Theprimary goal of corrective controls in financial systems is to ensure that errors do not propagate across interconnected systems. Financial transactions are ofteninterdependent, meaning one incorrect or unauthorized change can affect multiple systems. Regulations often mandate these controls tomaintain accuracy and prevent cascading failures.
A (insider threats altering banking details)is a concern, but thisscenario focuses on corrective controls, not insider threats specifically.
C (business insurance)is unrelated to why corrective controls are implemented.
D (preventing unauthorized changes)falls underpreventive, notcorrectivecontrols.
Reference:CompTIA Security+ SY0-701 Official Study Guide, Security Program Management and Oversight domain.

Firmware is a type of software that is embedded in hardware devices, such as BIOS, routers, printers, or cameras. Firmware controls the basic functions and operations of the device, and can be updated or patched to fix bugs, improve performance, or enhance security. Firmware vulnerabilities are flaws or weaknesses in the firmware code that can be exploited by attackers to gain unauthorized access, modify settings, or cause damage to the device or the network. A BIOS update is a patch that addresses a firmware vulnerability in the basic input/output system of a computer, which is responsible for booting the operating system and managing the communication between the hardware and the software. The other options are not types of vulnerabilities, but rather categories of software or technology.

When a legacy device is no longer receiving updates or patches, it is considered to be at the end of life (EOL)
. This means the manufacturer has ceased support for the device, and it will no longer receive updates, security patches, or technical assistance. EOL devices pose security risks and are often decommissioned or replaced.
* End of support may seem similar but typically refers to the cessation of technical support, whereas EOL means the device is fully retired.
* End of business and End of testing do not apply in this context.

The best answer is A. To ensure data is securely destroyed when no longer needed.
During asset decommissioning, organizations must handle storage media and data according to established data retention policies. These policies define how long data must be kept and when it should be securely destroyed. Following them helps ensure that data is not kept longer than necessary and is properly sanitized or destroyed when retention requirements have been met.
This is important for:
reducing risk of unauthorized data exposure
meeting legal and regulatory obligations
preventing sensitive information from being recovered from retired assets limiting unnecessary storage and liability Why the other options are incorrect:
B). To make backup copies of all company data before disposing of hardwareNot all data should be backed up indefinitely. Retention policies are about keeping data only as long as required.
C). To allow employees to access old files even after the hardware is recycledThis is not the primary purpose of retention policies during decommissioning.
D). To keep all customer data available in case it is required in the futureKeeping all data forever is not a proper retention strategy and can create legal and security problems.
From the SY0-701 perspective, asset disposal and media sanitization are closely tied to retention schedules and secure destruction practices, so A is the correct answer.