Timedora
Free Practice Quiz Question List

3 Security Controls and Defense in Depth Online Quiz Questions

Use this free practice quiz with 20 questions to review 3 Security Controls and Defense in Depth, test your knowledge, and prepare for your next test or exam.

20 questions
01
True or false
1 point

Security controls are safeguards that reduce risk to information, systems, or operations and help support confidentiality, integrity, and availability. True or false?

  1. A

    True

  2. B

    False

02
Choose one
1 point

An organization trains employees to recognize security risks and follow its security procedures. Which control category best describes the training?

  1. A

    Technical

  2. B

    Administrative

  3. C

    Corrective

  4. D

    Physical

03
Choose one
1 point

A company requires multifactor authentication before employees can access its systems. Which control category best describes this safeguard?

  1. A

    Technical

  2. B

    Administrative

  3. C

    Physical

  4. D

    Corrective

04
Fill in the blank
1 point

Least-privilege permissions aim to reduce the likelihood of unauthorized actions. They are controls.

05
Choose one
1 point

A security team discovers that an account has been compromised and disables it to limit further harm. Which control function best describes this action?

  1. A

    A preventive control

  2. B

    A corrective control

  3. C

    A physical control

  4. D

    An administrative control

06
Choose all
1 point

Select all the detective controls in this list.

  1. A

    Reviewing audit logs for suspicious activity

  2. B

    Restoring operations from clean backups after an incident

  3. C

    Using intrusion alerts to identify possible attacks

  4. D

    Investigating and containing an alert

  5. E

    Using door-access alarms to alert staff to entry events

07
True or false
1 point

If an organization uses several layers of security controls, it is guaranteed that a serious security loss cannot occur. True or false?

  1. A

    True

  2. B

    False

08
Written response
1 point

What term describes the risk that remains after an organization applies security controls?

09
Fill in the blank
1 point

A control assessment should test both its and its operation.

10
Choose one
1 point

An organization is deciding which safeguards to apply to a new system. Which approach best reflects risk-based control selection?

  1. A

    Choose every control in a catalog without considering the system

  2. B

    Select controls based only on their lowest implementation cost

  3. C

    Assess threats, vulnerabilities, likelihood, and impact before choosing controls

  4. D

    Use the same controls for every system, regardless of its environment

11
Choose all
1 point

A company wants layered protection for sensitive records. Select all options that provide complementary layers across people, technology, or the physical environment.

  1. A

    Train staff and require approval before access is granted

  2. B

    Use multifactor authentication and encryption

  3. C

    Rely on a single firewall as the only safeguard

  4. D

    Control entry to the room where the records are stored

12
True or false
1 point

A control that worked as intended before a major system or staffing change may need reassessment afterward. True or false?

  1. A

    True

  2. B

    False

13
Open ended
1 point

Describe how an organization can select and evaluate security controls using a risk-based approach. Include what it should assess before choosing controls and what it should check after implementation.

14
Written response
1 point

What aspect of a control do the labels preventive, detective, and corrective describe?

15
Choose one
1 point

An organization trains employees to recognize security risks and follow its procedures. Which category best describes this safeguard?

  1. A

    Administrative control

  2. B

    Technical control

  3. C

    Physical control

  4. D

    Corrective control

16
Choose one
1 point

A company uses access rules to limit who can view sensitive records. Which part of the CIA triad does this safeguard most directly support?

  1. A

    Confidentiality

  2. B

    Integrity

  3. C

    Availability

  4. D

    Operational impact

17
Choose one
1 point

After an alert reveals that an account has been compromised, an administrator disables it to limit further harm. What function does this action serve?

  1. A

    Preventive

  2. B

    Detective

  3. C

    Corrective

  4. D

    Physical

18
Choose one
1 point

A company wants to protect sensitive records without relying on a single safeguard. Which plan best applies defense in depth?

  1. A

    Use encryption alone because it removes the need for other safeguards

  2. B

    Combine staff procedures, technical safeguards, and controlled physical access

  3. C

    Focus only on correcting problems after they cause harm

  4. D

    Replace control monitoring with a one-time review

19
Written response
1 point

An organization adjusts baseline controls so they fit a particular system and its environment. What action is it taking?

20
Written response
1 point

What is the term for the risk that remains after an organization applies controls?