Administrative Security Controls ECSS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following best describes a security standard?

   • AA mandatory rule or specification that must be followed
   • BA suggested approach that may be ignored if inconvenient
   • CA high-level statement of management intent
   • DA step-by-step checklist for a specific task
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of compliance requirements in administrative controls?

   • ATo replace the need for security policies
   • BTo ensure the organization meets legal and regulatory obligations
   • CTo make security optional
   • DTo reduce the cost of security
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of separation of duties as an administrative control?

   • ATo allow employees to share passwords for convenience
   • BTo prevent fraud and errors by requiring multiple people to complete critical tasks
   • CTo ensure that all employees have the same level of access
   • DTo reduce the number of security policies needed
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a key component of a change management process?

   • ADeletion of change logs after implementation
   • BPublic announcement of all changes
   • CRollback plan
   • DImmediate implementation without review
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security manager is designing a security awareness program. The organization has a high rate of phishing incidents, but employees complain that training is too time-consuming and not relevant. The manager has a limited budget. Which approach is MOST likely to improve employee behavior while respecting the constraints?

   • APost security posters in common areas
   • BDeliver short, frequent, role-specific training modules and conduct simulated phishing exercises with immediate feedback
   • CSend a monthly email newsletter with security tips
   • DRequire all employees to complete a full-day security training course annually
   Reveal Solution Discussion Select an answer first