Certified Information Systems Security Professional (CISSP) — Question 175

An information security consultant is asked to make recommendations for a small business to protect the access to information, stored on network drives. The small business supports several government agencies that manage highly sensitive information. Which of the following recommendations is BEST to achieve this objective?

Answer options

• A. Develop and implement a security information and event monitoring system.
• B. Develop and implement access management policies and procedures.
• C. Develop and implement data center access policies and procedures.
• D. Develop and implement a security operations center (SOC) for access monitoring.

Correct answer: B

Explanation

The correct answer, B, is the best option because developing access management policies and procedures directly addresses the need to control who can access sensitive information stored on network drives. Options A, C, and D, while important for overall security, do not specifically target the management of access to information, which is the primary concern in this scenario.