Drag and Drop Matching Questions

Administrative: Policies, procedures, and rules

Administrative controls are management-driven policies, procedures, and rules that define expected behavior and establish the governance framework for security. They are often called directive controls because they guide human conduct rather than enforce it through hardware or software mechanisms. Examples include security awareness training, access control policies, incident response plans, and background checks. These controls form the foundation upon which technical and physical controls are selected and implemented.

Physical: Tangible barriers like fences

Physical controls are tangible, hardware-based measures designed to protect assets from physical harm or unauthorized physical access. Examples include fences, bollards, guards, locks, and closed-circuit television systems. Their primary purpose is to deter, delay, or deny direct contact with protected resources, often serving as the first layer in a defense-in-depth strategy. Unlike technical controls, they do not rely on software or network logic; they operate entirely in the physical world.

Legal/Regulatory: Compliance with laws

Legal/regulatory controls are externally imposed requirements that organizations must satisfy to meet statutory, regulatory, or contractual obligations. Examples include compliance with GDPR, HIPAA, PCI-DSS, and SOX, which are enforced by government bodies or industry auditors. Unlike administrative controls, which are internally chosen policies, legal/regulatory controls carry the force of law and failure to comply can result in fines, legal action, or revocation of operating privileges. They shape administrative policies but are distinct because their mandate originates outside the organization.

Layered security: Defense in depth

Layered security is correctly implemented through defense in depth, which deliberately deploys multiple overlapping security controls across physical, technical, and administrative layers. If one control is bypassed or fails, another independent control continues to provide protection, creating resilience against a variety of attack vectors. This approach does not rely on any single mechanism, making it far more difficult for an attacker to achieve full compromise.

Minimize risk: Least privilege

Minimizing risk is best achieved by the principle of least privilege, which dictates that users, processes, or systems are granted only the permissions and access rights absolutely necessary to perform their assigned functions. By limiting permissions to the bare minimum, the attack surface is reduced and the potential blast radius of a compromised account or compromised process is contained. This prevents excessive privileges from being used to access or modify resources beyond the intended scope.

Prevent fraud: Separation of duties

Preventing fraud is the primary purpose of separation of duties, a security principle that splits critical, sensitive tasks among multiple individuals so that no single person has end-to-end control over a high-risk process. For example, the person who authorizes a payment should not be the same person who issues the payment, forcing collusion between two or more insiders to commit fraud. This internal control creates a system of checks and balances that deters, prevents, and detects fraudulent activity.

Isolation: Preventing the spread of the incident to other systems.

Isolation is a containment strategy that severs the compromised system's network connectivity, disables unnecessary services, and may involve network segmentation or firewall rules to stop lateral movement. The primary goal is to limit the blast radius and prevent the attacker from accessing other systems or exfiltrating data, while preserving the system for further forensic analysis. Unlike eradication, which removes the threat, isolation is purely about containment and maintaining a safe perimeter for investigation.

Volatile Data Capture: Preserving evidence that may be lost if the system is powered off or rebooted.

Volatile data capture involves collecting information that resides in RAM and other transient storage, such as running processes, open network connections, logged-in users, and encryption keys, which is irretrievably lost when power is removed. Because memory contents vanish on shutdown or reboot, forensic responders must perform this capture as a high-priority step before any power-down. This preserves time-sensitive evidence that is often critical for understanding the attacker's current activities and in-memory malware.

Imaging: Creating a bit-for-bit copy of the affected drive for forensic analysis.

Imaging, also known as forensic imaging, creates a bit-for-bit copy (often a raw or E01 format file) of the entire storage device, including deleted files, unallocated space, and slack space. This exact replica allows analysts to perform thorough forensic examination without altering the original evidence, thereby maintaining the chain of custody and data integrity through hashing. It is a non-destructive procedure that captures the complete state of the storage medium for offline analysis, distinct from volatile memory capture.

Least privilege: A user is granted only the permissions required for their job duties.

Least privilege ensures users have minimal access needed to perform tasks.

Need to know: An employee can access sensitive data only if it is directly relevant to their current project.

Need to know restricts data access to what is necessary for job functions.

Accountability: All system actions are recorded with user identification to trace activities.

Accountability ties actions to individuals via logging and auditing.

