7.4 - Apply Foundational Security Operations Concepts CISSP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A retail company's accounts payable clerk has been processing vendor invoices for three years. The company suspects that the clerk may have been approving payments to a fake vendor. Which control would be most effective in detecting this type of fraud?

   • AIncrease the clerk's salary to reduce the incentive for fraud.
   • BAdd more detailed fields to the invoice entry form.
   • CRequire the clerk to take a mandatory two-week vacation each year.
   • DImplement job rotation so the clerk periodically moves to a different role, and another employee reviews the vendor list.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A system administrator has a domain admin account that is used for routine daily tasks such as resetting user passwords and managing file shares. The security team is concerned about the risk of credential misuse. Which practice should be implemented?

   • AShare the domain admin password among the IT team to ensure availability.
   • BCreate a separate standard user account for daily tasks and reserve the domain admin account for administrative functions only.
   • CDisable the domain admin account and use a local administrator account on each server.
   • DContinue using the domain admin account but require a longer password.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of a service-level agreement (SLA) in IT services?

   • ATo set the internal security policies for the service provider
   • BTo define the performance expectations, responsibilities, and remedies for service delivery
   • CTo provide a detailed technical design of the service infrastructure
   • DTo list the names of all employees who will support the service
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization has a policy that requires all privileged access to be monitored and audited. A network administrator needs to perform a one-time emergency configuration change on a firewall. Which action best complies with the policy?

   • AAsk a colleague to perform the change and then report it verbally.
   • BUse a shared admin account and change the password after the change.
   • CDisable logging for the session to avoid generating sensitive logs.
   • DUse a break-glass account that is normally disabled, and ensure the session is recorded and reviewed after the change.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A healthcare organization is implementing a new electronic health record (EHR) system. The security team must balance the need for clinical staff to quickly access patient data in emergencies with the principle of least privilege. The organization also wants to ensure that no single user can both prescribe and approve medication orders. Which combination of controls best meets these requirements?

   • AUse a single shared account for all clinical staff to simplify access, and require a manager to approve all prescriptions.
   • BImplement role-based access control (RBAC) with a break-glass emergency access procedure, and configure the system to prevent the same user from prescribing and approving orders.
   • CImplement job rotation for clinical staff and require a second clinician to approve all prescriptions.
   • DGrant all clinical staff full access to the EHR to ensure availability, and rely on post-incident review to detect misuse.
   Reveal Solution Discussion Select an answer first