Explain Access Management Principles 100-160 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An organization is updating its password policy. The security team wants to reduce the risk of brute-force attacks while minimizing user frustration. The current policy requires 8-character passwords and no expiration. Which policy change best balances security and usability?

   • AKeep the 8-character minimum but add a lockout policy after 5 failed attempts.
   • BIncrease the minimum length to 15 characters and remove the complexity requirement.
   • CRequire a 12-character password and force a change every 60 days.
   • DRequire a 6-character password with complex characters and change it every 30 days.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A bank wants to protect customer accounts from unauthorized access even if a customer's password is stolen. The bank already requires a username and password. Which additional control would provide the strongest protection?

   • AMonitor login locations and block unusual ones.
   • BRequire customers to change their password every 30 days.
   • CRequire a one-time passcode sent via SMS or generated by an authenticator app.
   • DImplement a CAPTCHA after login attempts.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hotel offers Wi-Fi to guests. The front desk wants to issue temporary credentials that expire after checkout, and the hotel wants to track which guest used the network. Which solution is most appropriate?

   • AProvide guests with a QR code that grants access without authentication.
   • BConfigure each access point with a local guest account.
   • CUse a RADIUS server with a guest database that supports time-based expiration and accounting logs.
   • DUse a single shared password for all guests and change it daily.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company's password policy requires 10-character passwords with complexity and a 90-day expiration. The security team wants to reduce the risk of password spraying attacks. Which change would be most effective?

   • ADisable account lockout to avoid locking out legitimate users.
   • BImplement account lockout after a small number of failed attempts and increase the minimum password length.
   • CRequire a special character in addition to the existing complexity.
   • DShorten the password expiration period to 30 days.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is deploying a new remote-access VPN. The security team requires that users authenticate with both a corporate smart card and a PIN, and that the VPN gateway log all successful and failed login attempts. The team also wants to avoid managing user accounts on the VPN gateway itself. Which solution best meets all requirements?

   • AImplement a separate authentication server that only validates PINs and does not integrate with the directory.
   • BUse the VPN gateway's built-in certificate authentication without a PIN.
   • CCreate local user accounts on the VPN gateway for each employee and require smart-card authentication.
   • DConfigure the VPN gateway to use RADIUS authentication against the corporate directory, with the RADIUS server validating smart-card certificates and PINs, and enable RADIUS accounting.
   Reveal Solution Discussion Select an answer first