Question

Following a ransomware incident that encrypted several file servers, an organization successfully restored operations from backups within its recovery objectives. The information security manager is now reviewing the control set to reduce the impact of any future occurrence. Which type of control was MOST directly responsible for limiting the business impact in this case, and should be prioritized for continued investment?

Accepted Answer

Corrective controls, such as tested backup and restoration capabilities

Answer

Preventive controls, such as email filtering and application allow-listing

Answer

Detective controls, such as endpoint detection and response alerting

Answer

Deterrent controls, such as warning banners and acceptable use policies