easyMultiple Select
Examples of Administrative Controls for Information Security
Which TWO of the following are examples of administrative controls for information security?
Quick Answer
The answer is security awareness training and access control policy, as both are classic examples of administrative controls in information security. Administrative controls are management-level safeguards that define rules, roles, and responsibilities through documented directives, such as policies, procedures, and training programs, rather than through technical mechanisms like firewalls or physical barriers like locks. Security awareness training governs user behavior by educating staff on security practices, while an access control policy establishes the framework for granting or restricting access to information assets. On the Certified Information Systems Auditor CISA exam, this topic tests your ability to distinguish administrative controls from technical or physical controls—a common trap is confusing a policy (administrative) with its technical implementation, such as an access control list. Remember the mnemonic “PAT”: Policies, Awareness, and Training are the pillars of administrative controls; if it’s a document or a class, it’s administrative.
⚠ Common exam trap
ISACA often tests the distinction between administrative, technical, and physical controls, and the trap here is that candidates confuse policy documents (administrative) with the technical mechanisms that implement them, such as firewalls or encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access control policy
Access control policy (C) is an administrative control because it is a documented management directive that defines rules, roles, and responsibilities for granting and revoking access to information assets, governing how people behave rather than enforcing anything technically. Security awareness training (E) is likewise administrative since it is a management-driven program that educates personnel on policies and procedures to reduce human risk. Both are process- and people-oriented controls, which is the defining characteristic of administrative controls. By contrast, an intrusion detection system (A) and firewall configuration (B) are technical (logical) controls that enforce or monitor security through hardware/software mechanisms, and encryption algorithms (D) are technical controls that protect data confidentiality through cryptographic transformation, so none of these belong to the administrative category.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Intrusion detection system
Why it's wrong here
An intrusion detection system is a detective technical control, monitoring network or host activity, not an administrative one. It tempts because it is a security control and appears in control lists, but administrative controls comprise policies, procedures, training and segregation of duties, which govern people and process rather than technology.
- ✗
Firewall configuration
Why it's wrong here
Firewall configuration is a technical control, implemented in device rule sets that permit or deny traffic. It is tempting because configuration is documented and governed by change procedure, but the control itself resides in technology; it would be correct where the question asked for technical controls.
- ✓
Access control policy
Why this is correct
An access control policy is administrative because it is a documented management directive governing how access is granted and reviewed, rather than a technical mechanism or physical safeguard. It satisfies the stem's requirement for an administrative control category example.
- ✗
Encryption algorithms
Why it's wrong here
Encryption algorithms are technical controls, transforming data mathematically to enforce confidentiality. It is tempting because algorithm selection follows written standards and policy, but the mechanism is cryptographic, not administrative; it would be correct where the question asked for technical or preventive controls.
- ✓
Security awareness training
Why this is correct
Security awareness training qualifies as an administrative control because it manages human behaviour through policy, procedure and education rather than technical enforcement. It satisfies the stem's requirement by reducing risk from social engineering and employee error, which no firewall or encryption setting can address directly.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are examples of administrative controls for information security? (Choose two.)
easy- A.Encryption of data at rest
- B.Biometric access controls
- ✓ C.Incident response policy
- ✓ D.Security awareness training
- E.Firewall configuration
Why C: An incident response policy is a documented set of procedures that defines roles, responsibilities, and steps to be taken when a security incident occurs. This is an administrative control as it governs human behavior and organizational processes, not technology. It aligns with the CISA domain of Protection of Information Assets by establishing a framework for detecting, responding to, and recovering from security events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.