Study. uk . com
  1. Home
  2. All questions
  3. Question 362

CISSP study material · question 362 of 500

A design permits a cleared analyst to read a classified report but must also stop that report being copied to a system rated for lower classification. Which SP 800-53 control addresses the second requirement?

  1. Separation of duties, which divides the handling of classified material.
  2. Information flow enforcement, which governs where information may travel rather than who may read it.
  3. Device lock, which prevents unattended access to the workstation.
  4. Least privilege, which limits what the analyst's account can do.
Show the answer

Answer: B. Information flow enforcement, which governs where information may travel rather than who may read it.

AC-4 regulates where information can travel within a system and between systems, in contrast to who is allowed to access it, and applies without regard to subsequent accesses.

Source: NIST SP 800-53 Rev. 5 (NIST) — SP 800-53 Rev. 5 > AC-4 Information Flow Enforcement

Challenge yourself on this topic → Study as cards