7.4 - Apply Foundational Security Operations Concepts CISSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which scenario best illustrates separation of duties?

   • AA user has read-only access to a database
   • BOne employee creates a purchase order and another employee approves it
   • CTwo employees share the same user account to perform their duties
   • DAn administrator has full control over a server and also monitors its logs
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a recommended control for managing privileged accounts?

   • AAllowing all users to know the administrator password
   • BUsing a privileged access management (PAM) solution to vault and rotate credentials
   • CCreating a single privileged account for all administrators to use
   • DStoring privileged account passwords in a shared spreadsheet
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small accounting firm has only two employees in the finance department. One employee creates purchase orders, and the other approves them. The firm wants to add a control to reduce the risk of collusion between the two employees. Which control would be most effective?

   • AIncrease the approval threshold so only large purchases require approval.
   • BImplement job rotation so employees periodically switch roles, and have an external accountant review transactions quarterly.
   • CRequire both employees to use strong passwords and change them monthly.
   • DAllow either employee to create and approve purchase orders to speed up the process.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a primary benefit of job rotation in a security operations context?

   • AIt reduces the need for background checks
   • BIt eliminates the need for separation of duties
   • CIt ensures that employees are paid equally
   • DIt helps detect irregularities by having different people perform the same tasks
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A payroll department has three employees: one enters employee hours, one approves the hours, and one processes the payroll. The company wants to ensure that no single employee can both enter and approve hours for the same employee. Which control should be implemented?

   • AAllow any employee to enter and approve hours, but require a manager to review the payroll report.
   • BRequire all three employees to use the same login to simplify access.
   • CConfigure the payroll system to prevent the same user from entering and approving hours for the same employee.
   • DGrant all three employees full access to the payroll system to increase efficiency.
   Reveal Solution Discussion Select an answer first