Security 11

A security engineer at a large company needs to enhance IAM in order to ensure that employees can only access corporate systems during their shifts. Which of the following access controls should the security engineer implement?

• Role-based

• Time-of-day restrictions

• Least privilege

• Biometric authentication

Answer explanation

IAM (Identity and Access Management) setup based on the questions is Time-based Access Management, which is another words Time-of-day restrictions.

A company wants to ensure employees are allowed to copy files from a virtual desktop during the workday but are restricted during non-working hours. Which of the following security measures should the company set up?

• Digital rights management

• Role-based access control

• Time-based access control

• Network access control

Answer explanation

C. Time-based access control Explanation: • Time-based access control: Restricts or permits access to resources based on specific time frames. This fits the scenario where file copying is allowed only during working hours.

Employees sign an agreement that restricts specific activities when leaving the company. Violating the agreement can result in legal consequences. Which of the following agreements does this best describe?

• SLA

• BPA

• NDA

• MOA

Answer explanation

A non-disclosure agreement (NDA) is a legal contract that limits how confidential information can be used and shared. NDAs are also known as confidentiality agreements, proprietary information agreements, or secrecy agreements.

A systems administrator just purchased multiple network devices. Which of the following should the systems administrator perform to prevent attackers from accessing the devices by using publicly available information?

• Install endpoint protection.

• Disable ports/protocols.

• Change default passwords.

• Remove unnecessary software.

A CVE in a key back-end component of an application has been disclosed. The systems administrator is identifying all of the systems in the environment that are susceptible to this risk. Which of the following should the systems administrator perform?

• Packet capture

• Vulnerability scan

• Metadata analysis

• Automated reporting

Answer explanation

B. Vulnerability Scan Why? A vulnerability scan systematically checks systems against a database of known vulnerabilities (including CVEs). It helps identify which systems, applications, or services are affected by the disclosed CVE. Most vulnerability scanning tools (e.g., Nessus, Qualys, OpenVAS) provide detailed reports and potential remediation steps. Why Not the Others? A. Packet Capture – Used for network traffic analysis, but it won’t directly identify vulnerable systems. C. Metadata Analysis – Involves examining file or system metadata, which is not relevant for detecting software vulnerabilities. D. Automated Reporting – Helps document findings but does not actively identify vulnerable systems.

Which of the following activities uses OSINT?

• Social engineering testing

• Data analysis of logs

• Collecting evidence of malicious activity

• Producing IOC for malicious artifacts

Answer explanation

Answer: A. Social engineering testing Open Source Intelligence (OSINT) involves gathering information from publicly available sources. Social engineering testing often uses OSINT to collect data about individuals or organizations to craft convincing phishing attacks or other social engineering tactics. Why the other options are not correct: C. Collecting evidence of malicious activity Collecting evidence of malicious activity typically involves forensic analysis of compromised systems or networks, which relies on internal data and artifacts rather than publicly available information. D. Producing IOCs for malicious artifacts Producing Indicators of Compromise (IOCs) involves analyzing malware or attack patterns to create signatures or identifiers. This process is based on technical analysis of malicious artifacts, not on publicly available information.

Which of the following are the best security controls for controlling on-premises access? (Choose two.)

• Swipe card

• Picture ID

• Phone authentication application

• Biometric scanner

• Camera

Answer explanation

A. Swipe Card ✔ Provides physical access control to restricted areas. ✔ Can be integrated with access logs to track entries and exits. ✔ Easy to revoke or deactivate if lost or stolen. D. Biometric Scanner ✔ Verifies identity using unique physical traits (e.g., fingerprint, iris, or facial recognition). ✔ Cannot be shared or stolen like swipe cards or PIN codes. ✔ Adds an extra layer of security by ensuring the person entering is the authorized individual.

A company is considering an expansion of access controls for an application that contractors and internal employees use to reduce costs. Which of the following risk elements should the implementation team understand before granting access to the application?

• Threshold

• Appetite

• Avoidance

• Register

Answer explanation

Answer: B. Appetite Risk appetite refers to the level of risk an organization is willing to accept to achieve its objectives. Before granting access to contractors and employees, the implementation team should understand the company's risk appetite to ensure the expansion of access controls aligns with the organization's tolerance for risk. Why the other options are not correct: A. Threshold A risk threshold is the specific level of risk that an organization is unwilling to exceed. While thresholds are important, they are more granular than risk appetite and are typically derived from it. Understanding risk appetite is more critical at this stage. C. Avoidance Risk avoidance involves eliminating risk by not engaging in the activity that creates it. This is not relevant to the scenario, as the company is considering expanding access, not avoiding it.

Which of the following is the act of proving to a customer that software developers are trained on secure coding?

• Assurance

• Contract

• Due diligence

• Attestation

Answer explanation

Attestation is the act of formally proving or certifying that a specific requirement or standard has been met. In this case, it would involve providing evidence or documentation to a customer that software developers have been trained in secure coding practices

An administrator is creating a secure method for a contractor to access a test environment. Which of the following would provide the contractor with the best access to the test environment?

• Application server

• Jump server

• RDP server

• Proxy server

Answer explanation

A jump server is a secure intermediate server designed to manage and control access to other servers or environments. Contractors or external users can connect to the jump server, which then provides them limited, controlled access to the target environment. The jump server acts as a gatekeeper, isolating the test environment from direct external access. This reduces the attack surface and ensures that access is limited and monitored.