When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?
A. Log all activities associated with sensitive systems
B. Provide links to security policies
C. Confirm that confidentially agreements are signed
D. Employ strong access controls
|
Download Printable PDF. VALID exam to help you PASS. |
 |
In the ISACA style, option C is correct, but for CISSP, D is correct.
Because ISC2 always asks the common sense approach and the super common sense approach (example: question number # 219).
The contract is just a contract and does not guarantee that all parties will actually comply.
So this is a question of complementary control.
Critical Data Assets are physical parts or devices. They require physical security parameters to be secure. by choosing option “C”. By Employing Strong Access Controls you are using Physical Security Techniques
Third-party vendors probably don’t need access to every computer on your organization’s network (unless they’re servicing them or providing data protection services that involve configuring all your internal network security endpoints). So, it’s a good idea to take a careful look at what you’re outsourcing to that vendor and make sure they only have access to the specific apps and databases that they need to do those specific tasks.
How to Protect Your Data When Outsourcing to 3rd Party Companies
https://blog.knogin.com/protect-your-data-outsourcing
Why not “C”?