7.4 - Apply Foundational Security Operations Concepts CISSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of separation of duties in a security operations environment?

   • ATo ensure that all employees have the same level of access
   • BTo reduce the number of privileged accounts in the organization
   • CTo provide backup for employees when they are on vacation
   • DTo ensure that no single individual has control over all critical aspects of a transaction
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key practice in privileged account management to reduce the risk of misuse?

   • AMonitoring and auditing the use of privileged accounts
   • BUsing the same privileged account for all administrative tasks
   • CDisabling logging for privileged accounts to protect privacy
   • DGranting all administrators the same password for simplicity
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's security team is implementing a privileged access management (PAM) solution. The team must ensure that privileged sessions are recorded and that the recordings are protected from tampering. The company also has an SLA requiring that the PAM solution be available 99.9% of the time. Which approach best meets these requirements?

   • AStore session recordings in a write-once-read-many (WORM) storage solution and implement redundant PAM infrastructure.
   • BStore session recordings on the same server as the PAM solution to reduce costs.
   • CRecord sessions only for critical systems to reduce storage requirements.
   • DAllow administrators to delete session recordings after 30 days to save storage space.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial services firm processes wire transfers. An employee in the payments department can initiate a transfer, and the same employee also has the ability to approve it. The security team wants to reduce the risk of fraudulent transfers. Which control should be implemented?

   • ALog all transfer activities and review logs monthly.
   • BRequire the employee to use a hardware token for both initiation and approval.
   • CRequire two different employees to perform the initiation and approval steps.
   • DAdd a second approval step performed by the same employee after a time delay.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A small manufacturing company has a finance team of three people. The team handles accounts payable, accounts receivable, and payroll. The company wants to prevent fraud but has limited staff, so strict separation of duties is difficult. Which approach best balances fraud prevention with operational feasibility?

   • AAssign all three roles to one trusted employee and rely on their integrity.
   • BDisable all financial system access and process transactions manually.
   • CImplement job rotation among the three roles and require the owner to review financial reports monthly.
   • DHire three additional employees to ensure complete separation of duties.
   Reveal Solution Discussion Select an answer first