Ensure Secure Installation CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a common method for enforcing least privilege in a system?

   • AUsing role-based access control (RBAC) to assign permissions based on job functions
   • BDisabling the operating system's built-in security features
   • CAllowing users to change their own permissions as needed
   • DGranting all users administrator privileges to avoid access issues
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a technical mechanism used to enforce security policies?

   • AA security awareness poster
   • BAn access control list (ACL) on a file server
   • CAn employee handbook
   • DA management directive to follow the policy
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary function of a firewall in network security?

   • ATo encrypt all network traffic
   • BTo provide a secure remote access VPN
   • CTo detect and remove malware from network traffic
   • DTo filter traffic based on a set of rules
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the recommended practice before deploying a new patch to a production environment?

   • ADeploy the patch immediately to all systems to minimize the window of vulnerability
   • BTest the patch in a controlled environment that mirrors production
   • COnly apply patches that are released by the software vendor
   • DSkip the patch if the system is currently stable
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security admin is deploying a new fleet of Linux servers that must boot only signed operating system components. The organization's PKI issues certificates for code signing, but the servers currently have no secure boot keys enrolled. Which action should the admin take to ensure the boot process rejects unsigned bootloaders and kernels?

   • AEnroll the organization's code-signing certificate in the UEFI signature database and enable secure boot.
   • BDisable secure boot and rely on the Linux kernel's built-in module signature verification.
   • CUse a boot script to verify the kernel's SHA-256 hash after boot completes.
   • DSet the UEFI platform key to the default Microsoft key and enable secure boot.
   Reveal Solution Discussion Select an answer first