1.3 - Identify and Implement Security Controls SSCP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company wants to protect its internal network from unauthorized external access while also preventing unauthorized individuals from entering the building. Which set of controls addresses both requirements?

   • ADeploy a firewall at the network perimeter and install electronic locks on all exterior doors.
   • BImplement a virtual private network (VPN) for remote employees and enforce a strong password policy.
   • CPost security guards at the entrance and require multi-factor authentication for all system logins.
   • DInstall security cameras in the parking lot and implement an intrusion detection system (IDS) on the network.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An organization is implementing a new security policy that requires multi-factor authentication (MFA) for all remote access. The IT team is concerned about user resistance and productivity impact. Which approach best addresses these concerns while ensuring the policy is effective?

   • ADelay MFA implementation until users request it.
   • BImplement MFA only for users who have experienced security incidents.
   • CImplement MFA with a user-friendly method such as push notifications, and provide training and support.
   • DEnforce MFA immediately without prior communication to users.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is subject to the General Data Protection Regulation (GDPR) and is implementing a new customer database. The compliance team needs to ensure that the database design supports GDPR requirements. Which control is most directly required by GDPR?

   • AImplementing a clean desk policy.
   • BConducting a penetration test annually.
   • CImplementing data minimization, ensuring only necessary data is collected.
   • DInstalling a firewall to protect the database from network attacks.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   During a periodic audit, a security analyst discovers that several firewall rules are no longer needed because the associated business processes have been decommissioned. The analyst also finds that some rules were never approved. What is the most appropriate action?

   • ARemove all identified rules immediately to reduce the attack surface.
   • BKeep all rules in place until the next scheduled audit to avoid making changes without full analysis.
   • CRemove the unapproved rules immediately and schedule a review of the decommissioned rules with the business owners.
   • DDocument the findings and report them to management without making any changes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services firm is required to comply with a new data protection regulation. The compliance team needs to ensure that all employees follow the new requirements. Which administrative control is most appropriate to implement first?

   • AInstall new locks on the server room door.
   • BConduct a risk assessment to identify potential threats to data.
   • CUpdate the information security policy to reflect the new regulatory requirements.
   • DDeploy a data loss prevention (DLP) system to monitor data transfers.
   Reveal Solution Discussion Select an answer first