CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
A company posts a visible notice at every cloud application login screen stating that all user activity is logged, monitored, and subject to disciplinary or legal action if misused. The primary purpose of this notice is to discourage employees from attempting unauthorized actions. Which type of security control does this notice represent?
- ACorrective control
- BDeterrent control
- CPreventive control
- DDetective control
Show answer & explanationAnswer & explanation
Correct answer: B. Deterrent control
A deterrent control discourages undesirable behavior by warning of consequences, such as a monitoring notice, without technically blocking or detecting the action itself. It differs from preventive controls that block actions and detective controls that identify them after they occur.
Why the other options are wrong
- A. Corrective controls act after an incident to restore systems, which is unrelated to a login warning.
- C. Preventive controls actively block actions, such as firewalls, rather than simply warning users.
- D. Detective controls identify that an incident has occurred, such as SIEM alerts, not discourage behavior beforehand.
Deterrent Control
A security control designed to discourage potential attackers or policy violators by warning of consequences, rather than technically preventing or detecting the action.
- Relies on psychological discouragement, not technical blocking
- Examples include warning banners, visible cameras, and legal notices
- One of five main control types alongside preventive, detective, corrective, and compensating
Memory trick: PDCDC: Prevent, Detect, Correct, Deter, Compensate