Exam CISM topic 1 question 284 discussion

B is preventive and C is reactive

Question is vague. I chose C thinking it means a malicious program in your environment. If this refers to malicious programming code, then the answer is B for code review.

in a nutshell its B countermeasure (proactive measure). C is reactive.

From the CISM Review Manual, 15th Edition, by ISACA (Page 219): "A key preventive control is the use of sound software development life cycle (SDLC) processes. Properly executed, the SDLC should help prevent the introduction of many types of malicious code."

C. Implement controls for continuous monitoring of middleware transactions.

I would agree with B since B is a preventative control while C is a detective control

The MOST effective countermeasure against malicious programming that rounds down transaction amounts and transfers them to the perpetrator's account is to implement controls for continuous monitoring of middleware transactions. This type of fraud, known as salami slicing, involves making small fraudulent transactions that are difficult to detect but add up over time. By implementing controls for continuous monitoring of middleware transactions, organizations can detect and prevent this type of fraud by monitoring all transactions for patterns and anomalies. The other options listed may provide some protection against malware, but they are not specifically targeted at the type of fraud described in the question.