VLAN: Separates broadcast domains logically

A VLAN creates logically isolated Layer 2 broadcast domains on the same physical switch infrastructure. By tagging frames with 802.1Q VLAN IDs, switches restrict broadcast, multicast, and unknown-unicast traffic to only ports in the same VLAN, reducing unnecessary propagation and improving security. This logical separation also lets administrators group devices by function or department without rewiring, while inter-VLAN routing is still required for communication between VLANs.

Subnet: Divides IP networks into smaller segments

Subnetting divides a larger IP address block into smaller, routable subnetworks, each with its own network address and broadcast address. This hierarchical partitioning reduces routing table size, improves address allocation efficiency, and supports traffic isolation by controlling which subnets can route to one another through Layer 3 devices. Unlike VLANs, which operate at Layer 2, subnets are a logical IP-layer construct that defines the boundaries for IP routing and broadcast delivery.

DMZ: Isolates public servers from internal network

A DMZ (demilitarized zone) is a perimeter network segment that sits between the public internet and the internal corporate LAN, typically via firewall rules that enforce strict traffic flows. Public-facing servers such as web, email, or DNS are placed here so that if an attacker compromises them, they do not have direct internal network access. The DMZ uses policies that allow only specific inbound ports (e.g., 80/443) to reach the zone, while internal networks initiate outbound sessions only as needed, containing potential breach impact.

SOC 2 Type II: Independent evidence that a SaaS provider's controls operated effectively during the last year.

A SOC 2 Type II report is an independent attestation by a CPA firm that evaluates the effectiveness of a service organization's controls over a specified period, typically 6–12 months. It tests the design and operating effectiveness of controls against AICPA Trust Services Criteria (e.g., security, availability, and confidentiality). This is the appropriate artifact for a procurement need seeking continuous, period-based operational assurance, unlike a point-in-time test.

SBOM: A list of files, libraries, and modules included in a supplier's software build.

A Software Bill of Materials (SBOM) is a machine-readable inventory of every third-party component, open-source library, and module included in a software build, along with version numbers and dependency relationships. For procurement, it directly answers the question of what exactly is inside the vendor's software, enabling security teams to cross-reference vulnerabilities (e.g., CVEs) and assess license and supply-chain risk. This artifact is essential for verifying that the supplier is not shipping code with known vulnerable dependencies.

DPA: A signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.

A Data Processing Agreement (DPA) is a legally binding contract, required under regulations like GDPR and HIPAA, that defines the roles (controller/processor), processing instructions, subprocessor relationships, data subject rights, and security safeguards. It also mandates specific incident-response obligations, including breach notification timelines and liability allocation. This is the proper artifact for a procurement need centered on data-handling rules and post-incident commitments, as it creates enforceable legal duties rather than just describing intent.

Security questionnaire: A set of questions about MFA, logging, and incident response before onboarding a cloud supplier.

A vendor security questionnaire is a standardized set of questions about security policies and technical controls, such as whether MFA is enforced, whether audit logs are retained, and whether there is an incident response team and plan. It is a primary pre-onboarding screening tool, allowing procurement to rapidly compare cloud suppliers' postures and identify red flags before deeper review. This artifact is best suited for gathering explicit assertions from the vendor about specific security practices, rather than relying on external audit reports.

Assess security controls: Security questionnaire

Security questionnaires are structured, vendor-specific assessments used during the pre-contract due diligence phase to gather self-reported information about controls such as access management, encryption, incident response, and compliance. They are the primary mechanism for initially assessing a vendor's security posture because they can be tailored to the customer's industry, regulatory burdens, and risk tolerance, and they surface red flags before a deeper review. Unlike independent audits, questionnaires rely on vendor disclosures but are cost-effective and efficient for screening a broad set of potential vendors.

Independent assurance: SOC 2 report

A SOC 2 report provides independent, third-party assurance from a licensed CPA firm that a service organization's controls over security, availability, processing integrity, confidentiality, and privacy are suitably designed and operating effectively. It is not a general questionnaire but a formal attestation report issued under the AICPA Trust Services Criteria, often with a Type II opinion covering operational effectiveness over a specific period. This makes SOC 2 the correct option when a customer needs objective evidence of a vendor's control environment rather than a simple self-assessment.

