Define Data Access Provisioning CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is part of the reapproval process for data access?

   • ACreating new user accounts for employees who join the organization
   • BResetting passwords for users who have forgotten their credentials
   • CInstalling security patches on servers to address vulnerabilities
   • DConducting periodic reviews of user and service account permissions to confirm they are still needed
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is implementing a new identity management system. The security team wants to ensure that user access is provisioned based on the user's role in the organization. Which approach best supports this requirement?

   • ADefine role-based access control (RBAC) policies that map job roles to specific permissions and assign users to roles based on their job function.
   • BUse attribute-based access control (ABAC) to grant access based on user attributes such as department and location.
   • CCopy the access rights of a senior employee to all new employees in the same department.
   • DGrant each user access on a case-by-case basis as requested by their manager.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is reviewing the service accounts used by a legacy application. The application requires a service account with domain administrator privileges to function correctly. The team wants to reduce the risk associated with this account. Which approach is most appropriate?

   • ARemove the domain administrator privileges and grant the account only the minimum permissions required for the application to function.
   • BDocument the business need for the elevated privileges, restrict the account's use to the specific application server, and monitor its activity closely.
   • CDisable the service account and require the application to run under the system account.
   • DReplace the service account with a user account that has domain administrator privileges.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise has hundreds of service accounts used by automated processes. A recent audit found that many of these accounts have passwords that never expire and are embedded in application configuration files. The security team wants to reduce the risk of credential theft while minimizing operational disruption. Which strategy best balances security and operational continuity?

   • AImplement a managed identity solution (e.g., Azure Managed Identity or AWS IAM Roles) for cloud workloads and migrate on-premises service accounts to a centralized credential vault with automatic rotation.
   • BSet all service account passwords to expire every 30 days and require application owners to update the configuration files manually each time.
   • CDisable all service accounts that are not actively used and leave the remaining accounts unchanged.
   • DCreate a new service account for each application and grant it the same permissions as the original account, then delete the original accounts.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A software development company uses a shared service account to deploy code to production. The security team wants to improve accountability and reduce the risk of unauthorized deployments. Which change best addresses these concerns?

   • ADisable the service account and require developers to deploy code using their own personal accounts with production access.
   • BReplace the service account with a single administrative user account that all developers share.
   • CKeep the shared service account but require all developers to use a shared password manager to access the credentials.
   • DCreate individual user accounts for each developer and require them to use their own credentials to initiate deployments, with the service account used only for the automated deployment process itself.
   Reveal Solution Discussion Select an answer first