ISC2 Certified in Cybersecurity (CC) Practice Question

Security controls are the practical safeguards or countermeasures that organizations implement to prevent, detect, or reduce security risks. They can be technical, administrative, or physical, but they always act directly on the risk itself. A policy sets management intent but is not the control. A vulnerability list is part of risk identification, not a safeguard. An audit checks compliance after the fact; it does not itself mitigate risk. Therefore, only the statement describing a safeguard or countermeasure that avoids, detects, counteracts, or lessens risk accurately defines a security control.