Which one of the following can be identified when exceptions occur using operations security
detective controls?

A.
Unauthorized people seeing confidential reports.

B.
Unauthorized people destroying confidential reports.

C.
Authorized operations people performing unauthorized functions.

D.
Authorized operations people not responding to important console messages.

Explanation:
C is the one that makes the most sense. [Operation Security] Detective Controls are used to detect
an error once it has occurred. Unlike preventative controls, these controls operate after the fact and
can be used to track an unauthorized transaction for prosecution, or to lessen an error’s impact on
the system by identifying it quickly. An example of this type of control is an audit trail. -Ronald Krutz
The CISSP PREP Guide (gold edition) pg 299