GSLC · Question #117
Which of the following are examples of administrative controls that involve all levels of employees within an organization and determine which users have access to what resources and information?…
The correct answer is A. Training and awareness B. Employee registration and accounting E. Disaster preparedness and recovery plans. Administrative controls are policy-based and people-oriented measures that govern how employees interact with systems and data. Training, registration/accounting, and disaster plans all qualify as administrative controls, while authentication and encryption are technical…
Question
Which of the following are examples of administrative controls that involve all levels of employees within an organization and determine which users have access to what resources and information? Each correct answer represents a complete solution. Choose three.
Options
- ATraining and awareness
- BEmployee registration and accounting
- CNetwork authentication
- DEncryption
- EDisaster preparedness and recovery plans
How the community answered
(17 responses)- A94% (16)
- C6% (1)
Why each option
Administrative controls are policy-based and people-oriented measures that govern how employees interact with systems and data. Training, registration/accounting, and disaster plans all qualify as administrative controls, while authentication and encryption are technical controls.
Training and awareness is a classic administrative control because it involves all employees and establishes organizational security behavior through education and policy enforcement.
Employee registration and accounting is an administrative control that governs who is granted access to organizational resources and tracks user activity through procedural and HR-based means.
Network authentication is a technical control because it relies on technology mechanisms such as protocols and software to verify user identity, not on policy or procedure.
Encryption is a technical control that uses cryptographic algorithms to protect data, rather than a policy-based or procedural measure governing employee behavior.
Disaster preparedness and recovery plans are administrative controls that define organizational procedures and responsibilities across all employee levels to maintain business continuity.
Concept tested: Administrative vs technical security controls classification
Source: https://csrc.nist.gov/glossary/term/administrative_control
Topics
Community Discussion
No community discussion yet for this question.