SSCP · Question #384
Which of the following is not a preventive operational control?
The correct answer is D. Conducting security awareness and technical training. Preventive operational controls are technical or physical measures put in place to directly stop or reduce the likelihood of a security incident. Protecting endpoints (A), controlling malware/viruses (B), and controlling data media access and disposal (C) are all direct…
Question
Options
- AProtecting laptops, personal computers and workstations.
- BControlling software viruses.
- CControlling data media access and disposal.
- DConducting security awareness and technical training.
How the community answered
(60 responses)- A7% (4)
- B2% (1)
- C8% (5)
- D83% (50)
Explanation
Preventive operational controls are technical or physical measures put in place to directly stop or reduce the likelihood of a security incident. Protecting endpoints (A), controlling malware/viruses (B), and controlling data media access and disposal (C) are all direct, operational preventive actions. Security awareness and technical training (D) is an administrative/management control - it educates people to behave more securely but does not itself technically prevent an incident from occurring. Training is classified as a preventive administrative control, not a preventive operational control, because it acts through human behavior rather than through a technical or physical mechanism.
Topics
Community Discussion
No community discussion yet for this question.