1.4 - Document and Maintain Functional Security Controls SSCP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A financial institution is required by its internal policy to implement a hardware security module (HSM) for all cryptographic key storage. Due to a supply chain shortage, the HSM is backordered for six months. The security manager needs to maintain the security posture in the interim. Which of the following actions BEST represents a compensating control in this situation?

   • ADelay the project until the HSM is available, accepting the risk of unsecured keys.
   • BPurchase a second HSM from a different vendor to ensure availability.
   • CImplement a software-based key vault with strict access controls and audit logging until the HSM arrives.
   • DDocument the risk and request an exception from the board of directors.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important to document security controls?

   • ATo ensure that controls are implemented consistently and can be audited and reviewed
   • BTo make the controls more effective at stopping attacks
   • CTo satisfy legal requirements that all controls must be documented
   • DTo replace the need for regular testing of controls
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is responsible for maintaining the effectiveness of a network-based intrusion prevention system (IPS). During a quarterly review, they find that the IPS is not blocking a new type of malware that uses encrypted traffic. The team has limited resources and must decide on the best course of action. Which of the following actions BEST maintains the functional security control?

   • AIncrease the logging level of the IPS to capture more data about the malware.
   • BDisable the IPS and rely on the firewall to block the malware.
   • CUpdate the IPS signatures and enable SSL/TLS inspection to detect the encrypted malware.
   • DDocument the issue and defer action until the next quarterly review.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company experiences a ransomware attack that encrypts critical production files. The security team's incident response plan includes restoring data from backups and patching the vulnerability that was exploited. After the restoration, the team verifies that the backups were clean and the systems are operational. Which of the following BEST describes the actions taken by the security team?

   • ADeterrent controls, because they are discouraging attackers from targeting the company.
   • BDetective controls, because they identified the ransomware attack.
   • CCorrective controls, because they are remediating the impact of the incident and restoring operations.
   • DPreventative controls, because they are stopping future attacks.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software development company wants to reduce the likelihood of unauthorized access to its source code repository. The security team has implemented a policy that requires all employees to sign a confidentiality agreement and has placed visible security cameras in the office. Additionally, they have deployed a firewall to restrict access to the repository. Which of the following BEST describes the role of the confidentiality agreement and security cameras?

   • ACorrective controls, because they remediate the impact of unauthorized access.
   • BDeterrent controls, because they discourage employees from attempting unauthorized access.
   • CPreventative controls, because they physically stop unauthorized access.
   • DDetective controls, because they identify unauthorized access after it occurs.
   Reveal Solution Discussion Select an answer first