Right to audit: Audit clause

An audit clause is a contractual provision that grants the customer the explicit right to perform or commission audits of the vendor's systems, facilities, and controls to verify ongoing compliance with contractual and regulatory obligations. It establishes the terms for on-site inspections, access to relevant documentation, and even third-party assessments, and is essential for customers that cannot rely solely on self-reported or periodic third-party reports. This right is exercised when the customer needs direct, hands-on assurance of the vendor's security posture over the life of the contract.

Policy: High-level statement of management intent

Policy is correctly defined as a high-level statement of management intent. It expresses the organization's security goals and expectations without specifying technical implementations, allowing flexibility in how objectives are met. Policies are approved by senior management and serve as the authoritative basis for developing standards, procedures, and guidelines.

Standard: Mandatory rules that must be followed

Standard is correctly defined as mandatory rules that must be followed. Standards convert policy intent into concrete, enforceable requirements, such as a minimum 12-character password length or AES-256 encryption, which all systems must satisfy. Noncompliance with a standard is a formal violation and can trigger corrective action, unlike guidelines that merely suggest optional approaches.

Phishing: Investigate email headers and links

Phishing investigations should start with the email message itself—analyzing full SMTP headers for SPF, DKIM, and DMARC validation failures, examining embedded URLs against reputation services, and sandboxing attachments to observe malicious behavior. Header anomalies like mismatched Reply-To or spoofed sender domains are strong signals, and link analysis often reveals credential-harvesting lures. This is the correct primary artifact focus for phishing, distinctly different from host-based malware analysis.

Malware: Analyze file hashes and process behavior

Malware analysis centers on identifying the malicious file and its runtime behavior. Investigators compute file hashes (MD5, SHA-256) and query them against known-bad threat intelligence to classify the sample, then observe process execution—looking for abnormal child processes, injected threads, registry persistence keys, or suspicious network connections from the infected host. These host-centric artifacts confirm active infection and are separate from email-content artifacts used in phishing investigations.

8% of users clicked: Indicates user susceptibility to phishing.

This metric directly measures the proportion of users who failed to recognize a simulated phishing email and interacted with the malicious content, thereby quantifying individual susceptibility to social engineering attacks. A higher click rate indicates a greater number of employees are likely to fall for real phishing lures, exposing the organization to breaches. It is a direct behavioral outcome, not a reflection of organizational culture or reporting norms.

34% of users reported: Reflects security culture and reporting behavior.

This metric captures the percentage of users who proactively flagged the simulated phishing email instead of ignoring or clicking it, demonstrating both their vigilance and their willingness to engage with security reporting processes. A high report rate signals that users recognize phishing indicators, trust the reporting mechanism, and feel empowered to escalate threats without fear of reprisal. It is a leading indicator of a mature security culture, where transparency and prompt communication are valued.

Median report time of 12 minutes: Measures responsiveness to phishing.

Median report time quantifies the speed with which users who identified the simulated phishing email actually submitted a report. A shorter median time, such as 12 minutes, means users quickly transition from recognition to action, allowing incident responders to neutralize threats before substantial damage occurs. This metric specifically measures the human response component of the phishing defense chain, complementing click rate and report rate by assessing efficiency, not just accuracy or willingness.

96% staff completed training: Shows training adoption and awareness.

This metric measures the proportion of employees who completed the mandated security awareness training, indicating the program's reach and the baseline level of knowledge imparted across the workforce. A 96% completion rate demonstrates that nearly all staff have been exposed to essential phishing recognition techniques and organizational policies, reflecting strong program adoption. It also signals institutional commitment to security education, though it does not directly measure behavioral change or retention of knowledge.

Least privilege: Users get minimal permissions needed

Least privilege is a core security principle that restricts a user, program, or process to only the access rights and permissions absolutely necessary to complete their assigned tasks. By granting minimal entitlements, it reduces the attack surface and limits the potential damage from credential compromise, insider threats, or software vulnerabilities. This principle is a foundational control in zero trust architectures and regulatory frameworks such as HIPAA, which mandate access aligned with job functions.

Defense in depth: Multiple layers of security

Defense in depth is a layered security approach that employs multiple, independent controls across physical, technical, and administrative domains to protect an asset. If one control fails, another control at a different layer or with a different mechanism still blocks or mitigates an attack, creating redundancy and resilience. This strategy is exemplified by combining network firewalls, host-based intrusion detection, data encryption, and security awareness training, so that an attacker must defeat several obstacles to succeed.

