(ISC)2 Certified in Cybersecurity Practice Exam

Which of the following is an example of administrative control?

1. Installing a firewall

2. Applying software updates automatically

3. Implementing access control policies

4. Configuring network devices

The correct answer is: Implementing access control policies

Administrative controls are management-directed policies and procedures that help ensure the integrity and security of information systems. They focus on managing user behavior and organizational practices to mitigate risk. Implementing access control policies serves as a fundamental example of an administrative control because it establishes guidelines on who can access certain resources within an organization. This includes defining user roles, permissions, and access levels, which are essential to safeguarding sensitive information. By having clear access control policies in place, organizations can effectively manage user privileges and prevent unauthorized access, thereby contributing significantly to the overall security posture. Other options, while critical in cybersecurity, represent technical measures or processes rather than administrative controls. For instance, installing a firewall, applying software updates automatically, and configuring network devices primarily involve the technical configuration of hardware and software systems to protect data and prevent breaches. These are more aligned with physical and technical controls rather than the administrative framework that governs how an organization operates.