ISC2 CC Prep Online

Network segmentation enforced with firewalls and ACLs restricts which devices, subnets, or services can communicate with critical segments by applying explicit allow/deny rules at security boundaries. This both limits unauthorized access to sensitive network areas and helps contain breaches by reducing lateral movement. An IDS can detect suspicious activity, but it primarily monitors and alerts rather than enforcing which devices may access a segment. SSL/TLS protects data in transit but does not decide whether a device is permitted to connect to a specific network segment. A VPN provides a secure tunnel for remote access, but by itself it does not create internal segmentation boundaries or enforce segment-to-segment access rules for devices already on the corporate network.

If the alternate facility cannot handle the full workload, recovery teams must restore only a subset of services at first, use workarounds, or add capacity before full operations can resume. This typically results in longer downtime and a failure to meet the organization’s stated RTO for critical services. The choice about a lower chance of a disaster is incorrect because backup capacity does not change the probability of disruptive events. The choices claiming faster restoration or improved confidentiality are also incorrect because capacity constraints generally slow recovery and do not inherently strengthen security controls.

Assigning a security guard to verify each person entering is the most effective of the listed measures because a guard can actively challenge and stop someone attempting to follow an authorized person through the door. CCTV cameras primarily provide deterrence and evidence after the fact unless there is continuous monitoring with immediate response. Badge/card readers can control access for the person who presents a credential, but they typically do not prevent someone from following through the same opening without additional controls (such as a guard, turnstile, or mantrap). Antivirus software addresses malware and does not mitigate unauthorized physical entry.