After a recent ransomware attack on a company's system, an administrator reviewed the log

files. Which of the following control types did the administrator use?

A$.$ Compensating

B$.$ Detective

C$.$ Preventive

D$.$ Corrective

Answer is detective, can you please explain why its detective? I think already attack has been detected right? Now they will be in corrective phase