SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Preventive and detective, because one measure blocks access and the other identifies suspicious activity.

  Why this is correct

  Requiring a badge and PIN is preventive because it attempts to stop unauthorized entry before it happens. Reviewing access logs is detective because it helps identify misuse or attempted misuse after the fact. Together, these controls reduce the likelihood of unauthorized entry while also giving the security team visibility into failed or unusual access attempts. This is a practical layered approach.

• ✗

  Corrective and recovery, because the logs can restore access after a badge failure.

  Why it's wrong here

  Corrective and recovery controls are designed to restore the system or data to a known good state after a security incident, such as rebuilding a compromised server or restoring from backup. Merely reviewing access logs after a badge failure neither repairs damage nor returns the system to operational status; instead, log analysis is a detective function because it reveals suspicious activity or failures after they have occurred. The scenario describes a failure of authentication, not an active compromise, and logs cannot reverse or remediate that event.

• ✗

  Deterrent and compensating, because the PIN discourages attackers and the logs replace the badge reader.

  Why it's wrong here

  A deterrent control aims to discourage an attacker through the perception of consequences, such as warning signage or visible cameras; the PIN is not primarily a deterrent because it is a knowledge-based authentication factor that directly enforces access control. A compensating control provides an alternative security measure when the primary control cannot be implemented, but access logs do not replace the function of the badge reader—they only record the events that the badge reader processes. The logs are detective, not compensating, because they provide visibility into activity rather than substituting for physical access enforcement.

• ✗

  Administrative and physical, because the weekly review and the badge reader are both physical measures.

  Why it's wrong here

  This option confuses the type of control (administrative, physical, technical) with the function of the control (preventive, detective, corrective). The weekly review of access logs is an administrative control—a policy-driven procedure —but its function is detective because it identifies suspicious patterns or unauthorized attempts, not because it uses a physical device. The badge reader and PIN are physical/technical preventive controls that block entry; labeling both as 'physical' because the badge reader is hardware ignores the fact that the review is a managerial, log-based oversight activity.

Go deeper

Related to this question