Information Security Fundamentals ECSS Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   After a user successfully authenticates to a network, the system determines which files the user can read or modify. Which AAA component is performing this function?

   • AAuthorization
   • BAuthentication
   • CAccounting
   • DAccess control
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company's risk assessment reveals that a critical application has a known vulnerability that could allow remote code execution. The vendor has not yet released a patch. The company cannot take the application offline because it is business-critical. Which risk treatment option is most appropriate under these constraints?

   • AAccept the risk without any action
   • BTransfer the risk by purchasing cyber insurance
   • CImplement compensating controls such as a web application firewall and network segmentation
   • DTake the application offline until the patch is released
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company is implementing a data classification scheme. The company has three levels: Public, Internal, and Confidential. The security team is deciding how to protect a document that contains customer personally identifiable information (PII). The document is used by the customer support team and must be accessible to them, but it should not be accessible to other employees. Which classification level and control would be most appropriate?

   • AClassify as Public and rely on encryption at rest
   • BClassify as Internal and rely on the corporate firewall
   • CClassify as Confidential and implement role-based access control (RBAC)
   • DClassify as Internal and implement data loss prevention (DLP)
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A bank is investigating a disputed wire transfer. The customer claims they never authorized the transaction, but the bank's logs show the transfer was initiated from the customer's authenticated session. The bank needs to prove the customer performed the transaction. Which evidence would provide the strongest non-repudiation?

   • AThe customer's login timestamp from the bank's access log
   • BThe IP address of the customer's computer at the time of the transfer
   • CA screenshot of the transaction confirmation page
   • DA digital signature generated by the customer's private key during the transaction
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following is best described as a vulnerability in an information system?

   • AAn unpatched software flaw that can be exploited
   • BA disgruntled employee
   • CA natural disaster such as a flood
   • DA hacker attempting to guess passwords
   Reveal Solution Discussion Select an answer first