Apply System Security Principles ISSEP Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A company is designing a new web application that will be accessible from the internet. The application will store sensitive customer data. The security architect is applying Zero Trust principles. Which design decision best reflects Zero Trust?

   • AGrant all authenticated users access to all application data.
   • BRequire authentication and authorization for every request, regardless of whether it comes from inside or outside the network.
   • CUse a strong firewall to block all external traffic and rely on the network perimeter for security.
   • DTrust all traffic that originates from inside the corporate network.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A government agency is deploying a new document-management system. The system has three roles: user (can upload and download documents), reviewer (can approve documents for publication), and administrator (manages user accounts). The agency wants to ensure that no single person can both approve a document and publish it. Which configuration best enforces this requirement?

   • AAllow the administrator role to also approve and publish documents.
   • BCreate a single role called 'publisher' that has both approve and publish permissions.
   • CKeep the reviewer role for approval and create a separate publisher role for publication, and ensure no user holds both roles.
   • DLet users with the reviewer role also publish documents after a 24-hour waiting period.
   Reveal Solution Discussion Select an answer first
3. 33foundation · easy

   Which control is designed to protect data while it is being transmitted over a network?

   • AData masking
   • BFull-disk encryption
   • CAccess control lists (ACLs)
   • DEncryption in transit (e.g., TLS)
   Reveal Solution Discussion Select an answer first