DNS Logging Tool Control Type
Short answer
D The DNS logging tool acts as a detective control by monitoring and reporting suspicious website visits without preventing or correcting them.
Question
Key Takeaways
The core concept tested is distinguishing between control types; the common trap is confusing Detective controls (logging/alerting) with Preventive (blocking) or Corrective (fixing) controls.
This question asks to identify the control type of a DNS logging tool that monitors and reports suspicious activity. The correct answer is Detective, as the tool observes and alerts rather than blocking or correcting.
Common mistake: Users often incorrectly select Preventive because they associate security tools with stopping threats, failing to recognize that logging alone does not block traffic.
Expert Analysis
Why the Answer Is Correct
The correct answer is D (Detective). A detective control is designed to identify and alert on security incidents after they have occurred or are in progress. By logging DNS queries and generating reports on suspicious websites, the administrator has implemented a mechanism to detect potential threats without actively stopping them.
Why the Other Options Are Wrong
Option A (Preventive) is incorrect because preventive controls aim to stop an incident before it happens (e.g., firewalls, access controls); this tool only logs activity. Option B (Deterrent) is incorrect because deterrent controls discourage attackers through fear of consequences (e.g., warning banners), which this tool does not do. Option C (Corrective) is incorrect because corrective controls restore systems after an incident (e.g., backups, patching), whereas this tool only provides information.
Community Comment Notes
Community consensus strongly supports option D. One user noted that the tool "identifies and notifies" risks, which aligns perfectly with detective functions. Another commenter emphasized that the daily report provides insights into malicious activities, helping in understanding incidents, a key aspect of detective controls.
Exam Strategy
When identifying control types, look for keywords like 'log', 'monitor', 'audit', or 'report' to indicate Detective controls. If you see 'block', 'encrypt', or 'authenticate', think Preventive. If you see 'restore', 'backup', or 'patch', consider Corrective.
Frequently Asked Questions
Why isn't a DNS log considered a preventive control?
Does a daily report make this a corrective control?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
johnabayot 👍 7 Answered DThe DNS logging tool is a detective control because it monitors the website visited by the users and reports any suspicious ones based on certain criteria. It does not prevent, deter or correct the behaviour of the users, but rather identifies and notifies the administrator of any potential security risks.
-
1403ad2 👍 7 Answered Dchoose D 2024-20-2 On Test and passed with 802
-
Hs1208 👍 1 Answered DD. Detective The daily report based on various weighted metrics provides insights into potentially malicious or unauthorized activities. Detective controls are valuable for identifying and responding to security incidents after they have occurred. They help in understanding the nature of incidents, gathering evidence, and taking appropriate corrective action
-
shady23 👍 1 Answered DD. Detective
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.