Need-to-know: Access only to information necessary for job duties

Need-to-know restricts information access to individuals whose job duties explicitly require that specific data, even if they have high-level clearance or broad authorization. It emphasizes the data content itself, rather than the level of privilege, ensuring that an employee handling accounts cannot view contracts or personnel files unless their role demands it. This principle is essential in compartmented environments like military intelligence, where access to certain programs is strictly limited to those directly involved.

Policy: All employees must use multi-factor authentication

A policy is a formal, mandatory statement of management intent, and 'must' makes this requirement non-negotiable for all employees. It establishes an organization-wide rule without prescribing the underlying mechanics, such as which MFA app or hardware token to use—that level of detail would live in a standard or procedure. Therefore, classifying this as Policy is correct because it sets an enforceable expectation.

Procedure: To reset a password, follow steps 1-5

A procedure is a detailed, ordered sequence of actions for completing a specific task, and the phrase 'follow steps 1-5' signals exactly that. Unlike a policy (a rule) or a standard (a technical requirement), this excerpt instructs the user how to perform a password reset step by step. The presence of enumerated steps is the defining characteristic of a procedure.

Standard: All laptops must be encrypted using AES-256

A standard codifies a specific technical requirement, and this excerpt names the exact cryptographic algorithm (AES) and key strength (256-bit). Because it dictates a precise, measurable control—not a broad behavioral rule or optional advice—it belongs in the standard class. In security governance, standards are often derived from policies and are mandatory, so the word 'must' here enforces the technical baseline.

Guideline: It is recommended to use complex passwords

A guideline is a recommended best practice that supports but does not mandate specific behaviors. The term 'recommended' clearly distinguishes this from a policy, which would use 'must' or 'shall,' and from a standard, which would specify measurable technical details. Organizations use guidelines like complex password usage to improve security posture while allowing flexibility in implementation.

A public marketing flyer approved for external posting: Public

The public marketing flyer is explicitly approved for external posting, which is the defining criterion for Public classification. Public data is non-sensitive and can be disclosed to anyone without restriction, requiring no access controls or protection mechanisms. Since the flyer is authorized for public distribution, any other classification would conflict with its intended purpose.

An internal org chart and office directory meant only for employees: Internal

The internal org chart and office directory are intended solely for employee use, making them Internal data. Although this information is not highly sensitive, it is not approved for public disclosure, so it cannot be classified as Public. It doesn't meet the threshold for Confidential because it lacks PII or other regulated data, but it still requires access restrictions to company personnel.

A customer case file with contact details and order history: Confidential

A customer case file containing contact details and order history constitutes PII, which falls under Confidential data. This classification demands strict access controls, encryption, and a need-to-know basis to protect customer privacy and comply with regulations. It is more sensitive than Internal but not as critical as Restricted, which is reserved for credentials and secrets.

A vault export containing API keys and encryption secrets: Restricted

A vault export containing API keys and encryption secrets is clearly Restricted, the highest classification level. These credentials, if exposed, could directly compromise systems, data, and infrastructure, so they demand the strongest protections such as hardware security modules, strict access logging, and minimal distribution. Misclassifying them as Confidential would understate the catastrophic impact of a leak.

Encryption: Ensuring confidentiality

Encryption is the process of transforming plaintext into ciphertext using an algorithm and a cryptographic key, ensuring that unauthorized parties cannot read the data. Confidentiality is achieved because only someone with the correct decryption key can recover the original message. Encryption does not inherently prevent modification, so it is not used for integrity; it specifically protects data from disclosure.

Hashing: Ensuring integrity

Hashing is a one-way cryptographic function that maps data of arbitrary size to a fixed-length digest. Because any change to the input, even a single bit, produces a completely different digest, hashing is used to verify that data has not been altered. It provides integrity by allowing a recipient to recompute the hash and compare it to the original, but it does not protect confidentiality or prove the identity of the sender.

Digital Signatures: Providing authentication and non-repudiation

Digital signatures are created by hashing a message and then encrypting that hash with the sender's private key. The recipient decrypts the signature using the sender's public key and compares the resulting hash to one computed from the received message, which verifies the sender's identity and ensures the message originated from them. Because the private key is known only to the sender, the sender cannot deny having signed it, thus providing non-repudiation in addition to authentication.

