QUESTION: 317 Topic: 2, Security Operation Adimnistration

Which of the following is NOT an administrative control?

Logical access control mechanisms
Screening of personnel
Development of policies, standards, procedures and guidelines
Change control procedures

Answer(s): A

Explanation:

It is considered to be a technical control.
Logical is synonymous with Technical Control. That was the easy answer.
There are three broad categories of access control: Administrative, Technical, and Physical.
Each category has different access control mechanisms that can be carried out manually or automatically. All of these access control mechanisms should work in concert with each other to protect an infrastructure and its data.
Each category of access control has several components that fall within it, as shown here:
Administrative Controls
· Policy and procedures
· Personnel controls
· Supervisory structure
· Security-awareness training
· Testing
Physical Controls
Network segregation
Perimeter security
Computer controls
Work area separation
Data backups
Technical Controls
System access
Network architecture
Network access
Encryption and protocols
Control zone
Auditing
The following answers are incorrect :
Screening of personnel is considered to be an administrative control
Development of policies, standards, procedures and guidelines is considered to be an administrative control
Change control procedures is considered to be an administrative control. Reference : Shon Harris AIO v3 , Chapter - 3 : Security Management Practices , Page : 52-54

Reveal Solution Next Question

QUESTION: 318 Topic: 2, Security Operation Adimnistration

Which of the following is NOT a technical control?

Password and resource management
Identification and authentication methods
Monitoring for physical intrusion
Intrusion Detection Systems

Answer(s): C

Explanation:

It is considered to be a 'Physical Control'
There are three broad categories of access control: administrative, technical, and physical. Each category has different access control mechanisms that can be carried out manually or automatically. All of these access control mechanisms should work in concert with each other to protect an infrastructure and its data.
Each category of access control has several components that fall within it, a partial list is shown here. Not all controls fall into a single category, many of the controls will be in two or more categories. Below you have an example with backups where it is in all three categories:
Administrative Controls
Policy and procedures
- A backup policy would be in place
Personnel controls
Supervisory structure
Security-awareness training
Testing
Physical Controls
Network segregation
Perimeter security
Computer controls
Work area separation
Data backups (actual storage of the media, i:e Offsite Storage Facility)
Cabling
Technical Controls
System access
Network architecture
Network access
Encryption and protocols
Control zone
Auditing
Backup (Actual software doing the backups)
The following answers are incorrect :
Password and resource management is considered to be a logical or technical control.
Identification and authentication methods is considered to be a logical or technical control.
Intrusion Detection Systems is considered to be a logical or technical control. Reference : Shon Harris , AIO v3 , Chapter - 4 : Access Control , Page : 180 - 185

Reveal Solution Next Question

QUESTION: 319 Topic: 2, Security Operation Adimnistration

Which of the following is BEST defined as a physical control?

Monitoring of system activity
Fencing
Identification and authentication methods
Logical access control mechanisms

Answer(s): B

Explanation:

Physical controls are items put into place to protect facility, personnel, and resources. Examples of physical controls are security guards, locks, fencing, and lighting.
The following answers are incorrect answers:
Monitoring of system activity is considered to be administrative control.
Identification and authentication methods are considered to be a technical control.
Logical access control mechanisms is also considered to be a technical control.

Reference:

Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 1280- 1282). McGraw-Hill. Kindle Edition.

Reveal Solution Next Question

QUESTION: 320 Topic: 2, Security Operation Adimnistration

Which of the following is given the responsibility of the maintenance and protection of the data?

Data owner
Data custodian
User
Security administrator

Answer(s): B

Explanation:

It is usually responsible for maintaining and protecting the data.
The following answers are incorrect:
Data owner is usually a member of management , in charge of a specific business unit and is ultimately responsible for the protection and use of the information.
User is any individual who routinely uses the data for work-related tasks.
Security administrator's tasks include creating new system user accounts , implementing new security software.
References : Shon Harris AIO v3 , Chapter - 3: Security Management Practices , Pages : 99 - 103

Reveal Solution Next Question

Free SSCP Exam Braindumps (page: 81)

QUESTION: 317 Topic: 2, Security Operation Adimnistration

Explanation:

QUESTION: 318 Topic: 2, Security Operation Adimnistration

Explanation:

QUESTION: 319 Topic: 2, Security Operation Adimnistration

Explanation:

Reference:

QUESTION: 320 Topic: 2, Security Operation Adimnistration

Explanation:

SSCP Exam Discussions & Posts