22. An organization is implementing a new hybrid cloud deployment. Before granting access to any of the resources, the security team wants to ensure that all employees are checked against a database to see if any risk is posed to the organization by hiring them. Which type of security control is the organization leveraging for its employees?
Answer: D
The organization is leveraging background checks for its employees.
The organization is implementing background checks to assess any risks posed by potential employees before granting them access to resources in a hybrid cloud deployment.
A) Authentication
Authentication refers to the process of verifying an individual's identity, typically through credentials such as passwords or biometrics. While important for security, it does not involve assessing the risk associated with hiring employees, making it incorrect in this context.
B) Web application firewall (WAF)
A web application firewall is a security measure that monitors and filters incoming traffic to a web application. It is not relevant to evaluating employee backgrounds or risks, thus it does not apply to the hiring process described in the scenario.
C) Authorization
Authorization is the process of granting or denying access rights to resources based on verified identity. Although it is a critical part of security, it follows authentication and does not pertain to the proactive assessment of employee risks before hiring.
D) Background check
Background checks are thorough investigations into a potential employee's history, including criminal records, employment history, and other factors that might indicate a risk to the organization. This aligns perfectly with the organization's goal of ensuring safety before granting access to resources.
Conclusion
The correct answer, background check, directly addresses the organization's need to evaluate the risks of potential employees prior to granting access to resources. All other options, including authentication, WAF, and authorization, focus on different aspects of security that do not involve pre-employment risk assessment, thereby confirming that D is the only suitable choice.