3.4 Manage Risk Controls ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An organization deploys a security guard at the entrance of its data center to verify employee badges before allowing access. Which type of risk control does this represent?

   • APreventive control
   • BDirective control
   • CDetective control
   • DCorrective control
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has implemented a security control that requires all employees to change their passwords every 30 days. The control was intended to reduce the risk of credential compromise. However, a security assessment reveals that the frequent password changes are leading to weaker passwords and increased help desk calls. Which type of control would be a more effective alternative?

   • ACorrective control: automate password resets
   • BDetective control: increase log monitoring for failed logins
   • CPreventive control: implement multi-factor authentication
   • DDirective control: require longer passwords
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A healthcare organization has implemented a data loss prevention (DLP) solution to prevent the unauthorized transmission of patient records. To verify the control is effective, the security team conducts a series of test transmissions of dummy patient data to external email addresses, expecting the DLP to block them. The tests are successful, but the team wants to ensure the control remains effective over time. Which additional action best supports ongoing effectiveness?

   • AConduct the same test annually and compare results
   • BReview DLP logs monthly for false negatives and tune policies accordingly
   • CDisable the DLP after successful tests to reduce false positives
   • DReplace the DLP solution with a more expensive one
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which activity is an example of ongoing monitoring of risk control effectiveness?

   • AConducting a one-time vulnerability assessment of the network
   • BPerforming a risk assessment at the start of a new project
   • CReviewing access logs on a monthly basis to identify unauthorized access attempts
   • DImplementing a new firewall rule to block a specific IP address
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company's security team has completed a comprehensive control effectiveness assessment. The results show that the overall control effectiveness is 85%, but the coverage of cloud-based assets is only 60%. The CISO must present this to the board, which is concerned about the company's risk posture. Which presentation strategy would be most effective?

   • APresent the overall effectiveness score and downplay the coverage gap
   • BFocus on the controls that are working well to reassure the board
   • CPresent the coverage gap as a critical risk and propose a remediation plan
   • DDelay the report until the coverage gap is closed
   Reveal Solution Discussion Select an answer first