Administrative Application Security CND Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's application stores customer personal data. The company wants to implement data protection measures that allow them to respond to data subject access requests (DSARs) and demonstrate compliance. What is the most important control to implement?

   • AEnable detailed logging of all access to personal data.
   • BImplement a data classification scheme and maintain an inventory of where personal data is stored.
   • CImplement strong authentication and authorization controls.
   • DEncrypt all personal data at rest and in transit.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which type of event should be logged to support security monitoring of an application?

   • AThe number of users in the organization
   • BThe current system time
   • CThe application's source code version
   • DSuccessful and failed login attempts
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A healthcare organization uses a patient portal application. The organization must comply with data protection regulations that require personal health information to be protected. The administrator is configuring the application's data handling. Which measure is most important to implement?

   • AEncrypt patient data both at rest and in transit, and restrict access to only authorized medical staff.
   • BDisable logging of patient data access to protect patient privacy.
   • CStore patient data in plain text to ensure it is easily readable by authorized personnel.
   • DAllow all employees to access patient data to improve operational efficiency.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has a high turnover rate of employees. The security team is concerned that former employees may retain access to sensitive applications. The administrator is designing a user access management process. What is the most effective control to implement?

   • ADisable all accounts after 90 days of inactivity.
   • BRequire managers to manually notify IT when an employee leaves.
   • CAutomate the deprovisioning of user accounts when an employee leaves the company, integrated with the HR system.
   • DConduct quarterly access reviews to identify and remove stale accounts.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of auditing and logging in application security?

   • ATo improve application performance by reducing unnecessary code
   • BTo record user activities and system events to detect and investigate security incidents
   • CTo replace the need for user access reviews
   • DTo automatically block all malicious users in real time
   Reveal Solution Discussion Select an answer first