Evaluate and Select Reusable Technologies CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is reviewing a PowerShell script that will be used to deploy infrastructure in a cloud environment. The script requires administrative privileges and will be run by a service account. The team wants to minimize the risk of the script being tampered with and to limit the blast radius if the service account is compromised. Which approach should be taken?

   • AStore the script in a network share with write permissions for all administrators
   • BDisable PowerShell logging to reduce the chance of the script being audited
   • CRun the script with the service account that has domain administrator privileges
   • DSign the PowerShell script with a code-signing certificate and configure the service account with the minimum required permissions
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a primary security risk associated with PowerShell environments?

   • APowerShell scripts can be used to execute malicious code with high privileges.
   • BPowerShell cannot run on Windows systems.
   • CPowerShell automatically deletes all files.
   • DPowerShell does not support encryption.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A database administrator needs to allow a reporting application to access only a subset of columns in a table that contains employee salaries. The application should not be able to see the salary column, and the administrator wants to avoid granting direct table access to the application's database user. Which database security control should be used?

   • AGrant the application user SELECT on the table but revoke the salary column's permissions
   • BCreate a trigger that redacts the salary column on every SELECT
   • CEncrypt the salary column using column-level encryption
   • DCreate a view that exposes only the non-sensitive columns and grant the application user SELECT on that view
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A government contractor must ensure that a new application's boot process is verified against known-good firmware and that cryptographic keys used for disk encryption are protected from software-based attacks. The solution must be implemented without requiring changes to the application code. Which technology should be integrated into the system architecture?

   • ATrusted Platform Module (TPM) for secure key storage and platform integrity measurement
   • BA software-based key management service running in user mode
   • CA database encryption feature that encrypts all stored data
   • DAn application-level code signing mechanism
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key security feature of the Java Virtual Machine (JVM) that helps prevent memory corruption attacks?

   • AIt encrypts all data in memory.
   • BIt compiles code to native machine code that is immune to attacks.
   • CIt disables all system calls from Java applications.
   • DAutomatic memory management with bounds checking.
   Reveal Solution Discussion Select an answer first