Administrative Security Controls ECSS Practice Questions (Page 12)

Questions 56–59

1. 56expert · hard

   A mid-sized company has a finance department where the same employee is responsible for both issuing purchase orders and approving vendor invoices for payment. The company has a policy requiring separation of duties, but the finance manager argues that the current arrangement is necessary because the department is understaffed. The company wants to reduce the risk of fraudulent payments without hiring additional staff. Which approach best balances the policy requirement with the staffing constraint?

   • ARequire the employee to self-certify monthly that all transactions were legitimate.
   • BImplement a compensating control where the finance manager reviews and approves all vendor invoices above a certain threshold.
   • CDisable the employee's ability to issue purchase orders and have the IT department do it.
   • DAllow the current arrangement to continue because the employee has been with the company for many years and is trusted.
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A company's security policy requires all servers to be hardened, but the IT team has been configuring each server differently based on the administrator's personal preference. This has led to inconsistent security configurations. The company wants to ensure all servers meet a minimum security level. Which control should be implemented?

   • ADevelop a security baseline document that specifies mandatory configuration settings for all servers.
   • BRequire each administrator to document their own configuration choices in a personal notebook.
   • CSchedule a monthly meeting to discuss server configurations and share best practices.
   • DAsk the most experienced administrator to configure all servers going forward.
   Reveal Solution Discussion Select an answer first
4. 58expert · hard

   A company's change management policy requires all changes to be reviewed by a change advisory board (CAB) before implementation. A network engineer needs to update a firewall rule to fix a connectivity issue that is affecting a critical business application. The CAB meets only once a week, and the next meeting is in five days. The business cannot wait that long. What is the best course of action?

   • AImplement the change immediately and inform the CAB at the next meeting.
   • BAsk the network engineer to make the change and then reverse it after the CAB meeting if not approved.
   • CWait for the next CAB meeting and explain the delay to the business.
   • DUse the emergency change process to get expedited approval from the CAB chair and document the change thoroughly.
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A retail company has experienced multiple phishing incidents where employees clicked on malicious links in emails. The security team wants to reduce the likelihood of successful phishing attacks. Which administrative control would be most effective as a first step?

   • ADisable email links and require employees to type URLs manually.
   • BIncrease the frequency of password changes for all employees.
   • CImplement a security awareness training program that includes simulated phishing exercises and regular updates.
   • DPurchase an advanced email filtering solution that blocks all phishing emails.
   Reveal Solution Discussion Select an answer first