Which of the following would NOT be an example of compensating controls being implemented?

A.
Modifying the timing of a system resource in some measurable way to covertly transmit
information

B.
Sensitive information requiring two authorized signatures to release

C.
Asafety deposit box needing two keys to open

D.
Signing in or out of a traffic log and using a magnetic card to access to an operations center

Explanation:
The correct answer is “Modifying the timing of a system resource in some measurable way to
covertly transmit information”. This is the definition for a covert timing channel. The other three are

examples of compensating controls, which are a combination of technical, administrative, or physical
controls to enhance security.