Exam 712-50 topic 1 question 71 discussion

D. Technical control Explanation: A firewall ruleset review is classified as a technical control because it involves the direct configuration, maintenance, and auditing of a technical security mechanism (the firewall). Key Reasons: Technical controls are measures implemented through hardware, software, or firmware to enforce security policies. Examples: Firewalls, IDS/IPS, encryption, access control lists (ACLs). Firewall ruleset reviews require technical expertise to analyze: Rule effectiveness (e.g., blocking unauthorized traffic). Redundant or overly permissive rules. Compliance with security policies.

C. Management control Explanation: The regular review of a firewall ruleset is an example of a management control because it involves oversight and assessment of security practices to ensure that they are aligned with organizational policies and objectives. Management controls are typically focused on the direction, coordination, and evaluation of security processes, including reviewing, updating, and ensuring compliance with security configurations and policies.

Just to complete NIST SP.800-26, indicates 3 types of control categories Management Operational Technical

NIST indicates 2 types of security controls - Management, Operational & Technical. However, since Management and Technical are not related and there is nothing called Orgn control, the remaining option is Procedural Control.