The DNS logging tool deployed by the network administrator is designed to monitor and log suspicious websites that users visit and generate daily reports. This functionality is best categorized as a detective control, which focuses on identifying and recording suspicious or unauthorized activities to facilitate further analysis and response.
* It does not actively stop activities (as a preventive control would).
* It identifies suspicious behavior after it has occurred.
* It helps in detecting patterns or potential security issues for future mitigation.
* A. Preventive: Preventive controls are designed to stop or mitigate risks before they occur, such as firewalls or access control mechanisms. This DNS tool does not actively block access to suspicious websites.
* B. Deterrent: Deterrent controls discourage malicious behavior by influencing potential attackers (e.g., warning banners or security cameras). While the tool might have an indirect deterrent effect, its primary purpose is to detect and log activity.
* C. Corrective: Corrective controls address and mitigate the effects of a security incident after it has occurred. The DNS logging tool does not remediate or correct issues; it only identifies them.
Characteristics of a Detective Control:Why not the other options?Conclusion:The DNS logging tool serves as a detective control by identifying and reporting on suspicious activity, aiding in monitoring and potential investigation.