Define Data Access Provisioning CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm is migrating its customer relationship management (CRM) system to a new platform. The security team must ensure that only currently active employees retain access after migration. The HR system is the authoritative source for employment status, and the CRM team has no direct integration with it. Which approach best satisfies the requirement while minimizing manual effort?

   • AProvision access to all employees in the HR system, and rely on the CRM platform's default security policies to restrict access to only those who have logged in previously.
   • BRequest that each department manager manually approve a list of their team members who should receive access to the new CRM platform.
   • CCopy all existing CRM user accounts and permissions to the new platform, then schedule a quarterly review to remove any accounts that are no longer needed.
   • DExport the current CRM user list, compare it against the HR system's active employee list, and disable accounts for individuals no longer employed before enabling access in the new platform.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security engineer is reviewing service account usage in a hybrid environment. Some service accounts are used by on-premises applications, and others are used by cloud workloads. The engineer wants to reduce the risk of credential theft while ensuring that the accounts remain functional. Which approach is most appropriate?

   • AUse managed identities for cloud workloads and a privileged access management (PAM) solution with automatic credential rotation for on-premises service accounts.
   • BSet all service account passwords to never expire and store them in a shared spreadsheet accessible only to the IT team.
   • CDisable all service accounts and require applications to use user accounts with interactive logon.
   • DCreate a single service account for all applications and grant it the highest level of access needed by any application.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A multinational corporation uses a cloud-based HR system as the authoritative source for employee data. The company wants to automate user provisioning for its new project management tool. Which integration approach is most appropriate?

   • AConfigure the project management tool to synchronize user accounts and group memberships directly from the HR system using a System for Cross-domain Identity Management (SCIM) connector.
   • BHave the IT help desk manually create user accounts in the project management tool whenever a new employee is hired.
   • CExport the HR system data to a CSV file daily and have a script import it into the project management tool.
   • DUse the project management tool's built-in user management interface to add and remove users as needed.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of a service account?

   • ATo serve as a temporary account for guest users to access the network
   • BTo provide a shared account for multiple human users to access a common resource
   • CTo act as a backup administrator account for emergency system access
   • DTo allow automated processes or applications to authenticate and access resources without human interaction
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security administrator is designing a recertification process for a data warehouse that contains sensitive customer data. The process must ensure that both user and service account access is reviewed, but the administrator is concerned that service account owners may not know which processes depend on their accounts. What is the most effective way to handle service account recertification?

   • ADelegate service account recertification to the IT operations team, as they are responsible for the servers the accounts run on.
   • BRequire service account owners to confirm that the account is still needed and that its permissions are appropriate, and document the business process that depends on it.
   • CAutomatically approve all service account access during recertification because service accounts do not represent human users.
   • DDisable all service accounts that have not been used in the last 90 days without requiring owner review.
   Reveal Solution Discussion Select an answer first