Least privilege: A user is given only the permissions needed to perform their job.

Least privilege is the principle that a user should be granted only the exact permissions and access rights required to perform their assigned job functions, and nothing more. This minimizes the attack surface by preventing users from accessing sensitive data or systems that are irrelevant to their role, reducing the potential impact of accidental or malicious misuse. In practice, this means applying role-based access control (RBAC) with fine-grained permissions, and regularly reviewing and revoking privileges when roles change. This scenario is correct because it directly aligns with the definition of least privilege, unlike scenarios involving multi-person approval which map to separation of duties.

Separation of duties: Two people are required to approve a financial transaction.

Separation of duties is an internal control that requires a critical task to be divided among two or more individuals, ensuring that no single person has end-to-end authority over a sensitive process. Requiring two people to approve a financial transaction creates a checks-and-balances mechanism, because the second approver independently verifies the legitimacy of the transaction, which deters fraud, errors, and unauthorized payments. This principle relies on a division of responsibilities rather than merely limiting permissions, and is a common requirement in financial auditing and regulatory compliance frameworks. This scenario is correct because it exemplifies the essence of separation of duties, not least privilege or defense in depth.

Defense in depth: A network uses firewalls, antivirus, and encryption.

Defense in depth is a security strategy that employs multiple, overlapping layers of protection so that if one control fails or is bypassed, another control is still in place to mitigate the threat. In this scenario, a network using firewalls, antivirus, and encryption represents distinct layers: the firewall filters traffic at the network boundary, antivirus detects malicious code at the host level, and encryption protects data at rest and in transit. These layers work together to provide redundancy and increase the overall complexity and effort required for an attacker to compromise the system. This scenario is correct because the use of multiple, diverse security controls across different layers is the defining characteristic of defense in depth.

Repeated login failures: Brute-force attack

Repeated login failures are a hallmark of an automated brute-force attempt, where an attacker cycles through many guessed username/password pairs against an authentication endpoint. Unlike a single typo, these failures cluster in a short time window and often come from a single source IP or a distributed pool. Monitoring failed-auth logs, lockout thresholds, and source IP reputation provides direct evidence of credential guessing.

Outbound connections to malicious IPs: Command and Control (C2)

Outbound connections to known malicious IP addresses, especially at regular intervals, indicate a compromised host’s command-and-control (C2) channel. A C2 protocol typically involves beaconing — periodic check-ins over HTTP, HTTPS, or DNS — to receive instructions or stage stolen data for later retrieval. Egress filtering and threat-intelligence feeds flag these destination IPs, revealing the compromised host.

Large data transfers at odd hours: Data exfiltration

A sudden surge in data transfers to external destinations during odd hours deviates from established user and host baselines, pointing strongly to data exfiltration. Attackers deliberately schedule bulk copying when administrative oversight is low, often compressing or encrypting the data to evade content inspection. Security monitoring with user and entity behavior analytics (UEBA) can trigger on volume, destination, and time anomalies.

Multiple ICMP requests from many sources: DDoS

An ICMP flood composed of requests from many distributed source addresses is a classic volumetric distributed denial-of-service (DDoS) attack. The goal is to saturate the target’s bandwidth or processing capacity with echo requests, rendering services unavailable. The distributed, high-quantity nature distinguishes it from a single-host ping sweep or host discovery.

Confidentiality: Restricts access to authorized users.

Confidentiality ensures that data and systems are accessible only to those explicitly cleared to view them, often enforced through attribute-based access control and full-disk encryption. It protects against unauthorized disclosure, whether accidental or malicious, by applying the principle of least privilege across users and processes. This is distinct from integrity because it focuses on secrecy rather than accuracy.

Integrity: Prevents unauthorized modification of data.

Integrity guarantees that data remains unaltered from its original state except by sanctioned modifications, typically verified using cryptographic hash functions or digital signatures. It defends against unauthorized changes to files, messages, or configuration settings, preserving trust in the information's accuracy and completeness. Unlike availability, which concerns uptime, integrity is specifically about preserving the exactness of content.

Availability: Ensures systems are accessible when needed.

