Scenario: The process of testing and/or evaluating security controls to determine if they are implemented correctly and operating as intended. Which concept is this?

• A. Security Control Assessment
• B. Security Control Baseline
• C. Availability
• D. Confidentiality

Answer: (A)

The central idea here is evaluating security controls to verify they are in place and working as intended. This is what a Security Control Assessment does: it tests and reviews the controls, collects evidence, and determines whether they are implemented correctly and operating as expected to achieve the required security outcomes. It’s the concrete step that confirms the controls actually function to protect assets, supporting confidentiality, integrity, and availability as designed.

A baseline refers to the defined set of controls you agree to implement to meet a minimum security level, not the testing process itself. Availability and confidentiality are security objectives or properties, not the activity of assessing controls.