Managing System Security GSLC Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is decommissioning a server that has reached end-of-life. The server contains sensitive customer data and is no longer under warranty. The security manager must ensure that the data cannot be recovered after the server is disposed of. Which action is the most appropriate to take?

   • ARemove the hard drives and store them in a secure warehouse for future use.
   • BPerform a multi-pass overwrite of the hard drives using a certified data destruction tool, then physically destroy the drives.
   • CDelete all files and folders on the server and then reformat the hard drives.
   • DUse the server's built-in 'factory reset' option and then donate the server to a local school.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which principle states that users should be granted only the minimum permissions necessary to perform their job functions?

   • ASeparation of duties
   • BNeed to know
   • CDefense in depth
   • DLeast privilege
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In the context of system security, which principle ensures that data has not been altered or destroyed by unauthorized means?

   • AIntegrity
   • BNon-repudiation
   • CConfidentiality
   • DAvailability
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst is reviewing system logs and notices that a user's account has been locked out multiple times in a short period. The user reports that they forgot their password and were trying to log in. Which security principle is most directly being protected by the account lockout policy?

   • AAvailability
   • BNon-repudiation
   • CIntegrity
   • DConfidentiality
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company's incident response team is responding to a ransomware attack. The malware has encrypted files on several file servers. The team has isolated the affected servers and is considering whether to pay the ransom to recover the data. The company has backups, but the last backup was two weeks ago, and some critical data has changed since then. What is the most appropriate action?

   • ADo nothing and wait for the attackers to contact the company with a lower ransom demand.
   • BRestore from the two-week-old backups and accept the loss of recent changes.
   • CPay the ransom to get the decryption key and recover the data quickly.
   • DAttempt to decrypt the files using free decryption tools available from security researchers.
   Reveal Solution Discussion Select an answer first