A company has identified that its employees often leave their laptops unlocked when they step away. The security team wants to reduce the risk of unauthorized access to sensitive data. Which control would be most effective?

Install security cameras to monitor workspaces

Post signs reminding employees to lock their screens

Conduct a one-time security awareness session

Implement an automatic screen lock policy that activates after 5 minutes of inactivity

A company is implementing a new security policy that requires all employees to complete annual security training. The policy also mandates that employees use a password manager. Which classification best describes these controls?

Detective controls, because they monitor compliance

Technical controls, because they involve software

Administrative controls, because they involve policies and procedures

Physical controls, because they involve people

EC-CouncilAssociate C|CISO

Domain 2Objective 2

Security Control Types and Objectives ACCISO Practice Questions (Page 1)

Part of the Information Security Controls and Audit Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

4concepts

Questions 1–5

1application · medium
An organization implements a security awareness training program that includes simulated phishing emails. Employees who click the simulated links receive immediate feedback and additional training. Which control types does this program primarily represent?
Select an answer first
2application · medium
A company's security policy requires all employees to complete annual data-handling training. The training is delivered online and completion is tracked. Which control type is this?
Select an answer first
3application · medium
A company has identified that its employees often leave their laptops unlocked when they step away. The security team wants to reduce the risk of unauthorized access to sensitive data. Which control would be most effective?
Select an answer first
4expert · medium
A company is implementing a new security policy that requires all employees to complete annual security training. The policy also mandates that employees use a password manager. Which classification best describes these controls?
Select an answer first
5application · medium
A healthcare provider must ensure that patient records are accessible to authorized staff during a regional power outage. The provider installs backup generators and redundant network connections. Which security control objective is being addressed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Security Control Types and Objectives ACCISO Practice Questions (Page 1)

Questions 1–5

An organization implements a security awareness training program that includes simulated phishing emails. Employees who click the simulated links receive immediate feedback and additional training. Which control types does this program primarily represent?

A company's security policy requires all employees to complete annual data-handling training. The training is delivered online and completion is tracked. Which control type is this?

A company has identified that its employees often leave their laptops unlocked when they step away. The security team wants to reduce the risk of unauthorized access to sensitive data. Which control would be most effective?

A company is implementing a new security policy that requires all employees to complete annual security training. The policy also mandates that employees use a password manager. Which classification best describes these controls?

A healthcare provider must ensure that patient records are accessible to authorized staff during a regional power outage. The provider installs backup generators and redundant network connections. Which security control objective is being addressed?

Keep studying — Information Security Controls and Audit Management