Elements of Information Security CEH Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An e-commerce website experiences periodic traffic spikes during flash sales. The site must remain available to customers, but the company has a limited budget and cannot afford to overprovision servers that sit idle most of the time. Which approach best balances availability and cost?

   • AUse a cloud auto-scaling group that adds instances during high traffic and removes them when demand drops
   • BImplement a queue-based system that delays requests during peak times
   • CPurchase a large number of servers to handle peak traffic at all times
   • DUse a single powerful server with a high-capacity network connection
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A law firm wants to protect client documents stored on a file server. They need to ensure that only attorneys working on a specific case can open the corresponding case files. The firm also wants to minimize disruption to attorneys who frequently switch between cases. Which approach best meets these requirements?

   • AEncrypt the files and require a smart card plus a PIN for every file access
   • BUse NTFS permissions to grant access only to the attorneys assigned to each case
   • CPlace all case files in a shared folder with a single password known to all attorneys
   • DApply full-disk encryption to the server and require a VPN for remote access
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A healthcare organization is deploying a new patient portal. They must comply with data protection regulations that require personal health information to be protected. Which measure is most directly aligned with the privacy principle?

   • AEnsuring the portal is available 99.99% of the time
   • BUsing a strong password policy for all users
   • CImplementing data minimization by collecting only necessary patient data
   • DBacking up patient data daily
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A hospital's patient portal allows doctors to update medication lists. The security team wants to ensure that any unauthorized change to a patient's record is detected, while minimizing impact on the doctors' workflow. Which control best meets this requirement?

   • AEncrypt the entire database with a strong algorithm
   • BRequire a second doctor to approve every change
   • CRestrict all updates to a single designated terminal
   • DImplement database auditing and cryptographic hashing of records
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A hospital's electronic health record (EHR) system must protect patient data. The system is accessed by doctors, nurses, and administrative staff. Recently, a ransomware attack encrypted the database, and the hospital had to restore from backups. The hospital wants to prevent future data loss and ensure that patient records are not altered. Which combination of controls best addresses the CIA triad in this scenario?

   • AUse full-disk encryption and a firewall
   • BDeploy an intrusion detection system and antivirus software
   • CImplement regular encrypted backups, file integrity monitoring, and role-based access control
   • DRequire multi-factor authentication for all users
   Reveal Solution Discussion Select an answer first