3.3 - Select Controls Based Upon Systems Security Requirements CISSP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An organization implements an intrusion detection system (IDS) to monitor network traffic for suspicious activity. This is an example of which control category and type?

   • ATechnical and detective
   • BPhysical and corrective
   • CTechnical and preventive
   • DAdministrative and detective
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a cost-benefit analysis of security controls, what does the term 'safeguard value' refer to?

   • AThe total cost of ownership of the control
   • BThe reduction in risk achieved by implementing the control
   • CThe market value of the security software
   • DThe cost of implementing the control
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A small business is considering a new security control to protect its customer database. The control has a high upfront cost but is expected to reduce the likelihood of a data breach by 80%. The business has a limited budget and must justify the expense. Which analysis should the business perform to determine if the control is worth the cost?

   • ACalculate the annualized loss expectancy (ALE) before and after implementing the control.
   • BCompare the control's cost to the cost of a single data breach.
   • CImplement the control if it is the most secure option available.
   • DAsk the vendor for a return on investment (ROI) estimate.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is an example of validating a security control?

   • ADocumenting the firewall's placement in the network architecture
   • BReviewing the configuration settings of a firewall to ensure they match the security policy
   • CChecking that the firewall software version is up to date
   • DConducting a penetration test to see if the firewall effectively blocks unauthorized access
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following best describes the initial step in the security control selection process?

   • AIdentifying and documenting the system's security requirements from business needs, risk assessments, and compliance obligations
   • BEvaluating the cost and operational impact of each candidate control
   • CSelecting controls from a predefined catalog based on the system's categorization
   • DImplementing the controls and verifying they work as intended
   Reveal Solution Discussion Select an answer first