Access Controls CCISO Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of the user access review process in access control administration?

   • ATo monitor network traffic for suspicious activity
   • BTo reset all user passwords on a regular basis
   • CTo create new user accounts for all employees at the start of the year
   • DTo periodically verify that users' access rights are still appropriate for their current job responsibilities
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In the IAAA framework, what is the difference between identification and authentication?

   • AIdentification is the claim of an identity, while authentication is the verification of that claim
   • BIdentification is the process of verifying a user's identity, while authentication is the process of granting access
   • CIdentification and authentication are the same process and are used interchangeably
   • DIdentification is the process of determining what a user can do, while authentication is the process of recording user actions
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is migrating its on-premises application to the cloud. The application consists of a web server and a database server. The security team wants to ensure that the database is not accessible from the internet, but the web server must be accessible from the internet. Which implementation is the most secure and practical?

   • APlace the web server in a public subnet and the database in a private subnet, with a security group on the database that only allows traffic from the web server's security group.
   • BPlace both servers in a private subnet and use a VPN for all access.
   • CPlace the database in a public subnet and the web server in a private subnet.
   • DPlace both servers in a public subnet and rely on the database's password to protect it.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of access control in an information security program?

   • ATo ensure that only authorized subjects can view, modify, or use protected resources
   • BTo create backup copies of data to ensure recovery after a disaster
   • CTo monitor network traffic and block malicious packets from entering the network
   • DTo encrypt all data stored on a system so that it cannot be read without a decryption key
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst notices multiple failed login attempts for a user account, followed by a successful login at 3:00 AM from an unusual location. The analyst then reviews the user's activity logs and finds that large amounts of data were exported. Which IAAA component is primarily being used to attribute these actions to the user?

   • AAuthorization
   • BAccountability
   • CIdentification
   • DAuthentication
   Reveal Solution Discussion Select an answer first