34 questions · Control Implementation · All types, answers revealed
You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?
This allows monitoring of internal and external traffic flows.
Why this answer
Placing the sensor on the span port of the core switch allows visibility into internal traffic flows.
Which type of control is an alarm system installed in a server room?
Detective controls trigger an alert upon detection of an event.
Why this answer
An alarm system is a detective control designed to alert staff of unauthorized presence.
Which TWO of the following represent best practices for password management?
Password managers facilitate the use of strong, unique credentials.
Why this answer
Complex, unique passwords and the use of a password manager are foundational security practices.
Which TWO of the following are critical requirements for implementing an effective patch management program?
Testing is essential to ensure patches don't break functionality.
Why this answer
Patch management requires testing to prevent outages and a deployment strategy to ensure coverage.
Which TWO of the following are examples of administrative security controls?
Policy creation is an administrative task.
Why this answer
Administrative controls are 'soft' controls involving policy and management, whereas technical controls are 'hard' controls.
You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?
The INPUT chain processes traffic intended for the local socket.
Why this answer
The INPUT chain handles traffic that is addressed to the host machine itself.
Which administrative control is essential before deploying a new security tool to production?
Change management ensures stability and accountability.
Why this answer
A formal change control process is required to ensure that changes are tested, documented, and approved.
You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?
Clients must be able to reach the CDP to verify status.
Why this answer
A Certificate Revocation List (CRL) is essential for clients to verify if a certificate is still valid.
What is the physical security control used to prevent piggybacking at an entry point?
A mantrap specifically prevents tailgating/piggybacking.
Why this answer
A mantrap is a physical system that requires one door to be closed before the other opens, preventing unauthorized entry.
When performing vulnerability management, what is the purpose of a 'credentialed scan'?
Accessing the OS allows detection of internal vulnerabilities.
Why this answer
Credentialed scans allow the tool to look inside the OS and application configuration, providing more accurate results.
Which THREE of the following are steps required to properly decommission a server containing sensitive data?
Records must reflect the current state of assets.
Why this answer
Secure data destruction, removing the server from the network, and updating the asset register are standard procedures.
To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?
This is the native Linux kernel disk encryption framework.
Why this answer
dm-crypt/LUKS is the industry-standard tool for transparent full disk encryption on Linux.
You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?
This ensures only binaries signed by your organization's CA are permitted.
Why this answer
Publisher rules in AppLocker allow for the most granular control based on digital certificates.
When implementing an 802.1X environment, what is the role of the RADIUS server?
The RADIUS server makes the final decision on access based on the credentials.
Why this answer
The RADIUS server acts as the Authentication Server, validating the credentials provided by the supplicant via the authenticator.
Which TWO of the following are considered 'technical' security controls?
Encryption is a technical control.
Why this answer
Technical controls (also called logical controls) use technology to enforce security.
Which THREE of the following are components of a secure server hardening process?
Patching is critical for vulnerability remediation.
Why this answer
Disabling unnecessary services, updating software, and using minimal feature sets are key to reducing the attack surface.
You are managing access to a file server. You want to ensure that users can read files but not delete them. What is this an example of?
Read-Only allows access to content but prevents modification or deletion.
Why this answer
This is the principle of Least Privilege, specifically using NTFS permissions to restrict write/delete access.
You are configuring a SIEM (e.g., Splunk) to monitor failed login attempts. What is the most efficient way to reduce noise while maintaining audit integrity?
Filtering at the source (forwarder) prevents ingestion of noise.
Why this answer
Filtering at the forwarder level prevents unnecessary ingestion of logs, saving storage and improving performance.
You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?
This file controls how the server handles cryptographic handshakes.
Why this answer
The web server's SSL/TLS configuration file (e.g., httpd.conf or nginx.conf) defines the supported cipher suites.
You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?
This correctly allows HTTPS traffic from any source.
Why this answer
Security groups are stateful; allowing inbound traffic automatically allows the return traffic, and the default is to deny all other traffic.
Which TWO of the following are effective ways to secure endpoints against malware?
Patching prevents exploitation of software vulnerabilities.
Why this answer
Antivirus/EDR and regular patching are the primary technical controls for endpoint malware protection.
When configuring Cisco ASA firewall rules, you notice that traffic is being dropped despite an 'allow' access-list. What is the most likely cause?
ASA access lists are processed sequentially; the first match wins.
Why this answer
The Cisco ASA uses an 'implicit deny' at the end of every access-list, and the order of rules matters.
You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?
This is the definitive control to prevent public access regardless of object settings.
Why this answer
S3 Block Public Access settings provide a centralized, account-wide or bucket-level override to prevent accidental exposure.
You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?
AD DS provides a secure, centralized location for recovery keys.
Why this answer
Storing recovery keys in Active Directory Domain Services (AD DS) ensures central management and recovery capability for IT staff.
In VMware vSphere, what is the best practice for securing virtual machine consoles?
VMRC provides a secure, authenticated channel to the VM console.
Why this answer
Disabling the remote console access or enforcing authentication is vital to prevent unauthorized access.
You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?
This is the standard mechanism for requiring MFA based on conditions.
Why this answer
Conditional Access policies allow for risk-based and context-aware authentication enforcement.
When configuring an email security gateway (e.g., Proofpoint), which record should be added to DNS to prevent domain spoofing?
SPF records define which IPs are authorized to send email for the domain.
Why this answer
SPF, DKIM, and DMARC are the trifecta of email authentication; SPF is the most foundational DNS record for authorized senders.
Which TWO of the following are recommended practices for managing firewall rules?
Justification is necessary for auditing and change management.
Why this answer
Regular review and documentation of rules help maintain a secure and clean firewall configuration.
Which THREE of the following are elements of a secure incident response control set?
An IRT is essential for professional response.
Why this answer
Preparation, identification, and containment are foundational phases of the incident response lifecycle.
Which TWO of the following are examples of physical security controls?
Cameras are a physical deterrent/detective control.
Why this answer
Physical controls protect the physical facility and hardware.
Which document is used to standardize the implementation of security controls across an organization?
Baselines define the required configuration state for assets.
Why this answer
A Security Baseline (or Standard) provides the specific, actionable configuration requirements for assets.
You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?
Splitting privileges prevents a single point of failure.
Why this answer
Separation of duties ensures no single administrator has total control over all aspects, minimizing risk.
A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?
This provides a controlled and audited gateway to production assets.
Why this answer
A Bastion Host with MFA ensures that access to production is controlled, logged, and authenticated securely.
You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?
This reduces benign noise while preserving detection capabilities.
Why this answer
Tuning policies to exclude known safe administrative scripts and software reduces noise while maintaining core monitoring.
Ready to test yourself?
Try a timed practice session using only Control Implementation questions.