Which one of the following can be identified when exceptions occur using operations security
detective controls?
A.
Unauthorized people seeing confidential reports.
B.
Unauthorized people destroying confidential reports.
C.
Authorized operations people performing unauthorized functions.
D.
Authorized operations people not responding to important console messages.
Explanation:
C is the one that makes the most sense.
[Operation Security] Detective Controls are used to detect an error once it has occurred. Unlike
preventative controls, these controls operate after the fact and can be used to track an
unauthorized transaction for prosecution, or to lessen an error’s impact on the system by
identifying it quickly. An example of this type of control is an audit trail. -Ronald Krutz The CISSP
PREP Guide (gold edition) pg 299