A company is designing a new office building and wants to implement layered security. The security architect must decide where to place controls. Which combination of controls represents a layered approach that includes administrative, technical, and physical controls?

A fence around the building, a security camera, and a motion sensor

A firewall, an intrusion detection system, and a vulnerability scanner

A security guard at the entrance, a badge access system, and a policy requiring visitors to sign in

A password policy, a security awareness training, and an acceptable use policy

A financial services company is implementing a new customer portal. The compliance team requires that all customer data be encrypted in transit and at rest. The security team also wants to prevent unauthorized access to the portal. Which combination of controls should the security team implement to meet both requirements?

Physical preventive controls: biometric access to the server room and surveillance cameras.

Corrective controls: automated incident response playbooks and data restoration procedures.

Administrative detective controls: mandatory security awareness training and quarterly access reviews.

Technical preventive controls: TLS for data in transit, disk encryption for data at rest, and multi-factor authentication for portal access.

A financial institution is required to comply with a regulation that mandates encryption of customer data at rest. The institution also wants to ensure that data is available for business operations. The security team is evaluating controls. Which control selection best balances regulatory compliance and availability?

Implementing encryption only on backup tapes, leaving production data unencrypted

Implementing encryption but storing keys in the same server to avoid performance impact

Implementing full-disk encryption on all servers and storing encryption keys in a hardware security module (HSM)

Implementing encryption but disabling it during peak business hours to improve performance

An organization has implemented a security awareness training program that includes simulated phishing emails. Employees who click the simulated phishing link are automatically enrolled in additional training. Which control types are being used?

Administrative deterrent and corrective controls.

Physical preventive and deterrent controls.

Technical preventive and detective controls.

Compensating and directive controls.

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 2

Security Control Types and Objectives CCISO Practice Questions (Page 1)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 1–5

1expert · hard
A company is designing a new office building and wants to implement layered security. The security architect must decide where to place controls. Which combination of controls represents a layered approach that includes administrative, technical, and physical controls?
Select an answer first
2application · medium
A financial services company is implementing a new customer portal. The compliance team requires that all customer data be encrypted in transit and at rest. The security team also wants to prevent unauthorized access to the portal. Which combination of controls should the security team implement to meet both requirements?
Select an answer first
3expert · hard
A financial institution is required to comply with a regulation that mandates encryption of customer data at rest. The institution also wants to ensure that data is available for business operations. The security team is evaluating controls. Which control selection best balances regulatory compliance and availability?
Select an answer first
4application · medium
An organization has implemented a security awareness training program that includes simulated phishing emails. Employees who click the simulated phishing link are automatically enrolled in additional training. Which control types are being used?
Select an answer first
5foundation · easy
A digital signature is applied to an email message to prove that the sender cannot later deny having sent it. Which security objective does this primarily support?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Security Control Types and Objectives CCISO Practice Questions (Page 1)

Questions 1–5

A company is designing a new office building and wants to implement layered security. The security architect must decide where to place controls. Which combination of controls represents a layered approach that includes administrative, technical, and physical controls?

An organization has implemented a security awareness training program that includes simulated phishing emails. Employees who click the simulated phishing link are automatically enrolled in additional training. Which control types are being used?

A digital signature is applied to an email message to prove that the sender cannot later deny having sent it. Which security objective does this primarily support?

Keep studying — Information Security Controls and Audit Management