Network Security (NETSEC) 1 Practice Test

A countermeasure can both detect incidents and initiate remediation. Detective controls monitor for signs of compromise, while corrective controls restore systems to a secure state after an issue is found. When a tool automatically responds to a detection—such as isolating an infected host, blocking malicious traffic, or rolling back malicious changes—it performs both roles at once. For example, endpoint detection and response solutions can identify malware activity and automatically quarantine the affected device, or an intrusion prevention system can detect malicious traffic and block it in real time to stop the attack and return the network to a safe state. This demonstrates that a countermeasure can be both detective and corrective. It’s not merely theoretical; many real-world security tools blend detection with automated remediation, though policy can guide what actions are permissible and when automatic responses are allowed.