Administrative Security Controls ECSS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of administrative security controls in an organization?

   • ATo install and configure firewalls and intrusion detection systems
   • BTo define and enforce the policies, procedures, and governance that guide security behavior
   • CTo encrypt data at rest and in transit
   • DTo physically secure server rooms and data centers
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A financial institution is required by regulation to conduct regular audits of user access to sensitive systems. The internal audit team has limited resources and cannot review every access log manually. The institution wants to ensure that audits are effective and efficient. Which approach best meets the regulatory requirement?

   • ARely on the IT department to self-audit and report any issues.
   • BImplement automated auditing tools that flag anomalous access patterns and generate reports for review.
   • CDisable logging for low-risk systems to reduce the volume of logs.
   • DConduct a manual review of a random sample of access logs each quarter.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A healthcare organization is subject to HIPAA and needs to ensure that employees understand their obligations regarding patient data. The organization has a detailed security policy, but employees rarely read it. Which administrative control would most effectively communicate the policy requirements to employees?

   • ACreate a detailed procedure manual for handling patient data and distribute it to department heads.
   • BRequire all employees to complete annual security awareness training that covers the policy and its practical application.
   • CPost the security policy on the company intranet and send a link to all employees.
   • DInclude the policy in the employee handbook and have new hires sign an acknowledgment.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company's security policy requires all servers to be configured according to a security baseline. However, a new business application requires a specific configuration that deviates from the baseline. The application is critical to operations. What is the best way to handle this situation?

   • ADocument the deviation, obtain approval from the security manager, and implement the configuration with compensating controls.
   • BConfigure the server according to the baseline and force the application to work with it.
   • CIgnore the baseline for this server because the application is critical.
   • DUpdate the baseline to match the application's requirements without further review.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A small accounting firm has only three employees: two accountants and one office manager. The office manager currently has full access to the accounting system, including the ability to create vendor records and issue payments. The firm wants to reduce the risk of fraud but cannot hire additional staff. Which approach BEST addresses the risk while respecting the staffing constraint?

   • AGive both accountants full access to create vendors and issue payments
   • BRely on the existing policy that prohibits fraud
   • CRemove the office manager's access to the accounting system entirely
   • DImplement compensating controls such as mandatory manager review of all payments and periodic audits
   Reveal Solution Discussion Select an answer first