Exam CISM topic 1 question 237 discussion

Detective controls are designed to identify and detect security incidents or events that have already occurred or are in progress. An incident response team is responsible for detecting and responding to security incidents within an organization, making it a type of detective control.

There is a difference between incident management and incident response. Incident management is actions taken prior to, during and after the incident. This includes pro-active and reactive detection of incidents. Incident response is actions taken when an incident has been declared, i.e. after detection and reporting. Among verification, assigning ownership, and triage this also includes corrective actions like containment, eradication and recovery. Therefore, the most likely answer is C, corrective.

Its literally called incident response. Something happens then a response just like corrective control. Its C

I thought detective is part of the NOC or SOC team. When incident detected and require escalation, which might trigger IRT to be involved.

Its a corrective control and not detective control. Question is about Incident RESPONSE team.

I'm going corrective. Reason being they are notified after an incident has taken place. Therefore, they aren't preventing it, detecting it or what ever the other option was. They come in after it has already been decided there is an incident to work. Yes, they detect whatever ever it is afterward but the team as a whole is not put in place to detect I would think that would fall under an IDS or IPS and then the team gets called into action afterward as the corrective control.

Stupid Question. It is both Detective and corrective.

An incident response team is a detective control. Detective controls are designed to identify and respond to security incidents after they have occurred. The incident response team's role is to detect, analyze, and mitigate security incidents in real-time or after they have occurred, working to minimize the impact and prevent future occurrences.

Guys please don't blindly listen to Chatgpt. I see that many of you here just accept whatever chatgpt provides as an answer but unfortunately many chatgpt answers are flawed. For this question chatgpt said A. Detective as the correct answer, but when i challenged it with supporting data from ISACA training, it apologized and changed it's answer to C. Corrective. This one is a nullbrainer. Don't blindly listen to chatgpt. Use your mind and do your own research.

A. Detective In the context of an incident response team, their primary role is to detect and respond to security incidents or breaches that have already taken place.

IRTs are activated after an incident has been confirmed as true.

According to the ISACA's CISM Review Manual, 27th Edition, an incident response team is a type of corrective control.

c: el equipo de respuesta a incidentes entra a corregir y no a detectar.

Trust me , C corrective .

C. Corrective. Main objective of incident management is to restore the affected processes back to its normal state as quickly as possible, minimizing the impact on the business, and NOT to detect incidents.

C. Corrective

A. Detective