Access Control & Password Management GSEC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An organization is implementing MFA for a high-security environment. The security team wants to prevent phishing and also ensure that the solution works for employees who do not have smartphones. Which MFA method is most appropriate?

   • ATOTP codes generated by a mobile authenticator app
   • BEmail-based one-time codes
   • CSMS one-time codes sent to a corporate phone
   • DFIDO2 security keys that support both USB and NFC
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary benefit of using a password manager for an organization?

   • AIt eliminates the need for multi-factor authentication
   • BIt automatically changes passwords on all websites
   • CIt encrypts all network traffic to prevent eavesdropping
   • DIt allows users to have unique, complex passwords for every account without needing to memorize them
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is revising its password policy. They want to reduce the risk of credential stuffing attacks while minimizing user frustration. Which policy change is most effective?

   • ARequire at least one uppercase letter, one number, and one special character
   • BSet a maximum password age of 90 days and lock accounts after three failed attempts
   • CRequire passwords to change every 30 days
   • DRequire a minimum password length of 14 characters and check against a list of breached passwords
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to encourage employees to use unique passwords for each application. They are considering a password manager. Which feature is most important for securely storing credentials?

   • AStoring passwords in the cloud for easy access
   • BAllowing password sharing between users
   • CEncrypting the password database with a strong master password
   • DGenerating random passwords for each site
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A new employee joins the finance department and needs access to the accounting system and the shared finance folder. The employee's manager requests that the employee have access to all finance-related resources. According to least privilege, what should the IT admin do?

   • AGrant access to all finance department resources to ensure the employee can cover for colleagues
   • BGrant access to the accounting system but not the shared folder until the employee requests it
   • CGrant the same permissions as the most senior finance employee to ensure consistency
   • DGrant access only to the specific accounting system and finance folder resources required for the employee's job function
   Reveal Solution Discussion Select an answer first