Is this accurate

1.	What is a primary purpose of security controls?
o	A) Increase productivity
o	B) Protect information assets
o	C) Generate revenue
o	D) None of the above

2.	What type of control aims to prevent security incidents before they occur?
o	A) Detective Controls
o	B) Corrective Controls
o	C) Preventative Controls
o	D) Compensatory Controls

3.	Which of the following is an example of a preventative control?
o	A) Incident Response Plan
o	B) Firewalls
o	C) Log Analysis
o	D) SIEM Systems

4.	What is the main function of detective controls?
o	A) Prevent breaches
o	B) Detect unauthorized activities
o	C) Repair systems
o	D) Train employees

5.	Which tool is used for detecting suspicious network activity?
o	A) Access Control Lists
o	B) Intrusion Detection Systems
o	C) Backup Solutions
o	D) Environmental Controls

6.	What do corrective controls aim to do?
o	A) Prevent incidents
o	B) Identify risks
o	C) Rectify issues after they occur
o	D) Train users

7.	Which of the following is a compensatory control?
o	A) Security Awareness Training
o	B) Multi-Factor Authentication
o	C) Incident Response Plan
o	D) Firewalls

8.	What is the purpose of physical controls?
o	A) Online data protection
o	B) Safeguarding physical assets
o	C) Training employees
o	D) Detecting breaches

9.	Which of the following is NOT a technical control?
o	A) Virtual Private Networks (VPNs)
o	B) Endpoint Security
o	C) Security Policies
o	D) Multi-Factor Authentication

10.	Administrative controls include:
o	A) Firewalls
o	B) Security policies and procedures
o	C) Access Control Lists
o	D) Physical barriers

11.	What is the aim of deterrent controls?
o	A) Detect breaches
o	B) Rectify issues
o	C) Discourage attacks
o	D) Monitor systems

12.	Data Backup Solutions are an example of:
o	A) Detective Controls
o	B) Corrective Controls
o	C) Preventative Controls
o	D) Administrative Controls

13.	The Equifax data breach was largely due to:
o	A) Weak passwords
o	B) Delayed patching of known vulnerabilities
o	C) Lack of employee training
o	D) Insider threats

14.	What does the principle of confidentiality in information assurance focus on?
o	A) Data accuracy
o	B) Data availability
o	C) Data protection from unauthorized access
o	D) Data processing speed

15.	Which approach uses key performance indicators (KPIs) to assess security controls?
o	A) Compliance Checks
o	B) Measuring Effectiveness
o	C) Incident Response Training
o	D) Phishing Simulations

16.	What are Security Information and Event Management (SIEM) systems used for?
o	A) Implementing access policies
o	B) Collecting and analyzing security data
o	C) Conducting training programs
o	D) Patching software

17.	What is a common result of not having an adequate incident response plan?
o	A) Increased employee productivity
o	B) Quick resolution to issues
o	C) Difficulty in recovering from breaches
o	D) Enhanced security culture

18.	What are phishing simulations used for in organizations?
o	A) Monitoring system performance
o	B) Evaluating employee security awareness
o	C) Data backup testing
o	D) Regulatory compliance

19.	Regular audits are essential for ensuring:
o	A) Regulatory compliance
o	B) Increased costs
o	C) Employee dissatisfaction
o	D) Larger datasets

20.	What is the importance of continuous monitoring in security?
o	A) To increase employee workload
o	B) To detect anomalies in real-time
o	C) To delay incident response
o	D) To limit data access

21.	What kind of control is a warning sign indicating surveillance is in operation?
o	A) Administrative Control
o	B) Detective Control
o	C) Deterrent Control
o	D) Corrective Control

22.	What does the principle of integrity ensure in information security?
o	A) Data is always available
o	B) Data remains unchanged without authorization
o	C) Data is always backed up
o	D) Data is encrypted

23.	Which of the following statements about corrective controls is true?
o	A) They prevent incidents from occurring.
o	B) They aim to restore normal system operations after a breach.
o	C) They are primarily administrative in nature.
o	D) They do not include incident response plans.

24.	A business continuity plan is intended to:
o	A) Create new data
o	B) Ensure operations continue during a crisis
o	C) Control access to sensitive data
o	D) Improve cybersecurity training

25.	Which of the following is a key characteristic of effective security control?
o	A) High-cost implementation
o	B) Regularly updated and evaluated
o	C) Always operational
o	D) Limits employee access

26.	Incident response training should include:
o	A) Hands-on breach simulation exercises
o	B) Technical jargon
o	C) Documentation only
o	D) External monitoring

27.	What is a notable feature of external audits?
o	A) Conducted by internal staff
o	B) Provide an objective assessment of security posture
o	C) Only focus on compliance
o	D) May skip critical evaluations

28.	Effective security controls contribute to which concept?
o	A) Increased market share
o	B) Organizational reputation
o	C) Risk management
o	D) All of the above

29.	The term "user access management" refers to:
o	A) Monitoring internet speed
o	B) Policies governing user roles and access levels
o	C) Data encryption strategies
o	D) Incident reporting systems

30.	Regular patching and updates are crucial for:
o	A) Enhancing employee morale
o	B) Minimizing vulnerability exploitation
o	C) Increasing operational costs
o	D) Restricting network access


Answer Key:
1.	Answer: B - Security controls are designed to protect a company's information assets.
2.	Answer: C - Preventative controls are intended to stop incidents before they happen.
3.	Answer: B - Firewalls limit unauthorized access, making them preventative controls.
4.	Answer: B - Detective controls are designed to identify and alert organizations of unauthorized actions.
5.	Answer: B - Intrusion Detection Systems monitor for abnormal behavior.
6.	Answer: C - Corrective controls are focused on fixing issues post-incident.
7.	Answer: C - Incident Response Plans can serve as compensatory measures when standard controls fail.
8.	Answer: B - Physical controls are designed to protect tangible assets and facilities.
9.	Answer: C - Security policies fall under administrative controls, not technical.
10.	Answer: B - Administrative controls consist of governance documents and employee training.
11.	Answer: C - Deterrent controls seek to dissuade potential attackers.
12.	Answer: B - Data Backup Solutions aim to recover systems post-incident.
13.	Answer: B - The failure to patch a known vulnerability led to the breach.
14.	Answer: C - Confidentiality ensures sensitive data is only accessible to authorized users.
15.	Answer: B - Assessing performance via KPIs is part of measuring effectiveness.
16.	Answer: B - SIEM systems analyze security logs to detect threats.
17.	Answer: C - Ineffective incident response can hinder recovery from security incidents.
18.	Answer: B - Phishing simulations help assess how well employees recognize and respond to phishing attempts.
19.	Answer: A - Audits help organizations ensure compliance with security requirements.
20.	Answer: B - Continuous monitoring helps organizations respond quickly to security threats.
21.	Answer: C - Warning signs are intended to deter potential attackers.
22.	Answer: B - Integrity ensures that data modifications are authorized.
23.	Answer: B - Corrective controls focus on recovery after incidents.
24.	Answer: B - Business continuity planning prepares organizations for ongoing operations during crises.
25.	Answer: B - Effective security controls must be regularly reviewed and updated according to evolving threats.
26.	Answer: A - Hands-on exercises prepare teams for real incidents.
27.	Answer: B - External audits are objective and assess security comprehensively.
28.	Answer: D - Security controls are integral to risk management, reputation, and can impact market share.
29.	Answer: B - User access management involves defining user permissions and roles.
30.	Answer: B - Patching is fundamental to close security gaps and reduce exploitation chances.