Security and Access Controls CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's security team has identified a critical vulnerability in a widely used third-party application. The vendor has released a patch, but the company is concerned about potential disruption to business-critical systems. According to patch management best practices, what should the team do first?

   • ATest the patch in a non-production environment that mirrors production configurations.
   • BWait for the next scheduled patch cycle to avoid any disruption.
   • CDeploy the patch immediately to all systems to minimize the window of exposure.
   • DDisable the vulnerable service until the patch can be deployed.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common TLS misconfiguration that weakens the security of the connection?

   • AUsing strong cipher suites
   • BEnabling certificate pinning
   • CUsing outdated protocol versions like SSL 3.0
   • DImplementing perfect forward secrecy
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's privacy team is designing a logging strategy for a new customer relationship management (CRM) system that stores personal data. They want to detect unauthorized access and support incident response. Which types of events should be logged to meet these objectives?

   • AAll user keystrokes and mouse movements
   • BOnly successful access to sensitive records, to reduce noise
   • COnly failed login attempts, to minimize log volume
   • DSuccessful and failed login attempts, access to sensitive records, and privilege changes
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational corporation has a complex organizational structure with employees in different departments, locations, and projects. The security team needs to implement an access control model that can enforce fine-grained policies based on multiple attributes, such as department, project, and data classification. However, the team is concerned about the administrative overhead of managing a large number of policies. Which authorization model best balances flexibility and manageability?

   • ARBAC with a limited number of roles and no additional attributes
   • BDAC where each resource owner sets permissions
   • CMAC with predefined security labels
   • DABAC with centralized policy management and automated policy generation
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A financial institution is implementing a new customer authentication system for online banking. The system must be secure against phishing and account takeover, but also usable for customers who may not have smartphones. The security team is evaluating different MFA methods. Which approach best balances security and usability for this diverse customer base?

   • AImplement biometric authentication (fingerprint) for all customers, as it is both secure and easy to use.
   • BUse only SMS-based one-time codes, as they work on all phones.
   • COffer a choice between a mobile authenticator app and a hardware token, with a fallback of SMS for customers without smartphones.
   • DRequire a hardware token for all customers, as it provides strong two-factor authentication.
   Reveal Solution Discussion Select an answer first