Examkin

Question

Difficulty: MediumSecurity Control Categories and Types

An organization requires department managers to perform quarterly user access reviews by manually evaluating account permissions and verifying that assigned rights match current job responsibilities. Which of the following best classifies both the security control category and functional type of this process?

  1. A
    Technical category and Preventive functional type
  2. B
    Managerial category and Directive functional type
  3. Operational category and Detective functional typeAnswer
  4. D
    Operational category and Corrective functional type

Answer

Operational category and Detective functional type
The correct answer is 'Operational category and Detective functional type'. Under the CompTIA Security+ framework, Operational controls refer to security measures implemented and executed by people through daily procedures and administrative operations. Periodic user access certification conducted by department managers is an operational process. Functionally, reviewing account rights identifies unauthorized permissions or privilege accumulation (privilege creep) that has already occurred, making it a Detective control.

Step-by-Step Solution

1
Determine the security control category
Operational control category
Control categories in CompTIA Security+ SY0-701 are divided into Technical, Managerial, Operational, and Physical. Routine day-to-day security procedures executed by human staff and managers—such as manual log reviews or quarterly user permission audits—fall under the Operational category.
2
Determine the functional type of the control
Detective functional type
Functional types define the operational goal of the control (Preventive, Detective, Corrective, Deterrent, Compensating, Directive). Auditing existing user rights allows organizations to uncover privilege creep or non-compliant permissions after they have been granted, fulfilling a Detective function.
3
Combine category and functional type to identify the correct classification
Operational category and Detective functional type
Combining the category determined in Step 1 with the functional type determined in Step 2 yields Operational category and Detective functional type.

Key Concept

Security Control Categories and Functional Types
Estimated Time:1m 15s
Rate this question

Topics

Security Control Categories and Types

More questions from this topic