Security Control Gap Documentation Quiz

1. Which metric should be included when documenting the severity of a control gap?

Number of employees affected

Time to remediate

CVSS score or similar risk rating

Vendor support availability

Submit

6. Which of the following is a key element in documenting a control gap for audit purposes?

Executive approval signatures

Evidence of the gap and its potential impact

Competitor benchmark comparisons

Marketing department sign-off

7. An organization has documented a control gap but lacks budget to remediate it immediately. What should the analyst recommend?

Ignore the gap until funding is available

Implement a compensating control and monitor the risk

Disclose the gap to external auditors only

Accept the risk without documentation

8. When prioritizing control gaps, which factor should receive the highest weight?

Ease of remediation

Risk to business objectives and compliance requirements

Vendor availability

Current budget allocation

9. What is the primary purpose of a control gap remediation roadmap?

To document historical security incidents

To outline the timeline and resources needed to close gaps

To eliminate all security risks permanently

To assign blame for control failures

10. A security analyst finds that encryption is not enforced for sensitive data at rest. Which CIA triad component is primarily at risk?

Confidentiality

Integrity

Availability

Accountability

11. When documenting a security control gap, which element is most critical to include first?

Detailed remediation timeline

Clear identification of the missing or ineffective control

Cost-benefit analysis

Vendor recommendation

12. An organization's access control policy states roles must be reviewed quarterly, but reviews occur annually. What is this gap called?

Design gap

Implementation gap

Operational gap

Strategic gap

13. When documenting control gaps, why is asset classification important?

It determines the color scheme of reports

It helps prioritize gaps based on asset criticality and sensitivity

It eliminates the need for risk assessment

It ensures compliance with all regulations simultaneously

14. A vulnerability scanner identifies that servers lack host-based intrusion detection. This represents a gap in which control type?

Preventive control

Detective control

Corrective control

Deterrent control

15. In the context of control gaps, what does 'compensating control' mean?

A control that replaces a missing primary control with equivalent protection

A control that increases system performance

A control that reduces operational costs

A control that simplifies compliance reporting

16. Which document type should a security analyst use to formally communicate a discovered control gap to management?

Informal email summary

Risk assessment report with remediation plan

Chat message to IT staff

Verbal briefing only

17. A company lacks multi-factor authentication on remote access systems. This control gap primarily affects which security goal?

Availability

Integrity

Confidentiality

Non-repudiation

18. When assessing a control gap, what is the relationship between likelihood and impact?

They are unrelated to risk calculation

Risk = Likelihood × Impact

Impact always supersedes likelihood

Likelihood determines compliance status

19. Which framework is most commonly used to classify and document security control gaps in enterprise environments?

COBIT

NIST Cybersecurity Framework

ISO 27001

All of the above

20. A security analyst discovers that system patches are not being applied within 30 days of release. What type of control gap is this?

Preventive control gap

Detective control gap

Corrective control gap

Compensating control gap

Security Analyst Documenting a Security Control Gap Quiz