Security Control Types and Objectives CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is deciding between investing in a new SIEM system or hiring additional security analysts. The risk assessment shows that the company has a high volume of alerts but a low number of actual incidents. Which decision is most aligned with the risk assessment?

   • APurchase a threat intelligence feed to improve alert accuracy.
   • BInvest in the SIEM system with advanced correlation and alert prioritization to reduce false positives, allowing existing analysts to focus on real incidents.
   • CDisable all alerts except those for critical systems to reduce noise.
   • DHire additional analysts to manually review all alerts.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A retail company is subject to PCI DSS and has a limited budget. A risk assessment shows that the highest risk is cardholder data being stolen from a compromised web server. Which control should the company prioritize?

   • AIncrease the frequency of security awareness training for all employees.
   • BPurchase a new physical access control system for the data center.
   • CDeploy a honeypot to attract attackers and study their methods.
   • DImplement a web application firewall (WAF) and encrypt cardholder data in the database.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's security policy states that all employees must wear their ID badges at all times while in the office. This policy is an example of which control type?

   • APreventive control
   • BDirective control
   • CCorrective control
   • DDetective control
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A small business is selecting security controls for its customer database. The risk assessment shows that the data is not highly sensitive, but the business has limited budget. Which control selection approach is most appropriate?

   • AImplementing basic controls such as strong passwords, regular backups, and access controls, and revisiting as the business grows
   • BImplementing only the controls required by industry regulations, regardless of the risk assessment
   • CDeferring all security controls until a major incident occurs, to save money in the short term
   • DImplementing a full suite of advanced security controls, including SIEM and 24/7 monitoring, to ensure maximum protection
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An online banking platform must ensure that transactions cannot be repudiated by customers. The system currently uses two-factor authentication for login. The security team is considering additional controls. Which control would best enhance non-repudiation for transactions?

   • AImplementing a backup system that stores transaction records offsite
   • BImplementing a transaction monitoring system that flags unusual activity
   • CImplementing a detailed audit log that records transaction details and timestamps
   • DImplementing a digital signature for each transaction using the customer's private key
   Reveal Solution Discussion Select an answer first