Store and Manage Security Data CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of a secure configuration baseline in deployment?

   • ATo allow developers to configure systems differently for each environment
   • BTo document the history of all configuration changes for auditing
   • CTo replace the need for change management processes
   • DTo provide a standard set of security settings that systems must meet before deployment
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is audit logging an important part of secure configuration management?

   • AIt automatically reverts any configuration change that is not approved
   • BIt provides a record of configuration changes that can be reviewed for unauthorized modifications
   • CIt prevents all configuration changes from being made
   • DIt eliminates the need for configuration baselines
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses certificates for mutual TLS authentication between services. They need to ensure that certificates are renewed before they expire and that the renewal process does not cause downtime. What should they implement?

   • ASet certificates to expire and rely on clients to handle the failure.
   • BAutomate certificate renewal with a tool that supports rolling updates, and monitor certificate expiry.
   • CManually renew certificates during a scheduled maintenance window.
   • DUse long-lived certificates that do not need renewal.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A certificate authority (CA) is about to expire. The organization wants to ensure that certificates issued by the old CA are still trusted until they expire, while new certificates are issued by a new CA. What should they do?

   • ARevoke all certificates issued by the old CA immediately.
   • BUse the old CA to issue new certificates until it expires.
   • CCross-sign the new CA with the old CA and deploy the new CA certificate to clients.
   • DIssue new certificates from the new CA and ignore the old CA's expiration.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A development team stores database credentials in a shared configuration file that is committed to the source repository. The security team has mandated that credentials must be centralized, encrypted at rest, and access must be logged. Which approach should the team adopt?

   • AUse environment variables in the deployment pipeline to inject the credentials at runtime.
   • BEncrypt the configuration file with a strong algorithm and store the encryption key in the same repository.
   • CGenerate a new database password each time the application starts and store it in a local file.
   • DMove the credentials to a secrets management vault and reference them via API calls from the application.
   Reveal Solution Discussion Select an answer first