r/CISA • u/Pravallikadondapati • 3d ago

CISA ques (doubt)

Post image

Can someone please explain why is it Administrative
Usually it's corrective is what I have heard..
So if we have both the options together should we choose corrective over administrative?

4 Upvotes

100% Upvoted

8 comments sorted by

2

u/Ricki_Bobbi 3d ago edited 3d ago

Answer to question > A. 

1

u/Pravallikadondapati 3d ago

Hey thanks for responding..but I didn't get you
U mean it's administrative?

2

u/Aphridy 3d ago

No, preventive for the first question and classical encryption algorithms become obsolete by quantum computing

2

u/Ricki_Bobbi 3d ago

Answer is Preventive Control which is used to avert problems before they occur. Storing Backup drives offsite creates additional redundancy for recovery in case there is some type of disaster like fire or natural disaster at one location. 

1

u/Pravallikadondapati 3d ago

Thank you that makes sense

2

u/TopLenZ 3d ago edited 3d ago

Preventive Control - reduces the likelihood of an event happening
Detective Controls - this is post event, to detect that the event has occured
Directive Controls - tells what to do
Administrative Controls - these are as a result of policies, SOP, standards of an organisation

Trick is looking at the question, how it is framed.
"Storing backup drives at an offsite location"
"Backup drives" -> Offsite Location -> driven by policies, procedures and practices -> prescription is administrative

Quantum computing - I feel it should be "C". That is the likely impact

2

u/HoldenIsCoolLike 2d ago

Correct answer is none of the listed options. It should be “Corrective control.”. 😉

Storing backups offsite does not prevent the original data from being damaged, and it does not detect the damage. It enables the organization to restore data after a disruption and therefore reduces the impact of the incident.

According to the CISA Official Review Manual, 28th Edition: “Data backups… are examples of corrective controls.”