Network Security Controls - Administrative Controls CCT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's business continuity plan (BCP) states that the order-processing system must be restored within 4 hours of a disruption. The disaster recovery plan (DRP) for the system includes restoring from backups. What is the relationship between the BCP and the DRP in this scenario?

   • AThe DRP defines the RTO, and the BCP provides the technical steps to meet it.
   • BThe BCP defines the recovery time objective (RTO), and the DRP provides the technical steps to meet it.
   • CThe BCP is only for natural disasters, and the DRP is only for cyberattacks.
   • DThe BCP and DRP are interchangeable and can be used for any disruption.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which scenario demonstrates separation of duties?

   • AOne administrator creates user accounts and another approves them
   • BA user is granted access to all files
   • COne administrator has full control over all systems
   • DA single person performs both development and production deployment
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A hospital's IT department is configuring access for a new group of nurses. Each nurse needs to view patient records for their assigned ward, update medication orders, but should not be able to access payroll or human resources systems. What is the most appropriate access control approach?

   • ACreate a role for ward nurses with permissions limited to patient records and medication orders
   • BGive nurses the same access as the hospital's IT administrators
   • CGrant each nurse full access to all hospital systems to avoid delays in patient care
   • DProvide temporary access to all systems and review permissions at the end of each month
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company's business continuity plan (BCP) identifies that its order-processing system must be restored within 4 hours of a disruption. The disaster recovery plan (DRP) for that system specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 30 minutes. What does the RPO of 30 minutes mean?

   • AThe system can be down for up to 30 minutes without affecting the business
   • BThe maximum acceptable amount of data loss is 30 minutes' worth of transactions
   • CThe system must be fully operational within 30 minutes of a disaster
   • DThe recovery team must be notified within 30 minutes of the disaster
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A small company has a single IT administrator who manages all user accounts, applies security patches, and reviews audit logs. The company is preparing for a compliance audit and wants to reduce the risk of unauthorized changes going undetected. Given the staffing constraint, which administrative control should the company implement first?

   • AImplement mandatory vacation and require another employee to review the administrator's access rights periodically.
   • BAssign the task of reviewing audit logs to a second employee, even if that employee has no technical IT role.
   • CEnable logging and configure alerts so that any changes to user accounts or audit logs trigger an immediate notification to the administrator.
   • DRequire the administrator to use a separate account for privileged tasks and a standard account for daily activities.
   Reveal Solution Discussion Select an answer first