1.4 - Document and Maintain Functional Security Controls SSCP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary function of a detective control?

   • ATo remediate or reduce the impact of a security incident
   • BTo discourage potential attackers by increasing the perceived risk of being caught
   • CTo identify and report security incidents after they occur
   • DTo proactively stop security incidents from occurring
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team has implemented a host-based intrusion detection system (HIDS) on all employee laptops. The HIDS is configured to send alerts to the security operations center (SOC) when suspicious activity is detected. During a review, the team finds that the HIDS is not sending alerts for a new type of malware. Which of the following is the MOST appropriate action to maintain the detective control?

   • ADisable the HIDS to prevent false alerts.
   • BUpdate the HIDS signatures and rules to include the new malware indicators.
   • CIncrease the frequency of log reviews to catch the malware manually.
   • DReplace the HIDS with a firewall to block the malware.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a deterrent control?

   • AA backup restoration procedure that recovers data after a ransomware attack
   • BA firewall rule that blocks unauthorized inbound traffic
   • CA prominent sign stating that all activities are monitored and violators will be prosecuted
   • DAn intrusion detection system that alerts administrators to suspicious activity
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following best describes the primary purpose of a deterrent control?

   • ATo detect and report an ongoing security incident in real time
   • BTo discourage potential attackers by making the cost or risk of an attack appear higher than the potential benefit
   • CTo restore systems to a secure state after an incident has occurred
   • DTo physically block or prevent an attack from succeeding
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security administrator is documenting the controls for a new customer relationship management (CRM) system. The documentation must include the purpose of each control, how it is implemented, and who is responsible for maintaining it. Which of the following is the MOST important reason for this documentation?

   • AIt provides a reference for auditors and ensures controls are consistently understood and maintained.
   • BIt allows the security team to remove controls that are not working.
   • CIt ensures that all controls are preventative in nature.
   • DIt guarantees that no security incidents will occur.
   Reveal Solution Discussion Select an answer first