Security Control Types and Objectives CCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm is deploying a new customer-facing web application. The compliance team requires that all access to the application's administrative interface be logged and that any unauthorized access attempt trigger an immediate alert to the security operations center. The security architect must select a control that satisfies both requirements. Which control type should the architect implement?

   • AA preventive control that blocks all administrative access from non-corporate IP addresses
   • BA deterrent control that displays a warning banner before allowing access to the administrative interface
   • CA corrective control that automatically reverts any unauthorized changes made to the application configuration
   • DA detective control that records administrative logins and sends real-time alerts on failed authentication attempts
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   An organization implements a policy requiring all employees to change their passwords every 90 days. Which control implementation category does this policy belong to?

   • ACompensating
   • BAdministrative
   • CPhysical
   • DTechnical
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is implementing a new access control system. The risk assessment indicates that the risk of unauthorized access is high, and the company must comply with a regulation that requires multi-factor authentication (MFA) for all system access. The company has a limited budget. Which control selection best addresses the risk and regulatory requirement while being cost-effective?

   • ADeferring MFA implementation until the next fiscal year to save budget
   • BImplementing MFA only for administrative users, as they have the highest privileges
   • CImplementing MFA for all users, prioritizing critical systems first
   • DImplementing a strong password policy instead of MFA to reduce costs
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A company has a legacy application that cannot support multi-factor authentication (MFA). To compensate, the security team implements a VPN with MFA for remote access to the application. Which control type is the VPN with MFA?

   • ADirective control.
   • BDetective control.
   • CCorrective control.
   • DCompensating control.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company has a high rate of false positives from its intrusion detection system (IDS), causing alert fatigue. The CISO wants to improve detection effectiveness without increasing staff. Which control change would be most effective?

   • AReplace the IDS with a more expensive next-generation firewall (NGFW).
   • BDisable the IDS during peak hours to reduce noise.
   • CIncrease the number of alerts by enabling all signatures to ensure nothing is missed.
   • DTune the IDS signatures and implement a security information and event management (SIEM) system with correlation rules to reduce false positives.
   Reveal Solution Discussion Select an answer first