312-50V9 · Question #47
The precaution of prohibiting employees from bringing personal computing devices into a facility is what type of security control?
The correct answer is B. Procedural. A prohibition on personal devices is a procedural control because it is enforced through policy and rules governing employee behavior, not through physical barriers or technology.
Question
The precaution of prohibiting employees from bringing personal computing devices into a facility is what type of security control?
Options
- APhysical
- BProcedural
- CTechnical
- DCompliance
How the community answered
(15 responses)- B93% (14)
- C7% (1)
Why each option
A prohibition on personal devices is a procedural control because it is enforced through policy and rules governing employee behavior, not through physical barriers or technology.
Physical controls are tangible, hardware-based measures such as locks, mantraps, or security guards that physically prevent access - not rules about what employees may carry.
Procedural controls are administrative policies, rules, and guidelines that dictate how people must behave within a facility or organization. Banning personal devices is a written or verbal rule enforced through HR or security policy, making it procedural rather than a physical or technical mechanism.
Technical controls use technology to enforce security, such as network access control (NAC) systems that block unauthorized devices - not a verbal or written prohibition.
Compliance is not a category of security control; it refers to adherence to laws, regulations, or standards rather than describing how a control is implemented.
Concept tested: Categorizing administrative vs physical vs technical security controls
Source: https://csrc.nist.gov/glossary/term/administrative_control
Topics
Community Discussion
No community discussion yet for this question.