OCEG GRCA Exam - Topic 1 Question 19 Discussion

Actual exam question for OCEG's GRCA exam

Question #: 19
Topic #: 1

[All GRCA Questions]

The two kinds of PROACTIVE controls are

Atraining and education

Bpromoting and preventive

Caccess and system

Show Suggested Answer

Suggested Answer: B

Proactive controls are those measures implemented to prevent undesirable events before they occur. Promoting controls are designed to encourage desired behaviors and outcomes, such as compliance with policies and procedures. Preventive controls are aimed at stopping undesirable events or actions before they happen, such as implementing security measures to prevent unauthorized access. Both types of controls are essential for effective risk management and ensuring the security and integrity of an organization's processes and systems. Reference:

COSO Internal Control -- Integrated Framework

ISO/IEC 27002:2013 - Information technology - Security techniques - Code of practice for information security controls

by Joana at Nov 23, 2025, 05:59 PM

Limited Time Offer

25%

Off

Get Premium GRCA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Launa

9 hours ago

Wait, are there really only two kinds?

upvoted 0 times

...

Tawanna

6 days ago

I thought it was B) promoting and preventive.

upvoted 0 times

...

Jess

11 days ago

A) training and education is definitely one!

upvoted 0 times

...

Roy

16 days ago

I'm going with B. Promoting and preventive controls just make the most sense for being proactive.

upvoted 0 times

...

Marti

21 days ago

Haha, I bet the exam writer was feeling punny when they came up with these options.

upvoted 0 times

...

Ruth

26 days ago

Training and education are important, but I don't think they're considered PROACTIVE controls.

upvoted 0 times

...

Nichelle

1 month ago

Access and system controls seem more like REACTIVE controls to me.

upvoted 0 times

...

Paul

1 month ago

I think the answer is B) promoting and preventive.

upvoted 0 times

...

Colette

1 month ago

I thought access and system controls were more reactive. I need to double-check what proactive controls really include.

upvoted 0 times

...

Jacquline

2 months ago

I remember something about promoting and preventive controls from practice questions, but I can't recall the details.

upvoted 0 times

...

Van

2 months ago

I feel like training and education are definitely part of proactive controls, but I'm not sure if that's the only kind.

upvoted 0 times

...

Jordan

2 months ago

I think proactive controls are about preventing issues before they happen, but I can't remember the exact types.

upvoted 0 times

...

Myra

2 months ago

I'm a little confused on the difference between the options. I'll have to review my notes to make sure I understand proactive controls before answering this.

upvoted 0 times

...

Willard

2 months ago

I remember discussing the two types of proactive controls in class. I'm pretty confident B is the right answer here.

upvoted 0 times

...

Carri

2 months ago

Okay, let me break this down. Proactive controls are about preventing issues before they happen, so B seems like the best fit. I'll mark that down for now.

upvoted 0 times

...