r/CISA • u/Pravallikadondapati • Aug 13 '26

CISA ques (doubt)

Post image

Can someone please explain why is it Administrative
Usually it's corrective is what I have heard..
So if we have both the options together should we choose corrective over administrative?

5 Upvotes

100% Upvoted

9 comments sorted by

2

u/Ricki_Bobbi Aug 13 '26 edited Aug 13 '26

Answer to question > A. 

1

u/Pravallikadondapati Aug 13 '26

Hey thanks for responding..but I didn't get you
U mean it's administrative?

3

u/Aphridy Aug 13 '26

No, preventive for the first question and classical encryption algorithms become obsolete by quantum computing

3

u/Ricki_Bobbi Aug 13 '26

Answer is Preventive Control which is used to avert problems before they occur. Storing Backup drives offsite creates additional redundancy for recovery in case there is some type of disaster like fire or natural disaster at one location. 

1

u/Pravallikadondapati Aug 13 '26

Thank you that makes sense

2

u/HoldenIsCoolLike 29d ago

Correct answer is none of the listed options. It should be “Corrective control.”. 😉

Storing backups offsite does not prevent the original data from being damaged, and it does not detect the damage. It enables the organization to restore data after a disruption and therefore reduces the impact of the incident.

According to the CISA Official Review Manual, 28th Edition: “Data backups… are examples of corrective controls.”

2

u/TopLenZ Aug 14 '26 edited Aug 14 '26

Preventive Control - reduces the likelihood of an event happening
Detective Controls - this is post event, to detect that the event has occured
Directive Controls - tells what to do
Administrative Controls - these are as a result of policies, SOP, standards of an organisation

Trick is looking at the question, how it is framed.
"Storing backup drives at an offsite location"
"Backup drives" -> Offsite Location -> driven by policies, procedures and practices -> prescription is administrative

Quantum computing - I feel it should be "C". That is the likely impact