Security and Access Controls CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which type of event should be logged to support privacy compliance and detect unauthorized access to personal data?

   • AOnly failed access attempts
   • BOnly successful access attempts
   • COnly administrative actions
   • DSuccessful and failed access attempts to systems containing personal data
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's security team is implementing a key management system for their encryption infrastructure. They need to ensure that keys are protected and that access to keys is strictly controlled. Which practice is a key management best practice?

   • AStore keys in a hardware security module (HSM) and enforce strict access controls
   • BEmbed keys directly in application code for easy access
   • CRotate keys only when a compromise is suspected
   • DUse the same key for all encryption operations to simplify management
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare startup is building a patient portal that will handle protected health information. The development team has just completed the design phase and is about to start coding. The privacy engineer wants to ensure that security and privacy requirements are integrated early and continuously. Which action best aligns with a secure SDLC approach at this point?

   • AAssign a security specialist to review the code after each sprint, but only for authentication and authorization logic.
   • BConduct a threat modeling session to identify potential attack vectors and privacy risks in the proposed architecture before coding begins.
   • CDefer all security reviews until after the application is deployed to production, when real usage patterns are available.
   • DImplement a comprehensive logging system now to capture all user actions, and analyze the logs after launch to detect any privacy issues.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which authorization model grants access based on the roles a user has been assigned within an organization?

   • ARole-Based Access Control (RBAC)
   • BAttribute-Based Access Control (ABAC)
   • CDiscretionary Access Control (DAC)
   • DMandatory Access Control (MAC)
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a primary advantage of asymmetric encryption over symmetric encryption?

   • AIt is simpler to implement
   • BIt allows secure key exchange without sharing a secret
   • CIt is faster for encrypting large amounts of data
   • DIt requires less computational overhead
   Reveal Solution Discussion Select an answer first