CSC Security Controls & Compliance Implementation 2 — Questions and Answers
Question 1: An organization wants to implement compensating controls because a required technical control is not feasible. What must the compensating control demonstrate?
- It must be cheaper than the original control
- It must provide equivalent protection to the original required control (Correct answer)
- It must be approved by a third-party auditor before use
- It must be temporary and replaced within 90 days
Correct answer: It must provide equivalent protection to the original required control
Compensating controls must provide equivalent or greater protection than the original required control they replace.
Question 2: Which NIST SP 800-53 control family specifically addresses audit and accountability requirements?
- AC (Access Control)
- AU (Audit and Accountability) (Correct answer)
- CM (Configuration Management)
- IA (Identification and Authentication)
Correct answer: AU (Audit and Accountability)
The AU (Audit and Accountability) control family in NIST SP 800-53 addresses logging, audit record content, protection, and review requirements.
Question 3: A company undergoes a SOC 2 Type II audit. What distinguishes a Type II audit from a Type I audit?
- Type II covers more trust service criteria than Type I
- Type II evaluates controls over a period of time rather than at a single point in time (Correct answer)
- Type II is performed by internal auditors while Type I uses external auditors
- Type II only applies to cloud service providers
Correct answer: Type II evaluates controls over a period of time rather than at a single point in time
SOC 2 Type II audits assess the operational effectiveness of controls over an examination period (typically 6–12 months), while Type I assesses design at a point in time.
Question 4: Under PCI DSS Requirement 6, what is the primary focus for protecting cardholder data environments?
- Encrypting all stored cardholder data with AES-256
- Developing and maintaining secure systems and software (Correct answer)
- Restricting physical access to cardholder data
- Implementing multi-factor authentication for all users
Correct answer: Developing and maintaining secure systems and software
PCI DSS Requirement 6 focuses on developing and maintaining secure systems and software, including patch management and secure development practices.
Question 5: What is the purpose of a System Security Plan (SSP) in the federal compliance context?
- It authorizes a system to operate in a production environment
- It documents the security requirements and controls implemented for an information system (Correct answer)
- It provides the incident response procedures for a federal agency
- It defines the budget allocation for cybersecurity controls
Correct answer: It documents the security requirements and controls implemented for an information system
An SSP describes the security requirements of a system and documents how controls are implemented to satisfy those requirements, typically required by FISMA.
Question 6: An organization applies the principle of least privilege. Which scenario BEST illustrates this principle?
- All employees share a single administrative account for efficiency
- A developer is granted only read access to production database records needed for debugging (Correct answer)
- Managers receive full system access to oversee their team's work
- IT staff are given temporary root access whenever they request it
Correct answer: A developer is granted only read access to production database records needed for debugging
Least privilege means granting users only the minimum access rights needed to perform their job functions, as illustrated by read-only access scoped to necessary records.
Question 7: Which control type is BEST described as deterring a threat actor from attempting an attack?
- Detective control
- Corrective control
- Preventive control
- Deterrent control (Correct answer)
Correct answer: Deterrent control
Deterrent controls discourage threat actors from attempting attacks, such as warning banners, security cameras, or security guard presence.
CSC Security Controls & Compliance Implementation 2
An organization wants to implement compensating controls because a required technical control is not feasible.
What must the compensating control demonstrate?