Security Control Types and Objectives ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's risk assessment shows that a critical database is vulnerable to SQL injection. The development team is asked to implement parameterized queries and input validation. Which control type is being applied?

   • ACompensating control
   • BCorrective control
   • CPreventive control
   • DDetective control
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is designing a new data center. The security architect must protect the facility from both physical intrusion and fire. The budget allows for only one major investment. Which control should be prioritized to address the most critical risk?

   • AInstall an automated fire suppression system
   • BInstall biometric access controls at all entrances
   • CHire additional security guards
   • DConduct a risk assessment to determine the most critical threat
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A multinational corporation is implementing a new access control system. The security team must balance the need for strong authentication (confidentiality) with user convenience. They are considering a risk-based authentication system that requires MFA only for high-risk transactions. Which control type best describes this system?

   • ADeterrent control, because it discourages attackers
   • BPreventive control, because it stops unauthorized access before it occurs
   • CCorrective control, because it responds to risk by requiring additional authentication
   • DDetective control, because it monitors user behavior
   Reveal Solution Discussion Select an answer first
5. 29application · easy

   A university is implementing a security awareness training program for all faculty and staff. The training teaches employees how to recognize phishing emails and report them. How should this control be classified?

   • APhysical deterrent control
   • BAdministrative preventive control
   • CTechnical detective control
   • DCorrective control
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A retail company has a legacy application that does not support multi-factor authentication (MFA). The security team wants to reduce the risk of account takeover. They decide to implement a third-party identity proxy that enforces MFA before allowing access to the application. Which type of security control is this proxy?

   • ADetective control, because it monitors and logs authentication attempts
   • BDirective control, because it directs users to use MFA
   • CDeterrent control, because it discourages attackers from attempting to access the system
   • DCompensating control, because it provides an alternative control to meet the security requirement that the application cannot natively enforce
   Reveal Solution Discussion Select an answer first