Administrative Security Controls ECSS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of security auditing?

   • ATo punish employees who violate policies
   • BTo design new security controls
   • CTo verify that security controls are implemented and effective
   • DTo replace the need for monitoring
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A small financial firm has a two-person IT team. The same administrator who creates user accounts also approves access requests and reviews audit logs. During a recent audit, the auditor flagged this arrangement as a control weakness. The firm wants to reduce the risk of unauthorized access without hiring additional staff. Which administrative control should the firm implement?

   • AIncrease the frequency of audit log reviews from monthly to weekly.
   • BDisable the administrator's ability to create accounts and assign that task to the helpdesk.
   • CRequire a second IT team member to review and approve all access requests before the administrator creates the account.
   • DHave the administrator self-certify quarterly that all access grants were appropriate.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the key difference between a security procedure and a security guideline?

   • AProcedures are optional, while guidelines are mandatory
   • BProcedures are mandatory step-by-step instructions, while guidelines are recommended practices
   • CProcedures are high-level statements, while guidelines are technical configurations
   • DProcedures are only for management, while guidelines are for all employees
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is an example of a regulatory requirement that administrative controls must address?

   • AGeneral Data Protection Regulation (GDPR)
   • BISO 27001
   • CNIST SP 800-53
   • DCIS Controls
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a common component of a security awareness program?

   • APhishing simulation exercises
   • BFirewall rule reviews
   • CServer patch management
   • DNetwork traffic analysis
   Reveal Solution Discussion Select an answer first