CAS-004 Security Architecture Practice Question
A security architect is implementing defense-in-depth for a critical application. Which of the following is an example of a detective control?
⚠ Common exam trap
Watch out — candidates often confuse preventive controls (encryption, ACLs, firewalls) with detective controls (IDS), as candidates often assume any security tool that 'protects' is detective, when in fact only monitoring/alerting tools qualify.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intrusion detection system
An intrusion detection system (IDS) is a detective control because it monitors network or host activity and generates alerts when it identifies suspicious or malicious behavior, allowing security teams to respond. Detective controls are designed to identify and log incidents after or during their occurrence, rather than preventing them outright. Encryption, ACLs, and firewalls are preventive controls that stop unauthorized access or protect data before an incident occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data encryption
Why it's wrong here
Encryption is a preventive control: it stops unauthorised reading of data rather than detecting an incident in progress. It is tempting because encryption is central to defense-in-depth, but detective controls such as IDS or audit logging identify and alert on activity that has already occurred.
- ✗
Access control list
Why it's wrong here
An access control list is a preventive control, permitting or denying traffic and requests before they succeed. It is tempting because ACLs are foundational to layered defence, yet they generate no alerting or logging of malicious activity; detective controls such as IDS or SIEM monitoring do that.
- ✗
Firewall
Why it's wrong here
A firewall is a preventive control, blocking or allowing traffic according to policy before it reaches the application. It is tempting because firewalls are a core defense-in-depth layer, but they do not detect and alert on intrusions; detective controls such as IDS or log analysis perform that function.
- ✓
Intrusion detection system
Why this is correct
An intrusion detection system monitors network or host activity and raises alerts on malicious patterns, which is detection after the fact rather than prevention. That matches the detective control requirement, unlike firewalls or access controls, which block activity and are preventive.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.