Administrative Application Security CND Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's application development team frequently deploys code changes without following the change management process, leading to misconfigurations and security incidents. The company wants to enforce the process without slowing down development. What is the best approach?

   • ADisable the ability to deploy code changes until the team follows the process.
   • BRequire all changes to be approved by a human change advisory board before deployment.
   • CAutomate the change management process by integrating security checks into the CI/CD pipeline.
   • DConduct a post-deployment review of all changes to identify misconfigurations.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is implementing a new customer portal. The security policy requires that users prove their identity using something they know and something they have. The administrator is configuring the authentication mechanism. What should the administrator implement?

   • AUsername and password only.
   • BBiometric fingerprint scan only.
   • CSecurity questions and a username.
   • DPassword plus a one-time code sent to the user's registered mobile device.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which measure is used to protect data at rest in an application?

   • AUsing HTTPS for web traffic
   • BEncrypting the database files
   • CImplementing a firewall
   • DEnforcing strong password policies
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hospital's patient portal application allows nurses to view patient records. A new nurse joins the cardiology unit and is granted access to all patient records to 'get started quickly.' Later, an audit reveals the nurse accessed records for patients outside the cardiology unit. The hospital wants to prevent this while ensuring the nurse can still do their job. What should the administrator do?

   • ARevoke the nurse's access and re-grant only the cardiology unit's patient records, then review role permissions quarterly.
   • BGrant the nurse read-only access to all records but log all access for auditing.
   • CDisable the nurse's account until a formal access request is approved by the head of cardiology.
   • DKeep the current access but add a warning banner that accessing non-cardiology records is prohibited.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of an administrative security policy for application management?

   • ATo provide a formal set of rules and guidelines for securing applications consistently
   • BTo document the application's source code for future maintenance
   • CTo provide a list of all users who have access to the application
   • DTo replace the need for technical security controls
   Reveal Solution Discussion Select an answer first