easyMultiple Select
SSCP Practice Question: Which TWO of the following are examples of…
Which TWO of the following are examples of administrative controls in a security program? (Choose two.)
⚠ Common exam trap
ISC2 often tests the distinction between administrative, technical, and physical controls, and the trap here is that candidates confuse firewall rules or intrusion detection software (both technical controls) with administrative controls because they are part of a security program, but they are not process-based or policy-driven.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security policies
Administrative controls are management-driven, people-and-process safeguards rather than technical or physical mechanisms. Option A, security policies, is correct because written policies define required behavior, responsibilities, and governance, which is a classic administrative control. Option D, employee background checks, is correct because vetting personnel before hire is a procedural/administrative control that reduces insider risk. Option B, firewall rules, is a technical (logical) control enforced by network devices, so it does not belong. Option C, locks on server room doors, is a physical control, so it does not belong. Option E, intrusion detection software, is a technical detective control, so it does not belong.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security policies
Why this is correct
Security policies are administrative controls because they govern behaviour through documented rules, standards and procedures rather than hardware or software. They satisfy the stem's requirement for a management-level control, directing how personnel must operate and providing the mandate against which other controls are enforced.
- ✗
Firewall rules
Why it's wrong here
Firewall rules are technical controls, filtering packets by address, port and protocol on network devices. They are tempting because rules are documented in security policy and administrators configure them, but the mechanism is technological enforcement; administrative controls consist of policies, procedures, guidelines and screening.
- ✗
Locks on server room doors
Why it's wrong here
Locks are physical controls, restricting contact with the asset through barriers rather than governing behaviour. They are tempting because server-room access is often written into policy documents, but the lock itself is hardware; administrative controls are the policies, procedures and training that direct people.
- ✓
Employee background checks
Why this is correct
Employee background checks are administrative controls because they are management processes applied to personnel before or during employment, not technical mechanisms. They satisfy the stem's requirement by reducing insider risk through vetting, a procedural safeguard that operates independently of any hardware or software enforcement.
- ✗
Intrusion detection software
Why it's wrong here
Intrusion detection software is a technical control, detecting malicious activity through monitoring and signatures rather than through rules about human conduct. It is tempting because IDS output feeds incident response procedures, yet the software enforces nothing administratively; administrative controls are policies, standards and awareness training.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.