Ensure Secure Installation CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company uses Infrastructure as Code (IaC) to deploy cloud resources. The security team wants to ensure that all deployments are secure and compliant. Which combination of practices is most effective?

   • AReview IaC templates manually before each deployment.
   • BDeploy templates directly to production and fix issues after detection.
   • CUse a single IaC template for all environments without environment-specific security settings.
   • DUse a policy-as-code tool to validate IaC templates against security policies before deployment.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common firewall rule configuration to protect a web server?

   • AAllow inbound traffic on port 22 (SSH) from any source
   • BAllow inbound traffic only on port 80 (HTTP) and port 443 (HTTPS)
   • CAllow all inbound traffic on any port
   • DBlock all outbound traffic from the web server
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization is implementing multi-factor authentication (MFA) for all administrative accounts. The security team must choose an MFA method that balances security and usability. Which method provides the strongest security while minimizing user friction?

   • AUse email-based verification codes.
   • BUse a mobile authenticator app that requires manual entry of a code.
   • CUse SMS-based one-time passwords (OTP) for simplicity.
   • DUse hardware security keys (e.g., FIDO2) for administrators.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization is provisioning service accounts for a new application. The security policy requires that credentials be stored securely and that the application authenticate without human intervention. Which approach best meets these requirements?

   • ASet the service account password to never expire and document it in the team's shared spreadsheet.
   • BEmbed the service account password in the application's configuration file.
   • CStore the service account password in a secrets management vault and have the application retrieve it at runtime.
   • DUse the same service account for all applications to simplify management.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization has implemented a security baseline for all servers. The security team needs to ensure that servers remain compliant over time. Which approach best monitors ongoing compliance?

   • APerform a one-time audit during deployment and then trust that configurations remain unchanged.
   • BRely on server administrators to self-report any configuration changes.
   • CDisable the baseline enforcement to reduce administrative overhead.
   • DSchedule periodic scans that compare server configurations against the baseline and report deviations.
   Reveal Solution Discussion Select an answer first