Security Control Types and Objectives ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company's security policy states that all sensitive data must be encrypted at rest and in transit. The IT team implements full-disk encryption on laptops and requires HTTPS for all web traffic. Which control types are these?

   • ADeterrent and compensating
   • BAdministrative and detective
   • CPhysical and corrective
   • DTechnical and preventive
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A healthcare organization is deploying a new patient-record system. The compliance officer requires that all access to patient records be logged and that any unauthorized access be detected quickly. The system must also ensure that records cannot be altered without detection. Which security control objective is the compliance officer primarily emphasizing?

   • ANon-repudiation, because the requirement focuses on proving who accessed the records
   • BIntegrity, because the requirement focuses on detecting unauthorized changes to records
   • CConfidentiality, because the requirement focuses on preventing unauthorized access
   • DAvailability, because the requirement focuses on ensuring records are accessible when needed
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A bank is required by regulation to implement segregation of duties. However, due to a small team, one employee must perform two conflicting tasks. The bank implements a mandatory peer-review process for that employee's work. Which type of control is the peer-review process?

   • ADirective control
   • BPreventive control
   • CDeterrent control
   • DCompensating control
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A cloud service provider wants to assure its customers that their data is protected from unauthorized access. The provider implements encryption for data at rest and in transit. Which security control objective is the provider primarily addressing?

   • AIntegrity
   • BConfidentiality
   • CNon-repudiation
   • DAvailability
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A hospital's IT team discovers that a legacy medical device cannot be patched and has a known critical vulnerability. The device must remain online for patient monitoring. The team decides to isolate the device on a separate network segment and restrict all inbound and outbound traffic except to the monitoring station. Which control type is the team primarily applying?

   • ACompensating control
   • BDeterrent control
   • CCorrective control
   • DDetective control
   Reveal Solution Discussion Select an answer first