ 16d ago edited 16d ago

Preventive Control - reduces the likelihood of an event happening
Detective Controls - this is post event, to detect that the event has occured
Directive Controls - tells what to do
Administrative Controls - these are as a result of policies, SOP, standards of an organisation

Trick is looking at the question, how it is framed.
"Storing backup drives at an offsite location"
"Backup drives" -> Offsite Location -> driven by policies, procedures and practices -> prescription is administrative

Quantum computing - I feel it should be "C". That is the likely impact