Which of the following illustrates an operational control process:

Question

Options

• AClassifying an information system as part of a risk assessment
• BInstalling an appropriate fire suppression system in the data center
• CConducting an audit of the configuration management process
• DEstablishing procurement standards for cloud vendors

• A
  14% (6)
• B
  75% (33)
• C
  5% (2)
• D
  7% (3)

Explanation

Installing a fire suppression system (B) is an operational control because it is a physical, hands-on safeguard that protects assets through direct action - it operates in the real world to prevent or contain harm, specifically within the data center environment.

Why the distractors are wrong:

• A (Classifying an information system) is a managerial/administrative control - it's a planning and risk assessment activity, not an operational one.
• C (Auditing the configuration management process) is also a managerial control - audits evaluate and oversee processes but don't directly protect assets.
• D (Establishing procurement standards) is an administrative/policy control - it sets rules and guidelines but isn't directly operational in nature.

Memory tip: Operational controls are physical or technical mechanisms that do something tangible - sprinklers, locks, guards, cameras, and similar measures. If you can point to it or watch it work in a facility, it's likely operational. Administrative/managerial controls live in documents and processes; operational controls live in the real world.

No community discussion yet for this question.