(ISC)2 Certified in Cybersecurity Practice Exam

What type of controls utilize processes to achieve control objectives?

1. Technical Controls

2. Operational Controls

3. Administrative Controls

4. Physical Controls

The correct answer is: Administrative Controls

The type of controls that utilize processes to achieve control objectives are defined as administrative controls. These controls focus on the policies, procedures, and processes that govern how an organization operates. They are designed to establish a framework for managing an organization's security posture through the implementation of rules and guidance regarding the behavior of personnel and the operation of technology. Administrative controls often include activities such as training, awareness programs, incident response procedures, risk assessment methodologies, and compliance with regulations. By clearly defining roles, responsibilities, and expectations through documented processes, organizations can maintain a proactive approach to managing security risks. In contrast, technical controls involve technology solutions such as firewalls, encryption, and antivirus software, which rely on hardware or software mechanisms to protect data and systems. Operational controls, while also crucial, typically pertain to the day-to-day procedures and practices that support security but don't emphasize the overarching policies and processes as significantly as administrative controls do. Physical controls directly relate to securing physical access to facilities and equipment rather than focusing on process management.