The implementation of anti-malware and anti-phishing controls on centralized email servers is an example of what type of security control?

Question

Options

• AOrganization control
• BProcedural control
• CManagement control
• DTechnical control

• A
  6% (1)
• C
  12% (2)
• D
  82% (14)

Explanation

Technical controls are software- or hardware-based mechanisms that automatically enforce security policies without requiring human action - and anti-malware/anti-phishing filters running on an email server fit exactly that definition: the system inspects, blocks, or quarantines threats automatically.

Why the distractors are wrong:

• A. Organization control isn't a standard security control category in most frameworks (e.g., NIST, ISO 27001 use Administrative, Technical, and Physical).
• B. Procedural control (a subset of administrative controls) refers to documented processes and policies that people follow, such as a policy requiring employees to report suspicious emails - not automated software.
• C. Management control covers governance, risk assessments, and policy decisions made by leadership - the decision to deploy anti-malware would be management; the implementation of it is technical.

Memory tip: If a control runs on a machine and does the work automatically (software, hardware, encryption, firewalls, filters), it's Technical. If a person has to follow or enforce it, it's Administrative/Procedural. Ask yourself: "Does this need a human to execute, or does the system do it?"

No community discussion yet for this question.