Certified Ethical Hacker (CEH) Practice Question

Security controls are commonly grouped by both their functional goal (preventive, detective, corrective, deterrent, compensating, or recovery) and their nature (administrative, technical, or physical). An intrusion detection system does not block traffic by itself; instead, it monitors activity and notifies administrators when suspicious patterns are detected. Its purpose is therefore to discover or detect an event after it has begun. Because the capability is implemented through technology (network sensors, analysis engines, alerting software), it is classified as a technical rather than administrative or physical measure. Consequently, a NIDS is considered a detective technical control. The other choices misclassify the control either by function (preventive, corrective, deterrent) or by nature (physical, administrative).