1.3 - Understand Security Controls CC Practice Questions (Page 3)

Questions 11–12

1. 11application · medium

   A hospital is updating its security program. The CISO mandates that all staff complete a phishing-awareness course before receiving network credentials. The IT team simultaneously deploys an email gateway that quarantines suspicious messages. Which statement best describes the relationship between these two controls?

   • ABoth are administrative controls because they are mandated by the CISO.
   • BThe training is technical; the email gateway is administrative, and they are redundant.
   • CThe training is physical; the email gateway is technical, and they are conflicting.
   • DThe training is administrative; the email gateway is technical, and they provide defense in depth.
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A company's security team is implementing a data loss prevention (DLP) solution that scans outbound emails for sensitive data and blocks them if they contain credit card numbers. The team also updates the employee handbook to include a section on proper handling of customer data. Which statement accurately describes the DLP solution?

   • AIt is an administrative control that enforces the employee handbook.
   • BIt is a detective control that only alerts after data is sent.
   • CIt is a technical control that prevents data exfiltration.
   • DIt is a physical control that protects the email server.
   Reveal Solution Discussion Select an answer first