3.1 - Research, Implement and Manage Engineering Processes Using Secure Design Principles CISSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a benefit of keeping a system simple and small?

   • AIt ensures that the system will have a longer lifespan
   • BIt guarantees that the system will be free of all vulnerabilities
   • CIt eliminates the need for security testing
   • DIt reduces the number of potential vulnerabilities and makes security analysis more manageable
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the core principle of least privilege?

   • AGrant all users the same level of access to simplify administration
   • BGrant users the maximum permissions possible to avoid access issues
   • CGrant permissions based on the user's job title rather than their specific tasks
   • DGrant users and processes only the minimum permissions necessary to perform their functions
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of segregation of duties (SoD)?

   • ATo divide critical tasks among multiple individuals to prevent fraud and errors by requiring collusion
   • BTo reduce the number of security controls needed in a system
   • CTo ensure that only one person is responsible for all aspects of a critical process
   • DTo ensure that all employees have the same level of access to sensitive systems
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the core principle of the zero trust model?

   • ATrust users after they have been authenticated once
   • BVerify only users, not devices or applications
   • CVerify every access request regardless of origin
   • DTrust all users inside the network and verify only external users
   Reveal Solution Discussion Select an answer first
6. 20foundation · medium

   A company is migrating a web application to an IaaS cloud provider. The provider supplies the physical data center, network infrastructure, and hypervisor. The company will deploy and manage its own virtual machines, operating systems, and application code. According to the shared responsibility model, which security responsibilities belong to the company?

   • AProviding network redundancy and DDoS protection at the provider edge
   • BPatching the guest operating system and configuring the application firewall
   • CEnsuring the hypervisor is patched and hardened against vulnerabilities
   • DManaging physical access controls to the data center and hardware maintenance
   Reveal Solution Discussion Select an answer first