I85PREP
⌘ K
CJE study materials
CJE study resources

CJE practice questions

One question at a time. Build your CJE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Jenkins Installation, Configuration, and Administration

A Jenkins administrator wants the controller to start automatically after a Linux host reboot and run under a dedicated service account. Which approach best matches standard Jenkins installation practice?

  1. Install the native OS package and enable the provided systemd service unit Correct answer.
  2. Rely on the Jenkins web UI to restart the process after each reboot
  3. Add a shell script to the controller user's crontab with the @reboot directive
  4. Run java -jar jenkins.war manually from an interactive terminal session

Explanation

The official Linux packages ship a systemd unit (jenkins.service) that runs the controller under the jenkins service account and starts it at boot when enabled. Manual war launches and cron hacks are not managed by the init system, so they lack restart-on-failure and consistent user context.

Question 2Jenkins Installation, Configuration, and Administration

During first-run setup of a new Jenkins controller, where does Jenkins write the initial administrator password that the setup wizard asks for?

  1. $JENKINS_HOME/initialAdminPassword Correct answer.
  2. $JENKINS_HOME/users/admin/config.xml
  3. $JENKINS_HOME/secrets/master.key
  4. /etc/jenkins/admin.password

Explanation

The setup wizard reads a generated one-time password from the initialAdminPassword file inside JENKINS_HOME. After the admin account is created the file is no longer used for unlocking the wizard.

Question 3Jenkins Installation, Configuration, and Administration

An administrator needs to change the TCP port the controller listens on from 8080 to 9090 on an RPM-based installation. Which change is correct?

  1. Edit the port attribute in $JENKINS_HOME/config.xml and reload the browser
  2. Pass --httpPort=9090 to the agent JNLP launcher arguments
  3. Set JENKINS_PORT in /etc/sysconfig/jenkins or the systemd unit's environment and restart the service Correct answer.
  4. Change the Jenkins URL in the global security settings to include :9090

Explanation

The HTTP port is a launch-time parameter supplied to the war, and the packaged service reads it from the sysconfig file or the systemd unit environment. Restarting the service applies the new listener port.

Question 4Jenkins Installation, Configuration, and Administration

A team wants Jenkins configuration (jobs, credentials references, global settings) stored in a Git repository and applied automatically. Which built-in capability supports this?

  1. ThinBackup plugin scheduled exports
  2. Script Console execution at startup
  3. Configuration as Code plugin with a jenkins.yaml file Correct answer.
  4. Built-in job DSL seed job without plugins

Explanation

The Configuration as Code (JCasC) plugin reads a declarative YAML file and reconciles the controller's global configuration to it. It can be pointed at a file or URL, including a Git-hosted copy.

Question 5Jenkins Installation, Configuration, and Administration

An administrator wants agents to connect outbound to the controller over HTTPS without opening a fixed inbound agent port. Which configuration achieves this?

  1. Enable the deprecated JNLP4 protocol on a random UDP port
  2. Use WebSocket agents through the controller's HTTP(S) port Correct answer.
  3. Configure the agent with the inbound TCP port and a fixed JNLP port
  4. Open the controller's CLI port and tunnel agent traffic through it

Explanation

WebSocket agents tunnel the agent connection over the controller's existing HTTP(S) listener, so no separate inbound TCP port is needed and firewalls only see 443. This is the recommended approach for restricted networks.

Question 6Jenkins Installation, Configuration, and Administration

Which file inside JENKINS_HOME stores the global system configuration such as the number of executors and system message?

  1. credentials.xml
  2. jenkins.model.Jenkins.xml
  3. config.xml Correct answer.
  4. hudson.model.UpdateCenter.xml

Explanation

The controller's global settings are persisted in config.xml at the root of JENKINS_HOME. Update center metadata, credentials, and node definitions live in separate files.

Question 7Jenkins Installation, Configuration, and Administration

A build fails with 'No space left on device' on the controller. Which administrative action most directly addresses the root cause while preserving build history?

  1. Increase the JVM heap size in the startup options
  2. Disable the built-in node and run all jobs on agents
  3. Configure build discarders and clean old workspace and log data Correct answer.
  4. Delete the $JENKINS_HOME/war directory

Explanation

Disk exhaustion is usually caused by accumulated build records, archived artifacts, and workspaces, so discarders and cleanup reclaim space while keeping recent history. Heap size affects memory, not disk usage.

Question 8Jenkins Installation, Configuration, and Administration

Which statement about the built-in node (formerly master) in a modern Jenkins controller is correct?

  1. It cannot host any plugins or global configuration
  2. It is removed automatically once one agent is attached
  3. It can be set to zero executors so only agents run builds Correct answer.
  4. It must run all freestyle jobs and cannot be restricted

Explanation

Setting the built-in node's executor count to zero keeps the controller free for scheduling and administration while agents execute builds. This is a common hardening practice.

Question 9Jenkins Installation, Configuration, and Administration

An administrator wants to grant a group of developers the ability to read job output but not change configuration. Which mechanism is appropriate?

  1. Anonymous read access enabled for everyone
  2. Global administrator role assigned to the whole group
  3. Matrix Authorization Strategy with read-only permissions for that group Correct answer.
  4. Script approval for the developers' Groovy scripts

Explanation

The matrix strategy assigns fine-grained permissions per user or group, so a read-only role can be granted without configuration rights. Global admin would grant far more than needed.

