Which of the following security controls should be implemented when systems that are covered by a compliance agreement are maintained separately from other elements of an organization's…

Question

Options

• AKey management
• BNetwork monitoring
• CData isolation
• DPenetration test

• A
  15% (6)
• B
  7% (3)
• C
  73% (30)
• D
  5% (2)

Explanation

Data Isolation is correct because when systems covered by compliance agreements (such as PCI-DSS, HIPAA, or SOX) must be kept separate from the rest of an organization's infrastructure, data isolation is the specific security control that enforces this separation - ensuring that regulated data and systems are segmented and protected from unauthorized access or contamination from non-compliant systems.

Why the distractors are wrong:

• A. Key management relates to the handling of cryptographic keys and is important for encryption, but it does not address the physical or logical separation of compliant systems from other infrastructure.
• B. Network monitoring is a detective control used to observe traffic and identify threats, but it does not enforce or create separation between compliant and non-compliant systems.
• D. Penetration testing is an assessment technique used to identify vulnerabilities, not a control that enforces separation of systems under compliance requirements.

Memory Tip: Think of compliance systems as being in a "quarantine zone" - isolation keeps regulated systems walled off from the rest of the environment, just like isolating sick patients in a hospital. When you see words like "separately maintained" or "compliance agreement" in an exam question, that's your trigger to think Data Isolation.

No community discussion yet for this question.