3.4 Manage Risk Controls ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm has implemented a compensating control for a missing segregation of duties in its payment processing system. The compensating control requires a manager to review and approve all transactions above $10,000. The compliance team wants to monitor the effectiveness of this control. Which metric would most directly indicate whether the compensating control is operating as intended?

   • APercentage of transactions above $10,000 that received manager approval
   • BNumber of system downtime incidents
   • CAverage transaction processing time
   • DTotal number of transactions processed in the system
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has implemented multiple controls for a single high-risk process: a preventive control (input validation), a detective control (audit logging), and a corrective control (automated rollback). During a coverage analysis, the security team finds that the detective control is not generating logs for certain edge cases. What is the most significant impact of this gap?

   • AThe coverage analysis is invalid because controls overlap
   • BThe preventive control may fail to stop attacks
   • CThe risk is fully covered by the other controls
   • DThe corrective control may not trigger when needed
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A company implements a compensating control to satisfy a security requirement because the primary control is not feasible in its current environment. What is the defining characteristic of a compensating control?

   • AIt provides an alternative means of meeting the security objective when the original control cannot be implemented
   • BIt is a control that is implemented after an incident to restore normal operations
   • CIt is a control that is required by law or regulation regardless of the organization's risk assessment
   • DIt is a control that detects and reports security violations after they occur
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A bank has implemented a control to detect fraudulent transactions by analyzing patterns. The control was initially effective, but over the past six months, the number of false positives has increased significantly, causing the fraud team to ignore alerts. The security manager needs to address this issue. Which action would best improve the control's ongoing effectiveness?

   • AIncrease the threshold for triggering alerts
   • BTune the detection algorithm based on recent fraud patterns
   • CRetrain the fraud team to pay more attention to alerts
   • DDisable the control until the false positive rate drops
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's security team has completed a control effectiveness assessment. The results show that a critical control is only 60% effective, meaning it fails to prevent a significant number of incidents. The CISO needs to communicate this to the IT operations team, which is responsible for implementing fixes. Which communication approach would be most effective?

   • ASend a detailed report to the IT operations manager
   • BSchedule a meeting to discuss the findings and agree on a remediation plan
   • CPost the results on the company intranet
   • DEscalate directly to the CEO
   Reveal Solution Discussion Select an answer first