Exam SY0-601 topic 1 question 175 discussion

A malicious investor would not be able to take advantage of anything gained until after the tour if the swiped a USB, looked at or stole documents. If their was a clean desk policy then that would prevent issues after a tour.

>After the tour

There is no clarification on where these desks are located in the bank during or after a tour, so one could ask if these desks were located in the main lobby where anyone could pass by, so a clean desk policy would eliminate anyone from grabbing something off of a desk.

CLEAN DESK 'After A tour' not 'After THE tour.' So 'a tour' is asking for what is the best policy in general to apply for when visitors are on a tour. Another poorly worded question and that's why many have voted for C. Access control is irrelevant here because a tour means one is guided by another. They will be constantly monitored and unable to access restricted areas or systems. An outside contractor doing work may be able to roam freely.

imagine you've forgotten to take away the access permission which you've given to the investors. i might be thinking complex but im gonna go with c.

D. Clean desk

I chose D. Clean Desk This policy would prevent the visitors from seeing confidential documents or sensitive material that they would use for malicious activity AFTER the tour In the study guide, under Security Policy's, Standards, and Management an Access Control Policy is NOT noted as a Personal Management Policy. However, if you think of this Access Control policy as physical access controls than yes that makes sense as a preventative DURING the tour and AFTER the tour but if you think of Access Control as the schemas or privileges to secure access to devices than this policy would not makes sense.

Access control policies are designed to limit and control who has access to specific areas or information. After SOC tours, it's essential to ensure that individuals who attended the tour do not have unauthorized access to sensitive areas or data. Access control policies can help restrict access to only authorized personnel, reducing the risk of malicious activity after the tour.

Clean desk is irrelevant if intruders are able to access the site AFTER the tour. You try to stop intruders at the front door, not AFTER they are already in your building.

ANSWER C: Access Control Clean desk only one potential risk but access control will prevent not only desks but also other areas, for example Limit access: Ensure that only authorized individuals are allowed to enter the SOC and other sensitive areas. Visitor restrictions: Specify rules for visitors, such as escort requirements, visitor badges, and supervised access. Restrict privileges: Define the level of access and actions that visitors can take during the tour, ensuring that they cannot compromise security or access sensitive information.

The keyword here is "AFTER the tour." Having a clean desk policy is pointless if you do it AFTER the tour. The most coherent answer would be "Access Controls," i.e., checking that everyone who came on the tour has left and no one remains in the organization.

Access control will prohibit them from entering high-risk areas. I don't get clean desk policy, what, are they going to steal random papers, or hope idiots will leave pendrives with valuable data on desk? These are not random people, those are investors, one slip up and their reputation is doomed.

Tours means that people will sign visitors logs and most likely be escorted into the area. Which leaves cleaning the desk.

IMO after a tour situation access control would best best measure to take coz infrastructure should be laid tight control. Even any password on desk only authorized person can access into system.

Clean Desk - If the investors are already on a tour of the SOC then access management is already out the window, your best practice at this point is to make sure your desk is clear of anything sensitive including your screen(s)

The clean desk policy would be the best policy to reduce the risk of malicious activity occurring after a SOC (Security Operations Center) tour. A clean desk policy requires employees to keep their work areas tidy and free from sensitive information when they are not present. This policy helps prevent unauthorized individuals, including potential investors during a tour, from gaining access to sensitive documents or information that could be used for malicious purposes.

The way we understood the question makes the correct answer confusing. As per my understanding, the answer should point to what should be done after the tour which makes C the correct answer. You don't clean desk after a tour in the SOC, u do that before.