Developing effective security controls is a balance between:

Question

Options

• ARisk Management and Operations
• BCorporate Culture and Job Expectations
• COperations and Regulations
• DTechnology and Vendor Management

• A
  79% (19)
• B
  4% (1)
• C
  13% (3)
• D
  4% (1)

Explanation

Developing effective security controls requires balancing Risk Management (identifying, assessing, and mitigating threats) with Operations (ensuring controls don't disrupt business functions). Too much focus on risk without operational feasibility produces controls that get bypassed; too much focus on operations without risk awareness leaves gaps that attackers exploit.

• B is wrong because corporate culture and job expectations influence adoption of controls but don't define the core design tension - a control can be culturally accepted and still be ineffective if it doesn't address actual risk.
• C is wrong because regulations are constraints that inform security programs, not the primary balancing act; complying with regulations doesn't automatically mean risk is managed, and ignoring operations still breaks implementations.
• D is wrong because vendor management is one operational consideration, not a foundational axis - technology alone doesn't address why a control is needed (risk) or whether it can be sustained.

Memory tip: Think "R.O." - Risk tells you what to protect against; Operations tells you how to make it work. Every security decision lives at that intersection.

No community discussion yet for this question.