Exin CITM Exam - Topic 8 Question 5 Discussion

Actual exam question for Exin's CITM exam

Question #: 5
Topic #: 8

A technical team investigating possible controls concludes that the most preferred control cannot be implemented as a result of too many constraints and decides to propose the second-best control. How is this control being referred to?

ADeterrent

BCompensating control

CDetective control

DCorrective control

Show Suggested Answer

Suggested Answer: B

A compensating control is an alternative control implemented when the preferred control cannot be applied due to constraints (e.g., technical, financial, or operational). According to frameworks like COBIT or ISO/IEC 27001, compensating controls provide equivalent or partial risk mitigation when the primary control is infeasible.

Deterrent controls (A) discourage violations, detective controls (C) identify incidents, and corrective controls (D) address issues after they occur. Only compensating control (B) fits the scenario of a second-best alternative due to constraints.

by Jolene at Aug 04, 2025, 09:53 PM

Limited Time Offer

25%

Off

Get Premium CITM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Glendora

7 months ago

Sounds a bit off, I’m not convinced it’s compensating.

upvoted 0 times

...

Margret

7 months ago

Wait, are we sure it's not corrective?

upvoted 0 times

...

Amber

7 months ago

Totally agree, compensating is the right term here.

upvoted 0 times

...

Jame

7 months ago

I thought it was a detective control?

upvoted 0 times

...

Bronwyn

8 months ago

It's definitely a compensating control!

upvoted 0 times

...

Lajuana

8 months ago

If the preferred control can't be implemented, it makes sense to go with a compensating control, but I hope that's the correct answer!

upvoted 0 times

...

Meghann

9 months ago

I'm a bit confused; I thought detective controls were more about identifying issues after they happen, not proposing alternatives.

upvoted 0 times

...

Matt

9 months ago

I remember practicing a question about controls, and I think the second-best option is often referred to as a compensating control.

upvoted 0 times

...

Yaeko

9 months ago

I think the term we're looking for is "compensating control," but I'm not entirely sure if that's the right choice.

upvoted 0 times

...

Ruth

9 months ago

The key here is that the team couldn't implement the preferred control due to constraints, so they had to go with the second-best option. That sounds like a compensating control to me.

upvoted 0 times

...

Krissy

9 months ago

I'm a little confused by the wording of this question. I'll need to re-read it a few times to make sure I understand what they're asking.

upvoted 0 times

...

Lilli

10 months ago

Okay, let's see. If the team couldn't implement the preferred control, then the second-best option must be a compensating control. I think that's the answer.

upvoted 0 times

...

Asha

10 months ago

Hmm, I'm a bit unsure about the difference between the control types here. I'll need to think this through carefully.

upvoted 0 times

...

Daron

10 months ago

This seems like a straightforward question about control types. I'm pretty confident I can figure this out.

upvoted 0 times

...

Shanice

10 months ago

Actually, I believe the correct answer is B) Compensating control because it helps to mitigate the risks when the preferred control cannot be implemented.

upvoted 0 times

...