Overview of Information Security and Defense Strategies EHE Practice Questions (Page 8)

Questions 36–40

1. 36expert · medium

   A healthcare provider stores patient records in a cloud database. The provider is required to ensure the confidentiality and integrity of the data. They have implemented encryption at rest and in transit, and they have strict access controls. However, a recent audit found that the database administrator (DBA) has the ability to modify patient records without any oversight. Which control would best address this issue?

   • AEncrypt the database with a key that only the DBA knows, so that only they can decrypt it.
   • BRequire two-person control for all changes to patient records, where a second person must approve the change.
   • CImplement database activity monitoring (DAM) to alert on unauthorized or unusual changes to patient records.
   • DRemove the DBA's access to the database entirely and have all changes made by application administrators.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A financial firm has implemented a next-generation firewall, host-based intrusion detection on all endpoints, and a SIEM that correlates alerts. After a phishing email bypassed the email filter, an employee clicked a malicious link and malware was detected on the workstation. Which control should the firm rely on FIRST to stop the malware from spreading to other systems?

   • AThe SIEM correlation rules that generate an incident ticket for the security operations center.
   • BThe host-based intrusion detection system (HIDS) that alerts the security team to the malware's presence.
   • CThe email filter's spam quarantine that holds suspicious messages for user review.
   • DThe network segmentation rules that restrict lateral movement between workstation subnets.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has a mature security program with a strong firewall, endpoint protection, and regular patching. However, a recent phishing attack bypassed these controls because an employee clicked a malicious link. The company wants to add a control that would have the most impact in preventing a similar attack. Which control should the company implement?

   • AA new security policy requiring strong passwords
   • BA more advanced firewall
   • CAdditional endpoint protection software
   • DSecurity awareness training for employees
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is developing a new mobile app that will handle customer payment information. The development team wants to move fast and is resisting security reviews. Which security policy or standard should the company implement to ensure security is integrated into the development process?

   • AA secure coding standard that requires code reviews and static analysis before each release.
   • BA procedure that only performs a security audit after the app is released to the public.
   • CA policy that allows developers to skip security reviews if they sign a waiver.
   • DA standard that requires all developers to attend a one-time security awareness training.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization wants to ensure that all employees consistently use strong passwords and change them periodically. Which document should the organization implement to mandate this behavior?

   • AA security guideline that recommends best practices for password use.
   • BA security procedure that outlines step-by-step password change steps.
   • CA security standard that specifies the exact password length and complexity.
   • DA security policy that defines password requirements and consequences for non-compliance.
   Reveal Solution Discussion Select an answer first