Security Control Types and Objectives CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   A manufacturing company wants to protect its industrial control systems (ICS) from unauthorized physical access. The site already has perimeter fencing and security guards. The CISO wants to add a control that is primarily physical and preventive. Which option best fits?

   • ADeploy network intrusion detection systems (IDS) on the ICS network segment.
   • BInstall biometric access control systems on the doors to the ICS control room.
   • CConduct quarterly security awareness training for all plant employees.
   • DImplement a policy requiring all visitors to be escorted by authorized personnel.
   Reveal Solution Discussion Select an answer first
2. 27application · easy

   A company is required by a new regulation to implement multi-factor authentication (MFA) for all remote access. The current remote access solution only supports passwords. Which control should the company implement to meet the regulation?

   • AContinue using the current solution and document the risk in the risk register.
   • BImplement a compensating control such as IP-based access restrictions.
   • CDisable remote access entirely to avoid the requirement.
   • DDeploy a VPN that supports MFA and require all remote users to use it.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An e-commerce company wants to ensure that customers can trust that their orders have not been modified after placement. Which control objective and control type best address this?

   • AConfidentiality, using administrative detective controls such as access reviews.
   • BIntegrity, using technical preventive controls such as cryptographic hashes and digital signatures on order data.
   • CAvailability, using physical preventive controls such as redundant servers.
   • DNon-repudiation, using technical corrective controls such as audit logs.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has implemented a security information and event management (SIEM) system that collects logs from all servers and applications. The SIEM generates alerts for suspicious activities. However, the security team is overwhelmed by false positives. The CISO wants to improve the effectiveness of the SIEM. Which control type should be enhanced?

   • ADetective controls by tuning the SIEM correlation rules to reduce false positives
   • BDeterrent controls by displaying warnings to users about monitoring
   • CPreventive controls by adding more firewalls to block suspicious traffic
   • DCorrective controls by automating incident response playbooks
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A hospital is implementing a new patient portal. The CISO must balance patient privacy (confidentiality) with the need for emergency access to records (availability). The risk assessment shows that the biggest threat is unauthorized access by employees. Which control set best balances these objectives?

   • AUse strong encryption for all patient data and require two-factor authentication for all users.
   • BRestrict access to patient records to only the primary care physician and require a court order for any other access.
   • CImplement role-based access control (RBAC) with break-glass emergency access procedures and audit logging of all access.
   • DAllow all employees access to patient records to ensure availability, and rely on audits to detect misuse.
   Reveal Solution Discussion Select an answer first