Which two security control decisions indicate optimal security control behavior? (Choose two.)