Network Security Controls - Administrative Controls CCT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company has a high rate of employees falling for phishing emails. The security team has already implemented mandatory annual security awareness training, but the click rate has not improved. The team has a small budget and wants to try a new approach. Which approach is most likely to reduce the click rate?

   • ADisable all email links and require employees to type URLs manually.
   • BReplace the training with a one-time, highly detailed security awareness presentation.
   • CImplement a phishing simulation program that sends fake phishing emails and provides immediate feedback to employees who click.
   • DIncrease the frequency of training to quarterly sessions.
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A company's management wants to reduce security risks that arise from employee behavior, such as tailgating and sharing passwords. They are considering implementing administrative controls. Which of the following is an example of an administrative control?

   • AImplementing a security awareness training program for all employees
   • BDeploying a firewall to filter network traffic
   • CUsing encryption to protect data at rest
   • DInstalling a badge reader at the entrance to the data center
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A small company has two IT administrators. One administrator is responsible for creating user accounts and assigning permissions, and the other is responsible for reviewing access rights and approving changes. The company wants to implement separation of duties to prevent unauthorized access. However, the two administrators sometimes need to cover for each other during vacations. What is the best way to maintain separation of duties while allowing coverage?

   • AAllow each administrator to perform the other's duties during vacation, but require a manager to review the changes afterward.
   • BCross-train a third employee to perform one of the roles, so that no single administrator performs both roles.
   • CHave the two administrators share a single account and coordinate their tasks.
   • DEliminate the review role and rely on logging to detect unauthorized changes.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is developing its business continuity plan (BCP) and disaster recovery plan (DRP). The company has identified that its customer relationship management (CRM) system is critical and must be restored within 8 hours of a disaster. The current backup strategy takes 12 hours to restore the system. What is the MOST appropriate action?

   • AIgnore the RTO and focus on the RPO
   • BAccept the current backup strategy because the system is not that critical
   • CRevise the RTO to 12 hours to match the current backup capability
   • DImplement a faster backup and recovery solution that can restore the system within 8 hours
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a security policy that requires all employees to use strong passwords. The IT team has created a document that explains the importance of strong passwords and provides tips for creating them, but it does not mandate specific requirements. What type of document is this?

   • AA security guideline, because it offers recommendations without being mandatory.
   • BA security procedure, because it explains how to create strong passwords.
   • CA security baseline, because it defines the minimum password requirements.
   • DA security standard, because it provides best practices for password creation.
   Reveal Solution Discussion Select an answer first