CISA Question 140

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  For CISA control classification, stress and capacity testing are considered detective controls because they identify weaknesses rather than actively stopping failures. The preventive controls are the capacity upgrades or design changes implemented after testing results are analyzed.

• Chose C1

  In this scenario, stress and capacity testing of remote access infrastructure and systems aims to identify and address potential issues related to performance, capacity, and reliability before they impact the organization's ability to support a remote workforce effectively. By conducting these tests, the IT department can ensure that the remote access infrastructure can handle the anticipated workload and maintain acceptable levels of service during peak usage periods, thereby preventing disruptions or outages that could negatively impact remote workers' productivity. Therefore, stress and capacity testing of remote access infrastructure and systems represent a preventive control measure aimed at preemptively addressing potential risks associated with the shift to a remote workforce.

• 2

  C. Preventive control