Security and Access Controls CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which activity is a key component of the secure SDLC phase that involves verifying that security and privacy controls work as intended?

   • AThreat modeling
   • BSecurity testing and code review
   • CUser training
   • DDeployment planning
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational corporation is implementing a new IAM system. The security team wants to ensure that every user's identity is verified, that users can only access resources based on their role, and that all access attempts are recorded for audit. Which combination of IAM components directly addresses these three requirements?

   • AIdentification, encryption, and monitoring
   • BAuthentication, authorization, and accountability
   • CDirectory services, certificates, and access tokens
   • DSingle sign-on, multi-factor authentication, and password policies
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

   • AAn IDS is software-based, while an IPS is hardware-based
   • BAn IDS is deployed inline, while an IPS is deployed out-of-band
   • CAn IDS uses signature-based detection, while an IPS uses anomaly-based detection
   • DAn IDS monitors and alerts, while an IPS actively blocks or prevents detected threats
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which secure communication protocol is commonly used to provide encrypted remote command-line access to servers?

   • ASSH
   • BTLS
   • CHTTP
   • DIPsec
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services firm is designing a new customer-facing application that will allow users to view account balances and initiate transfers. The privacy engineer is leading a threat modeling exercise. The team has identified that a user could potentially view another user's account details by manipulating the URL parameters. Which threat modeling technique would best help the team systematically identify and document this and similar risks?

   • AConduct a penetration test after the application is deployed to see if any real attackers can exploit the URL parameter issue.
   • BDeploy a web application firewall (WAF) in front of the application to block any request with suspicious URL parameters.
   • CUse STRIDE to categorize the threat as an information disclosure and then apply mitigations such as access control checks on the server side.
   • DReview the application's audit logs after launch to detect any unauthorized access attempts that may have occurred.
   Reveal Solution Discussion Select an answer first