Understand Core Concepts CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital stores patient health records in a database. The security team wants to ensure that only authorized medical staff can read the records. Which combination of controls best achieves this goal?

   • AUse a firewall and an intrusion detection system
   • BImplement multi-factor authentication for all users
   • CHash all records and store the hashes in a separate database
   • DEncrypt the database and implement role-based access control
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A financial trading platform must maintain high availability during market hours. The architecture uses multiple application servers behind a load balancer and a database cluster with synchronous replication. The compliance team requires that all access to the platform be logged and that only authorized traders can execute trades. Which additional control is most critical to ensure the platform remains available during a component failure?

   • AImplement automatic failover for the database cluster
   • BUse role-based access control to restrict trading permissions
   • CEnable detailed audit logging for all trading actions
   • DEncrypt all network traffic between components
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which authentication method requires the user to provide two or more different types of credentials?

   • AMulti-factor authentication (MFA)
   • BFederated identity
   • CBiometrics
   • DSingle sign-on (SSO)
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company stores sensitive customer data in a database. They want to protect the data from unauthorized access while also being able to trace who accessed it. They implement encryption and audit logging. However, the audit logs themselves are stored in a separate system that some administrators can access. What additional control is needed to ensure the audit logs are trustworthy?

   • AAllow all administrators to modify the audit logs for accuracy
   • BStore the audit logs in the same database as the customer data
   • CEncrypt the audit logs with the same key used for the database
   • DMake the audit logs append-only and restrict access to a separate admin role
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A software company wants to ensure that its mobile app updates are authentic and have not been tampered with after leaving the build server. Which mechanism should be used?

   • AEncrypting the app binary with a symmetric key
   • BCode signing with a certificate from a trusted CA
   • CStoring the app on a read-only server
   • DUsing a checksum such as CRC32
   Reveal Solution Discussion Select an answer first