Distinguish technical, administrative, and physical controls, giving an example of each from the lesson.
Answer
Technical controls use technology, such as firewalls or multifactor authentication. Administrative controls guide people and processes, such as policies or employee training. Physical controls restrict access to facilities or equipment, such as secure access measures.
Explanation
### Why this is right
The categories distinguish the mechanism a safeguard uses. Technology-based protections are technical, organizational practices are administrative, and protections for physical spaces or equipment are physical.
### The concept
A control can address the same broad security goal in different ways. For example, a technical tool may restrict network activity, an administrative rule may define how employees handle information, and a physical safeguard may limit entry to a server area. Organizations often combine categories because a single measure may not address every route to harm.
### What a good answer covers
- Define technical controls and give an example.
- Define administrative controls and give an example.
- Define physical controls and give an example.
- Explain that controls can complement one another.
### Terms
- **Physical control**: a safeguard that protects people, facilities, or equipment through physical access restrictions.
### Remember
Ask whether the safeguard acts through technology, organizational practice, or physical access.
Related Questions
- Which sequence correctly represents the core risk assessment steps listed in the lesson?(basic)
- A ransomware event has a 20% annual chance and an expected loss of $500,000 per incident. Using ALE = SLE × ARO, what is the estimated annualized loss?(intermediate)
- Which option correctly classifies a firewall in the lesson’s control categories?(basic)
- The e-z-buy application must handle usernames, passwords, and payment information while meeting a stated 99.999% uptime requirement. Which planning response best follows the lesson?(advanced)
- A team is modeling a database system and considers a possible structured query language injection attack. What is the main purpose of this activity?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free