1.3 - Identify and Implement Security Controls SSCP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company wants to detect and respond to network intrusions in real time. The security team is considering implementing an intrusion detection system (IDS). Which additional control should be implemented to enable an automated response to detected intrusions?

   • APhysical access control system
   • BSecurity awareness training
   • CIntrusion prevention system (IPS)
   • DData backup solution
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A healthcare organization is implementing a new patient records system. The compliance officer needs to ensure the system meets regulatory requirements for protecting patient data. Which initial step should the organization take to assess its compliance obligations?

   • APurchase a commercial security information and event management (SIEM) tool to monitor all system activity.
   • BDevelop a set of internal security standards based on industry best practices.
   • CConduct a penetration test to identify vulnerabilities in the new system.
   • DIdentify all applicable laws and regulations, such as HIPAA, and map them to specific system requirements.
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   A company wants to restrict access to a sensitive database to only authorized personnel. The database administrator has created a list of allowed IP addresses. Which type of control is the administrator implementing?

   • ACompensating control using a firewall
   • BTechnical control using an access control list (ACL)
   • CAdministrative control using a security policy
   • DPhysical control using a lock on the server room
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization has implemented a security awareness training program. Management wants to verify that the training is effective and that employees are applying the knowledge. Which control should be used to evaluate the program's effectiveness?

   • AConduct periodic phishing simulation tests and track employee response rates.
   • BReview the training completion certificates for all employees.
   • CInstall a spam filter on the email server.
   • DPublish a new security policy on the company intranet.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a physical security control?

   • AA security policy that defines acceptable use of company assets
   • BAn access control list that specifies which users can read a file
   • CA firewall that filters incoming network traffic
   • DA mantraps that prevents tailgating by allowing only one person to enter at a time
   Reveal Solution Discussion Select an answer first