Overview of Information Security and Defense Strategies EHE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company has a security policy that requires all employees to use multi-factor authentication (MFA). However, many employees are not complying because they find it inconvenient. The company wants to improve compliance without weakening security. Which action should the company take?

   • AIgnore the non-compliance because the policy is just a formality.
   • BIncrease the password complexity requirements.
   • CProvide training on the importance of MFA and make the process more user-friendly.
   • DRemove the MFA requirement to reduce inconvenience.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization's intrusion detection system (IDS) alerts on suspicious outbound traffic from a workstation. The security analyst confirms that malware is exfiltrating data. Which type of control is the IDS providing?

   • ADetective control
   • BCorrective control
   • CDeterrent control
   • DPreventive control
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A small e-commerce company has a limited security budget. A risk assessment identified three threats: a ransomware attack on the main database (likelihood: low, impact: critical), a DDoS attack on the web store (likelihood: high, impact: moderate), and an insider accidentally deleting customer orders (likelihood: medium, impact: moderate). Which risk treatment should the company prioritize?

   • AAccept the risks and allocate the budget to marketing to increase sales.
   • BImplement offsite encrypted backups and test restoration procedures for the database.
   • CRequire two-person approval for all order deletion operations in the admin panel.
   • DPurchase DDoS mitigation services from a cloud provider to absorb large-scale attacks.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company's security policy requires that all laptops be encrypted, but several employees have been working from home with unencrypted personal laptops to access corporate email. The IT help desk has received multiple requests to 'just get it done' without following the policy. What should the security team do to address this situation?

   • AEnforce the policy by blocking access to corporate email from unencrypted devices and provide company-managed encrypted laptops.
   • BUpdate the security policy to allow personal laptops if the employee signs an acceptable use agreement.
   • CDisable encryption on company laptops to make the policy consistent with personal laptop usage.
   • DSend a reminder email to all employees about the encryption policy and ask them to comply voluntarily.
   Reveal Solution Discussion Select an answer first
6. 35expert · medium

   A company has hired an ethical hacker to perform a penetration test on its network. The ethical hacker has discovered a critical vulnerability in a legacy system that is no longer supported by the vendor. The company cannot afford to replace the system immediately. What should the ethical hacker do?

   • APublicly disclose the vulnerability to pressure the company into replacing the system.
   • BExploit the vulnerability to demonstrate the impact, but do not provide any recommendations.
   • CReport the vulnerability to the company and recommend compensating controls to mitigate the risk.
   • DRefuse to test the system because it is unsupported and too risky.
   Reveal Solution Discussion Select an answer first