Which control activity does not involve direct protection-related actions?

Which control activity does not involve direct protection-related actions?

• A. Exercising a contingency plan
• B. Locking user accounts after failed logins
• C. Reviewing audit logs
• D. Moving backups to an offsite location

Answer: (B)

The correct response is that reviewing audit logs does not involve direct protection-related actions. This activity is primarily focused on monitoring and assessing security measures rather than actively thwarting potential security issues. By reviewing audit logs, an organization can analyze past access and system actions to detect any anomalies or suspicious behavior, which may indicate security breaches or vulnerabilities. In contrast, the other activities, such as locking user accounts after failed logins or exercising a contingency plan, involve proactive measures to secure information and systems against potential threats. Locking accounts as a response to failed login attempts directly helps to prevent unauthorized access, while executing a contingency plan is an immediate action taken to mitigate damage or provide alternatives during a security incident. Similarly, moving backups to an offsite location is a preventive strategy aimed at protecting critical data from loss or damage due to localized incidents. In summary, while all the activities are essential components of a security strategy, reviewing audit logs stands apart as a mostly analytical and evaluative process rather than a direct protective measure.

The correct response is that reviewing audit logs does not involve direct protection-related actions. This activity is primarily focused on monitoring and assessing security measures rather than actively thwarting potential security issues. By reviewing audit logs, an organization can analyze past access and system actions to detect any anomalies or suspicious behavior, which may indicate security breaches or vulnerabilities.

In contrast, the other activities, such as locking user accounts after failed logins or exercising a contingency plan, involve proactive measures to secure information and systems against potential threats. Locking accounts as a response to failed login attempts directly helps to prevent unauthorized access, while executing a contingency plan is an immediate action taken to mitigate damage or provide alternatives during a security incident. Similarly, moving backups to an offsite location is a preventive strategy aimed at protecting critical data from loss or damage due to localized incidents.

In summary, while all the activities are essential components of a security strategy, reviewing audit logs stands apart as a mostly analytical and evaluative process rather than a direct protective measure.