712-50 Question 256
Single answerUnderstand the importance of warning banners for implementing access rulesA newly appointed CISO is standardizing access control across the company's VPN, privileged access management (PAM) portal, and remote administrator consoles. During a legal review, counsel notes that the organization has acceptable use and monitoring policies, but users can authenticate directly into systems without seeing any warning or consent message. The security team wants to strengthen enforcement of access rules and improve the organization's position in employee misconduct investigations. Which action should the CISO prioritize?
- A
Implement a pre-authentication warning banner that states the system is for authorized use only, activities may be monitored, and use constitutes consent to monitoring and enforcement of company policies.
- B
Publish the acceptable use policy on the intranet and require annual acknowledgment, since repeating the policy at login provides little additional value.
- C
Display a post-login informational message reminding users to follow security policy, because users are already authenticated and the message will not interfere with access.
- D
Rely on technical controls such as MFA and session logging instead of warning banners, because banners do not materially affect access rule enforcement.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement a pre-authentication warning banner. In enterprise security programs, warning banners are commonly used to support access control governance, acceptable use enforcement, and monitoring notice. They are especially important for systems containing sensitive data, administrative functions, or remote access capability. A properly worded banner typically states that the system is restricted to authorized users, that there is no expectation of privacy or that activity may be monitored to the extent permitted by law and policy, and that continued use signifies consent to monitoring and compliance with company rules. From a governance perspective, this aligns with common control frameworks and security practices that emphasize administrative controls alongside technical controls. For example, NIST SP 800-53 includes system use notification concepts under AC-8, and many organizations use warning banners to support investigative and disciplinary processes. While wording should be reviewed by legal counsel to comply with local privacy and labor laws, the CISO should prioritize pre-access notification because it most directly reinforces access rules at the moment of use.
- A. Correct.
Correct. A pre-authentication warning banner is a key administrative and legal control that supports implementation of access rules by clearly notifying users that access is restricted to authorized purposes, that activity may be monitored, and that continuing indicates consent. This helps distinguish authorized from unauthorized use, reinforces acceptable use requirements at the point of access, and can strengthen the organization's position during investigations, disciplinary actions, and potential legal proceedings.
- B. Incorrect.
Incorrect. Annual acknowledgment of an acceptable use policy is useful, but it is not an effective substitute for a login warning banner. A banner presented at the time of access provides immediate notice tied to the specific session and system being accessed. The misconception is that a policy acknowledgment alone creates the same evidentiary and deterrent value as an explicit access warning at sign-in.
- C. Incorrect.
Incorrect. A post-login message is weaker because the user has already been granted access before the warning is displayed. For enforcement and consent purposes, the preferred approach is to present the banner before authentication or before access is completed, so the user is on notice before entering or continuing into the system.
- D. Incorrect.
Incorrect. MFA and logging are important technical controls, but they do not replace the purpose of warning banners. The misconception is treating banners as purely cosmetic. In practice, banners complement technical controls by providing notice, clarifying authorization boundaries, and supporting monitoring and disciplinary enforcement.