Administrative Security Controls ECSS Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company has a business continuity plan (BCP) that was tested successfully last year. Since then, the company has migrated several critical applications to a cloud provider and has hired a new IT team. The BCP has not been updated. What is the most important reason to update and retest the BCP?

   • AThe new IT team needs to practice the BCP to feel more confident.
   • BThe BCP must be updated annually to satisfy regulatory requirements.
   • CThe cloud provider requires the BCP to be updated before they will renew the contract.
   • DThe BCP may no longer reflect the current infrastructure, dependencies, and personnel, so it may not work in a real disaster.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard · select all that apply

   A company has a high rate of employees falling for social engineering attacks, such as phishing emails and phone calls. The security team wants to implement a comprehensive security awareness program. Which two components are essential for an effective program? (Select all that apply.)

   • AA clear reporting procedure that employees can follow when they suspect a social engineering attempt.
   • BA policy that punishes employees who fall for phishing simulations.
   • CRegularly scheduled training sessions that include real-world examples and simulated attacks.
   • DA one-time mandatory training video for all new hires.
   • EA technical solution that automatically blocks all phishing emails.
   Check answers Discussion Select an answer first
4. 43foundation · easy

   Which document would provide the exact steps to follow when granting a new user access to the network?

   • ASecurity baseline
   • BSecurity procedure
   • CSecurity policy
   • DSecurity guideline
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An online retailer that processes credit card payments wants to ensure it meets industry requirements for protecting cardholder data. The company already has a general security policy but needs to implement specific technical and operational requirements. Which control should the company adopt?

   • ARely on the existing general security policy because it already covers data protection.
   • BConduct a one-time security audit and fix any issues found.
   • CAdopt the PCI DSS standard and implement its specific requirements for encryption, access control, and monitoring.
   • DRequire all employees to sign a confidentiality agreement.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A system administrator needs to apply a critical security patch to a production server. The change management policy requires that all changes be reviewed and approved before implementation. However, the patch addresses a vulnerability that is actively being exploited. What should the administrator do?

   • AApply the patch and then submit a change request after the fact.
   • BFollow the emergency change process, which allows expedited review and approval while still documenting the change.
   • CWait for the next scheduled change window, which is two weeks away.
   • DApply the patch immediately without any approval because the risk is too high.
   Reveal Solution Discussion Select an answer first