The system administrator has deployed updated security controls for the network to limit risk of attack.
The security manager is concerned that controls continue to function as intended to maintain appropriate
security posture.
Which of the following risk mitigation strategies is MOST important to the security manager?

A.
User permissions

B.
Policy enforcement

C.
Routine audits

D.
Change management

Explanation:
After you have implemented security controls based on risk, you must perform routine audits. These
audits should include reviews of user rights and permissions as well as specific events. You should pay
particular attention to false positives and negatives.
Incorrect Answers:
A: User permissions are part of the routine checks that should be followed.
B: Policy enforcement usually refers to account policies and these determine the security parameters
regarding who may and may not access the system. These are already in place and should be routine
checked in this scenario.
D: Change management is the structured approach that is followed to secure a company’s assets.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis,
2014, p. 28