Examkin

Question

Difficulty: Very hardSecurity Control Categories and Types

Following a major security incident involving a compromised legacy jump box, an enterprise security team implements two immediate measures: (1) deploying custom Web Application Firewall (WAF) rate-limiting rules to shield the legacy application while developers rebuild the primary authentication microservice, and (2) establishing an enterprise-wide policy requiring formal executive sign-off for any future jump box configuration modifications. Which of the following correctly classifies Measure 1 and Measure 2 by their control category and functional type?

  1. Measure 1 is a Technical / Compensating control; Measure 2 is a Managerial / Directive control.Answer
  2. B
    Measure 1 is an Operational / Corrective control; Measure 2 is a Technical / Directive control.
  3. C
    Measure 1 is a Technical / Corrective control; Measure 2 is a Managerial / Deterrent control.
  4. D
    Measure 1 is a Managerial / Compensating control; Measure 2 is an Operational / Preventive control.

Answer

Measure 1 is classified as a Technical / Compensating control, and Measure 2 is classified as a Managerial / Directive control.
Deploying WAF rate-limiting rules relies on technical software enforcement to provide an alternative guardrail while primary authentication mechanisms are constructed, making it a Technical / Compensating control. Enforcing executive sign-off through formal policy sets organizational rules and oversight, making it a Managerial / Directive control.

Step-by-Step Solution

1
Analyze Measure 1 (Deploying temporary WAF rate-limiting rules while rebuilding authentication).
Control Category = Technical; Functional Type = Compensating.
WAF rules are automated software mechanisms (Technical). Because they temporarily mitigate risk while the primary authentication control is missing or being rebuilt, they function as a Compensating control.
2
Analyze Measure 2 (Establishing enterprise policy requiring executive sign-off for configuration changes).
Control Category = Managerial; Functional Type = Directive.
Governance policies and administrative oversight rules are defined by management (Managerial). Controls that specify or mandate required organizational behavior operate as Directive controls.

Key Concept

Dual-Axis Security Control Classification (Categories vs. Functional Types)
Rate this question

Topics

Security Control Categories and Types

More questions from this topic