Network Security Controls - Administrative Controls CCT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is security awareness training important for reducing human error?

   • AIt ensures that all employees become security experts
   • BIt teaches employees to recognize and avoid risky behaviors
   • CIt guarantees that no security incidents will occur
   • DIt eliminates the need for technical controls
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary role of administrative controls in an organization's security program?

   • ATo replace the need for technical security controls
   • BTo physically secure server rooms and data centers
   • CTo provide the framework for managing security through policies and procedures
   • DTo automatically enforce security rules on network devices
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which statement best describes administrative controls in network security management?

   • AThey are encryption protocols that protect data in transit.
   • BThey are hardware devices that filter traffic at the network perimeter.
   • CThey are software tools that detect and block malware on endpoints.
   • DThey are policies, procedures, and guidelines that govern human behavior and management processes.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial company is required to protect customer data under a new regulation. The risk team has identified that customer data is stored on a legacy server with weak encryption. They must decide how to treat this risk. The regulation requires that data be encrypted at rest, and the company has budget to upgrade the server. What is the most appropriate risk treatment?

   • AAvoid the risk by discontinuing the use of the legacy server immediately.
   • BMitigate the risk by upgrading the server and implementing strong encryption.
   • CTransfer the risk by purchasing cyber insurance.
   • DAccept the risk because the server is legacy and will be replaced soon.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is implementing a new financial system. The system will have three roles: 'accountant' who can create invoices, 'manager' who can approve invoices, and 'auditor' who can view all transactions. The company wants to ensure that no single user can create and approve an invoice. Which control should be implemented?

   • AAssign the accountant role the ability to approve invoices only when the manager is unavailable.
   • BGive the manager role the ability to create invoices as well, since they are higher up.
   • CAllow the auditor role to also create invoices to provide oversight.
   • DConfigure the system so that the accountant role cannot be assigned to the same user as the manager role.
   Reveal Solution Discussion Select an answer first