Availability ensures that authorized users have timely and uninterrupted access to information and IT resources, often achieved through redundant infrastructure, load balancing, and backup recovery plans. It mitigates risks such as denial-of-service attacks, hardware failures, or power outages by implementing failover mechanisms and disaster recovery procedures. Security teams must balance availability with confidentiality and integrity, as reducing access controls can boost uptime but weaken protection.

Encryption: Protects data by converting it into a secure format.

Encryption transforms plaintext data into ciphertext using cryptographic algorithms and keys, ensuring that only authorized parties possessing the correct decryption key can read it. This process protects data at rest, in transit, and in use, maintaining confidentiality against unauthorized access. It is a fundamental control for cloud data protection, especially when data is stored in shared infrastructure.

IAM: Manages digital identities and access rights.

Identity and Access Management (IAM) encompasses the policies and technologies used to manage digital identities, authentication, and authorization. It ensures that the right users have appropriate access to cloud resources through mechanisms like multi-factor authentication, role-based access control, and single sign-on. IAM is the foundation for enforcing least privilege and auditing user activities.

SIEM: Provides real-time analysis of security alerts.

Security Information and Event Management (SIEM) aggregates and correlates log data from across the cloud environment to provide real-time monitoring and threat detection. It analyzes events against known threat intelligence and rule sets, generating alerts for suspicious activity. SIEM tools enable security teams to rapidly identify potential incidents and support compliance reporting.

DLP: Prevents unauthorized sharing of sensitive data.

Data Loss Prevention (DLP) tools inspect data content and context to detect and prevent unauthorized transmissions or sharing of sensitive information. They enforce policies that block exfiltration via email, web uploads, or removable media, and can also identify improperly stored data in cloud storage. DLP helps organizations meet compliance requirements by protecting regulated data.

Administrative: Security awareness training policy

Security awareness training policy is an administrative control because it governs human behavior through formal organizational rules, procedures, and education. Unlike technical safeguards, it does not directly enforce a rule in software or hardware; instead, it reduces risk by teaching employees to recognize phishing, handle data properly, and follow incident reporting protocols. Administrative controls such as this are the foundation for ensuring that the other control types are used correctly.

Technical: Firewall

A firewall is a technical control because it relies on software or hardware mechanisms to inspect and filter network traffic based on predetermined security rules. It actively blocks or permits packets at the network or host level, enforcing access control without requiring human action after it is configured. This distinguishes it from administrative controls like policy documents that depend on people to read and follow them.

Physical: Locked server room door

A locked server room door is a physical control because it provides a tangible, real-world barrier that restricts unauthorized access to the facility housing critical systems. Physical controls such as locks, biometric readers, and mantraps are designed to prevent direct contact with hardware, reducing risks like theft, tampering, and environmental damage. They operate independently of user conduct or network settings.

Deterrent: Visible security cameras

Visible security cameras are a deterrent control because their primary function is to discourage potential intruders from attempting unauthorized actions by increasing the perceived likelihood of detection. While cameras also serve a detective function by recording incidents, the distinguishing intent of a visible camera is to influence the decision-making of people before they act. Deterrent controls rely on psychological deterrence rather than physically blocking or immediately alerting.

Guest Wi-Fi: Used for external users to access the internet without accessing internal resources.

Guest Wi-Fi creates a segmented, untrusted zone for visitors and contractors to reach the internet only. It uses a separate SSID/VLAN with ACLs or a captive portal, and firewall rules block any return traffic to internal resources. Even though it shares the same physical router, routing and L2 isolation keep it from reaching the internal LAN.

DMZ: Hosts public-facing services like web servers and email servers.

The DMZ (demilitarized zone) is a buffer network that hosts servers reachable from the internet, such as web, email, and application front ends. Firewalls regulate traffic between internet, DMZ, and internal LAN using different security policies — inbound 443/80 is allowed only to specific DMZ hosts, and those hosts cannot initiate connections into the internal network. This limits exposure if a public server is compromised.

Internal LAN: Used for daily operations of internal employees.

The Internal LAN is the trusted zone where employee workstations, printers, and internal databases reside. Unlike the DMZ and guest Wi-Fi, this segment has no direct inbound exposure to the internet, and most traffic is allowed laterally inside the trusted boundary. The organization places its day-to-day computing, data, and authentication traffic here after it passes firewall inspection from other zones.