Which of the following would NOT be an example of compensating controls
being implemented?

A.
Modifying the timing of a system resource in some measurable way to covertly transmit
information

B.
Sensitive information requiring two authorized signatures to release

C.
Asafety deposit box needing two keys to open

D.
Signing in or out of a traffic log and using a magnetic card to access to
an operations center

Explanation:
The correct answer is “Modifying the timing of a system resource in some measurable way to
covertly transmit information”. This is the definition for a covert timing
channel. The other three are examples of compensating controls, which are a combination of
technical, administrative, or physical controls to enhance security.