(ISC)2 Certified in Cybersecurity Practice Exam

What is the function of a security control?

1. To create new vulnerabilities

2. To reduce or mitigate security risks

3. To identify potential threats

4. To escalate security incidents

The correct answer is: To reduce or mitigate security risks

The function of a security control is fundamentally to reduce or mitigate security risks. Security controls are measures implemented within an organization to protect its assets, data, and overall infrastructure from threats and vulnerabilities. These controls can take various forms, such as physical, technical, or administrative measures, and they work by reducing the likelihood of security incidents or their potential impact. By implementing effective security controls, organizations can create a more resilient security posture that limits the opportunities for attackers to exploit weaknesses. For instance, technical controls such as firewalls and intrusion detection systems monitor and restrict unauthorized access to networks, while administrative controls, like security policies and employee training, foster a culture of security awareness within the organization. While identifying potential threats and escalating security incidents are crucial tasks in a cybersecurity framework, they are largely part of the broader security management process and do not constitute the primary function of what security controls are meant to do. Instead, security controls focus specifically on mitigating risks. Creating new vulnerabilities is counterproductive to the goal of enhancing security, making that option clearly misaligned with the purpose of implementing controls.