Cyber Defense Principles GMON Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security engineer is designing access controls for a cloud storage bucket that contains sensitive customer data. The company policy states that only the data analytics team should have read access, and only the data engineering team should have write access. The engineer wants to implement least privilege. Which approach is the most appropriate?

   • AGrant the analytics team read and write access, and the engineering team read and write access.
   • BCreate a single role with read and write permissions and assign it to both teams.
   • CCreate two IAM roles: one with read-only permissions for the analytics team and one with write permissions for the engineering team.
   • DMake the bucket public and rely on the network firewall to restrict access.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing the access controls for a database that stores customer payment card data. The database administrator has a single account with full administrative privileges that is used for both routine maintenance and emergency break-glass access. The analyst wants to reduce the risk of credential misuse while still ensuring that the administrator can perform urgent tasks. Which approach best aligns with the principle of least privilege?

   • ACreate a separate break-glass account that is disabled by default and requires a manager to approve its activation.
   • BUse the same account for all administrators so that accountability is shared and no single person has unique access.
   • CGrant the administrator full privileges only during business hours and remove them after hours.
   • DKeep the single administrative account but require the administrator to change the password every 30 days.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A risk assessment for a hospital's patient portal identifies that a data breach could result in regulatory fines and loss of patient trust. The hospital decides to implement mandatory encryption for all patient data at rest and in transit. This decision is an example of which risk management strategy?

   • ARisk avoidance
   • BRisk transfer
   • CRisk acceptance
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is designing a new customer-facing web application. The security team wants to implement defense-in-depth. Which combination of controls best exemplifies this principle?

   • AA single strong authentication mechanism with multi-factor authentication (MFA) for all users.
   • BA network firewall, a web application firewall, and application-level input validation.
   • CA comprehensive backup strategy with offsite storage and regular restoration testing.
   • DAn intrusion detection system (IDS) that monitors network traffic and generates alerts.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which principle of cyber defense is best described by implementing multiple independent security controls so that if one control fails, another still provides protection?

   • ARisk management
   • BSeparation of duties
   • CDefense-in-depth
   • DLeast privilege
   Reveal Solution Discussion Select an answer first