ISC2 CC Security Principles Practice Question
A security manager is mapping several controls to the categories of administrative, technical, and physical. Which TWO of the following are administrative controls? (Choose two.)
⚠ Common exam trap
The trap here is assuming that any control which expresses a management decision, such as a firewall rule, must itself be classified as administrative.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An acceptable use policy that employees must read and sign
Administrative controls govern people and processes through rules, policies, and training. The acceptable use policy and the recurring security awareness training both shape behavior through management action rather than through hardware or software. The bollard is a physical barrier, while the biometric reader and firewall enforce access through technology, so those three fall into the physical and technical categories instead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An acceptable use policy that employees must read and sign
Why this is correct
An acceptable use policy is a management directive that defines how employees may use organizational assets, and it is enforced through acknowledgment and disciplinary process. It governs behavior through rules rather than through hardware or software, which places it squarely in the administrative category. Signing the policy also establishes awareness and accountability, reinforcing its administrative nature within the security program.
- ✗
A firewall rule set that blocks inbound traffic on unused ports
Why it's wrong here
A firewall rule set is a technical control that inspects and filters network traffic according to defined criteria. It enforces policy through configuration on a device, not through human behavior or management process. Even though the rules express a decision made by management, the control itself is implemented in technology, so it does not belong in the administrative category.
- ✗
A biometric fingerprint reader controlling the data center door
Why it's wrong here
A biometric fingerprint reader is a technical control that automates identity verification and grants or denies entry based on a stored template. It may also be described as a physical access control because it guards a door, but its mechanism is electronic and software-driven rather than a management rule. The scenario asks for administrative controls, and a biometric device operates through technology, not policy or procedure.
- ✓
A security awareness training program delivered each quarter
Why this is correct
A security awareness training program is an administrative control because it shapes employee knowledge and behavior through an organized management process. It does not rely on a technical device or a physical barrier; instead, it reduces risk by teaching people to recognize threats and follow procedures. Quarterly delivery also shows ongoing governance, which is characteristic of administrative controls within a security program.
- ✗
A bollard installed at the entrance to the loading dock
Why it's wrong here
A bollard is a physical barrier that prevents vehicles from approaching or damaging a facility, so it belongs to the physical control category. It operates by directly blocking or discouraging physical access, not by defining rules or procedures. Although it supports the overall security posture, it is a tangible structure, which distinguishes it from administrative controls such as policies and training.
Go deeper
Related to this question
Learn chapter
Physical Access Controls
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.