What is the principle of least privilege in user access management?

Granting users the minimum level of access required to perform their job functions

Granting all users the same level of access to simplify administration

Granting users access only to the applications they use most frequently

Granting users access based on their seniority in the organization

A system administrator is configuring a new internally developed web application. The application uses a configuration file that contains database credentials. The administrator wants to prevent these credentials from being exposed. What is the most secure configuration approach?

Embed the credentials in the configuration file and set the file permissions to read-only for all users.

Use environment variables or a dedicated secrets management service to store the credentials, and restrict access to the configuration file.

Encrypt the configuration file with a hard-coded key in the application code.

Store the credentials in the application's source code repository so developers can easily access them.

Which mechanism is commonly used to enforce authorization in an application?

Multi-factor authentication (MFA)

Role-based access control (RBAC)

What is the difference between authentication and authorization?

Authentication is a one-time process; authorization is continuous

Authentication verifies identity; authorization determines what an authenticated user is allowed to do

Authentication determines permissions; authorization verifies identity

Authentication is used for users; authorization is used for applications

What is the primary purpose of administrative application security?

To ensure that applications are developed using secure coding practices

To manage and configure applications to protect organizational data and maintain their integrity and availability

To replace the need for network security controls by securing applications directly

To ensure that only the application development team can access the application

EC-CouncilCertified Network Defender

Domain 3Objective 1

Administrative Application Security CND Practice Questions (Page 1)

Part of the Application and Data Security domain, which makes up ~10% of our current practice bank.

41questions here

9free pages

10concepts

Questions 1–5

1foundation · easy
What is the principle of least privilege in user access management?
Select an answer first
2application · medium
A system administrator is configuring a new internally developed web application. The application uses a configuration file that contains database credentials. The administrator wants to prevent these credentials from being exposed. What is the most secure configuration approach?
Select an answer first
3foundation · easy
Which mechanism is commonly used to enforce authorization in an application?
Select an answer first
4foundation · easy
What is the difference between authentication and authorization?
Select an answer first
5foundation · easy
What is the primary purpose of administrative application security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.