Examkin

Soru

Zorluk: ZorSecurity Control Categories and Types

An enterprise security architecture team discovers that a legacy mainframe application processing sensitive financial transactions cannot support native transport layer encryption due to application stack limitations. To mitigate the risk of unauthorized data exposure across internal network segments without modifying legacy software, the team deploys an encrypted IPSec tunnel overlay between dedicated network gateway appliances. Which of the following best classifies both the control category and the functional control type of this IPSec tunnel implementation?

  1. Technical category and Compensating functional typeCevap
  2. B
    Technical category and Preventive functional type
  3. C
    Operational category and Compensating functional type
  4. D
    Managerial category and Directive functional type

Cevap

Technical category and Compensating functional type
The implementation utilizes network devices and cryptographic algorithms (Technical category) to provide an alternative mitigation path when the baseline security requirement cannot be directly integrated into the legacy software (Compensating functional type).

Adım Adım Çözüm

1
Analyze the underlying mechanism to determine the control category.
The control is realized using network hardware, specialized appliances, and cryptographic protocols (IPSec), placing it firmly in the Technical category.
Technical controls (also called logical controls) use hardware, software, or firmware mechanisms to execute security protections.
2
Analyze the deployment rationale to determine the functional control type.
The IPSec overlay is implemented specifically because the legacy application cannot support the primary requirement of native transport layer encryption, designating it as a Compensating control type.
Compensating controls are alternative security measures put in place to achieve the intent of a primary security standard when the primary control is technically unfeasible or prohibitive to implement.

Anahtar Kavram

Dual-Axis Security Control Classification (Categories vs. Functional Types)
Bu soruyu puanla

Konular

Security Control Categories and Types

Bu konudan daha fazla soru