ISC2 CC Practice Question: Which TWO of the following are examples of…

Which TWO of the following are examples of administrative security controls? (Choose two.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Security awareness training

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Intrusion detection system
Why it's wrong here
An IDS is a technical control that monitors network traffic for threats.
✓
Security awareness training
Why this is correct
Training is an administrative control that educates users on security policies.
✗
Firewall
Why it's wrong here
A firewall is a technical control that filters network traffic.
✗
Encryption
Why it's wrong here
Encryption is a technical safeguard that protects data confidentiality through cryptographic algorithms, not an administrative control that governs human behaviour via policies or procedures. It is tempting because encryption is often mandated by security policies, but its implementation is a corrective or preventative technical measure, not a rule or guideline. Encryption would be the correct choice if the question asked for a technical control, such as in a scenario requiring data-at-rest protection.
✓
Background checks for employees
Why this is correct
Background checks are an administrative control that verifies employee trustworthiness.

Go deeper