Security audits and tests, incident response plans, and separation of duties are best classified as administrative security controls because they involve policies, procedures, monitoring, governance, and assignment of responsibilities. Administrative controls are designed to manage human behavior and organizational processes that support cybersecurity. The ACFE material discusses computer security controls, including separation of duties, security audits and tests, and incident response planning, as part of a broader control environment for preventing and detecting cyberfraud. Logical access controls focus on system permissions and authentication. Physical access controls protect facilities and hardware. Technical controls are automated or technology-based safeguards. Since the listed items mainly involve procedures, oversight, and response planning, administrative security controls is the best answer.

================