Isaca Updated CRISC Exam Questions and Answers by andrei

A preventive control is a type of control that aims to avoid or reduce the occurrence of an undesirable event or risk. A preventive control can be implemented through technical, administrative, or physical means. A new policy that forbids copying of data onto removablemedia is an example of a preventive control, because it prevents unauthorized data exfiltration or leakage through removable devices, such as flash drives or external hard disk drives. A preventive control is different from the other types of controls, as explained below:

A detective control is a type of control that aims to discover or identify the occurrence of an undesirable event or risk. A detective control can be implemented through monitoring, auditing, or reporting activities. An example of a detective control is a log analysis tool that detects any unauthorized access or modification of data on a system.

A directive control is a type of control that aims to guide or instruct the behavior or actions of individuals or groups. A directive control can be implemented through policies, procedures, standards, or rules. An example of a directive control is a training program that teaches employees how to handle sensitive data securely and appropriately.

A deterrent control is a type of control that aims to discourage or dissuade individuals or groups from performing an undesirable event or risk. A deterrent control can be implemented throughsanctions, penalties, or consequences. An example of a deterrent control is a warning message that informs users of the legal implications of copying data onto removable media without authorization. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.1, page 38.

Regular employee security awareness training is the most effective method to reduce unintentional disclosure of sensitive information. Training educates employees on risks, policies, and best practices, thus changing behavior and reducing human error. Classification policies provide guidelines, and technical controls like IDS and anti-malware detect or prevent some risks but do not address the human factor as directly as awareness training【5:517, 5:527†CRISC_SentenceinNOTE30.pptx】.

The project sponsor holds the ultimate accountability for the project ' s success and is typically responsible for approving significant decisions, including risk mitigation responses. Their role involves ensuring that the project aligns with business objectives and that risks are managed appropriately to achieve desired outcomes.