Network Security Controls - Administrative Controls CCT Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company's incident response team is responding to a suspected data breach. The team has identified the affected systems and is considering whether to disconnect them from the network. However, disconnecting the systems may destroy volatile evidence and disrupt business operations. What is the BEST course of action?

   • ALeave the systems running and continue normal operations to avoid disruption
   • BImmediately disconnect all affected systems to prevent further data loss
   • CReboot the systems to clear any malware from memory
   • DPreserve evidence by taking forensic images and collecting volatile data before disconnecting
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company is evaluating risk mitigation options for a legacy system that stores customer data. The system is outdated and cannot be patched. The company faces a choice: invest $100,000 to replace the system, or implement compensating controls that reduce the likelihood of exploitation but do not eliminate the risk. The risk assessment estimates a potential loss of $1,000,000 with a 20% annual likelihood if no controls are implemented. Which decision is MOST aligned with risk management principles?

   • AAccept the risk because the cost of replacement is too high
   • BImplement compensating controls because they are cheaper than replacement
   • CReplace the system because the annualized loss expectancy exceeds the cost of replacement
   • DTransfer the risk by purchasing cyber insurance without any other controls
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why are business continuity and disaster recovery considered administrative controls?

   • ABecause they are required by law in all countries
   • BBecause they are implemented using firewalls
   • CBecause they are automated by software
   • DBecause they involve management processes and planning
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company wants to ensure that all new Windows servers are configured with the same security settings, such as password policies, firewall rules, and patch levels. What should the company implement to achieve this consistency?

   • AA security procedure that describes how to install a server
   • BA security guideline that recommends optional settings for servers
   • CA security policy that states the company's commitment to security
   • DA security baseline that defines the minimum mandatory configuration for all servers
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the relationship between business continuity planning (BCP) and disaster recovery (DR)?

   • ABCP is only for natural disasters, DR is for cyber incidents
   • BBCP is a subset of DR
   • CThey are identical processes
   • DBCP focuses on maintaining operations during a disruption, while DR focuses on restoring IT systems after a disaster
   Reveal Solution Discussion Select an answer first