Access Controls CCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company's IT department is responsible for both developing and deploying its own applications. A security auditor recommends separating the duties of developers and production administrators to reduce the risk of unauthorized code changes. Which access control practice directly implements this recommendation?

   • AUse the same account for developers and administrators to simplify management.
   • BCreate separate roles for developers and production administrators, with no user assigned to both roles.
   • CRequire all code changes to be approved by a single manager.
   • DGrant developers read-only access to production systems.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A system administrator is configuring permissions for a new file share. The CISO has mandated that each user should have the minimum permissions necessary to perform their job. Which principle is being applied?

   • ALeast privilege
   • BDefense in depth
   • CSeparation of duties
   • DNeed to know
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A software development company uses a shared code repository. The security policy requires that developers can commit code to the main branch, but only senior developers can merge pull requests. A junior developer is accidentally added to the 'maintainers' group that has merge rights. Which authorization mechanism should be used to prevent this type of misconfiguration?

   • AApply mandatory access control (MAC) with labels for code files.
   • BImplement role-based access control (RBAC) with a separation of duties policy that prevents the same role from having both commit and merge rights.
   • CRely on periodic access reviews to catch and remove incorrect group memberships.
   • DUse discretionary access control (DAC) where each developer can grant merge rights to others.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which security goal is most directly supported by enforcing access control on a sensitive database?

   • AAvailability
   • BNon-repudiation
   • CConfidentiality
   • DIntegrity
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When an employee leaves the organization, what is the most critical access control administration action to take?

   • ATransfer the employee's access rights to their manager
   • BRevoke all of the employee's access rights and disable their accounts promptly
   • CChange the employee's password to a temporary one and leave the account active
   • DWait until the next scheduled access review to remove the access
   Reveal Solution Discussion Select an answer first