Examkin

Question

Difficulty: HardSecurity Control Categories and Types

An enterprise organization updates its endpoint compliance architecture by deploying Mobile Device Management (MDM) software across all remote corporate devices. When an endpoint fails continuous compliance checks or exhibits unauthorized system modifications, the MDM agent automatically executes a remotely triggered cryptographic wipe script to isolate and sanitize the stored sensitive data. A security auditor asks the architecture team to classify this automated software action. Which of the following classifications correctly identifies both the primary category and functional type of this security control?

  1. Technical category and Corrective functional typeAnswer
  2. B
    Operational category and Corrective functional type
  3. C
    Technical category and Deterrent functional type
  4. D
    Managerial category and Preventive functional type

Answer

Technical category and Corrective functional type
The security control is implemented via software logic and automated scripts running on an endpoint, which places it firmly in the Technical control category. Because the script executes automatically following a compliance failure to neutralize data exposure and return the endpoint to a safe state, its functional behavior is Corrective.

Step-by-Step Solution

1
Identify the mechanism used to implement the security control
The mechanism relies on software agents, cryptographic scripts, and automated device technology.
Security measures executed via hardware, software, or firmware belong to the Technical control category.
2
Determine the functional objective of the security control during an incident
The remote wipe script executes after an endpoint fails compliance checks to mitigate risk and reverse exposure.
Controls that react to an incident or compliance failure by restoring security or limiting damage operate as Corrective controls.
3
Synthesize category and functional type classifications
Combining software-based implementation with incident remediation yields a Technical, Corrective control.
CompTIA Security+ classifies automated endpoint software scripts taking post-compromise action under Technical category and Corrective functional type.

Key Concept

Dual-axis classification of security controls (Categories: Technical, Operational, Managerial, Physical; Types: Preventive, Detective, Corrective, Deterrent, Compensating, Directive)
Rate this question

Topics

Security Control Categories and Types

More questions from this topic