What does DDR stand for in the context of alternate access controls?

• A. Directly Deploy Rules
• B. Document, Decide, Reveal
• C. Detect, Delay and Response
• D. Deny, Detain, Release

Answer: (C)

DDR in the context of alternate access controls describes a defensive sequence: Detect, Delay, and Respond. This approach emphasizes three practical actions when an access attempt occurs.

First, Detect means the system continuously monitors for unauthorized or suspicious access attempts, triggering alerts or flags as soon as something unusual is noticed. This early awareness is crucial so the situation isn’t missed.

Second, Delay adds friction to the process. By slowing or delaying a potential breach—through additional authentication, locking mechanisms, or staged verification—the system buys time to verify legitimacy and reduce the chance of a successful, rapid intrusion.

Third, Respond involves taking action based on what was detected and delayed. This can mean denying access, activating alarms, notifying security personnel, locking down affected areas, or logging for later investigation.

This triad is the best fit because it describes an actionable, layered security response to access attempts, rather than simply applying rules, addressing governance, or following a punitive sequence that isn’t tied to real-time access control. The other options align more with policy deployment, governance steps, or a legalistic workflow, which don’t capture the practical defense-in-depth sequence of detection, delay, and response.