Question 10Jenkins Installation, Configuration, and Administration

Which Jenkins security realm validates usernames and passwords against an external LDAP directory?

  1. GitHub OAuth plugin
  2. LDAP security realm Correct answer.
  3. Unix user/group database realm
  4. Jenkins' own database

Explanation

The LDAP realm delegates authentication to a directory server, binding with configured credentials and searching for the user entry. The built-in database stores accounts locally instead.

Question 11Jenkins Installation, Configuration, and Administration

A pipeline needs a secret token without exposing it in the Jenkinsfile or console output. Which approach is correct?

  1. Store the token as a Jenkins credential and bind it with withCredentials Correct answer.
  2. Echo the token into the log so operators can copy it
  3. Pass the token as a plain build parameter in the job configuration
  4. Commit the token to the repository in an encrypted file

Explanation

Credentials are stored encrypted by Jenkins and injected at runtime via withCredentials, and the secret is masked in logs. Committing or printing the token exposes it to anyone with repository or log access.

Question 12Jenkins Installation, Configuration, and Administration

Which plugin is the recommended way to define pipelines in source control using a Groovy-based syntax with stages and steps?

  1. Build Timestamp plugin
  2. Role-based Authorization Strategy plugin
  3. Pipeline: Declarative plugin Correct answer.
  4. Email Extension plugin

Explanation

Declarative pipeline syntax is provided by the Pipeline plugins, with the Declarative plugin enabling the pipeline { agent ... stages { ... } } structure. The other plugins address notifications, authorization, or metadata.

Question 13Jenkins Installation, Configuration, and Administration

An administrator wants to limit which plugins can be installed from the update center to an approved list. Which approach is most appropriate?

  1. Set the Jenkins URL to the internal repository host
  2. Disable the update center entirely and install plugins by copying random jars
  3. Configure an internal update site that serves only approved plugin versions Correct answer.
  4. Grant every user the Overall/Administer permission

Explanation

Pointing Jenkins at a curated internal update site restricts what the update center can offer to the approved set. This keeps version control and provenance while still allowing installs.

Question 14Jenkins Installation, Configuration, and Administration

Which directory under JENKINS_HOME holds installed plugin files and their dependencies?

  1. logs
  2. nodes
  3. plugins Correct answer.
  4. jobs

Explanation

Plugins are unpacked into the plugins directory inside JENKINS_HOME, each with its own subdirectory and jar. The other directories hold job data, agent definitions, and log output.

Question 15Jenkins Installation, Configuration, and Administration

After upgrading a plugin, the controller fails to start with a dependency error. Which recovery step is most appropriate?

  1. Delete JENKINS_HOME and reinstall from scratch
  2. Restore the previous plugin version from backup and restart Correct answer.
  3. Disable the update center and reboot the host
  4. Run a full garbage collection from the Script Console

Explanation

Plugin upgrades change dependency versions, and restoring the prior plugin files from a known-good backup returns the controller to a working state. Wiping JENKINS_HOME destroys jobs and configuration.

Question 16Jenkins Installation, Configuration, and Administration

Which file should be backed up to preserve the controller's encrypted credential records and their encryption key?

  1. credentials.xml together with the secrets directory Correct answer.
  2. jenkins.model.JenkinsLocationConfiguration.xml
  3. config.xml alone
  4. hudson.model.UpdateCenter.xml

Explanation

Credentials are stored in credentials.xml, but the values are encrypted with keys in the secrets directory, so both must be captured for a usable restore. Backing up only the XML yields undecryptable secrets.

Question 17Jenkins Installation, Configuration, and Administration

An administrator needs to run a one-off Groovy script to inspect the controller's internal state. Which built-in feature provides this?

  1. Manage Jenkins > Script Console Correct answer.
  2. Manage Jenkins > Manage Nodes
  3. Manage Jenkins > Global Tool Configuration
  4. Manage Jenkins > System Log

Explanation

The Script Console executes arbitrary Groovy in the controller's JVM, which is why access to it should be restricted to trusted administrators. The other pages expose logs, node management, and tool setup.

Question 18Jenkins Installation, Configuration, and Administration

A build agent is configured with the launch method 'Launch agent by connecting it to the controller' and a fixed port. Which port must be reachable from the agent to the controller?

  1. The agent's SSH port
  2. The configured inbound TCP agent port Correct answer.
  3. The controller's CLI port
  4. The controller's HTTP port only

Explanation

With the inbound connection method the agent dials a dedicated TCP port configured under Manage Jenkins > Security (or the global agent port). That port must be open in the controller's firewall.

Question 19Jenkins Installation, Configuration, and Administration

Which mechanism allows Jenkins to authenticate users against an external identity provider using the OAuth 2.0 authorization code flow?

  1. The legacy JNLP protocol
  2. An OAuth provider plugin such as GitHub or GitLab OAuth Correct answer.
  3. The Unix user/group realm
  4. The built-in database realm

Explanation

OAuth provider plugins implement the authorization code flow against services like GitHub or GitLab and map the resulting identity into Jenkins. The built-in database and Unix realms authenticate locally.

Question 20Jenkins Installation, Configuration, and Administration

An administrator wants to restrict the controller's JVM to a known set of Java options and increase heap to 4 GB on a systemd-based install. Where is this configured?

  1. In $JENKINS_HOME/config.xml as an XML element
  2. In the global tool configuration for the JDK
  3. In the systemd unit's environment or the sysconfig file, using JAVA_OPTS or JENKINS_JAVA_OPTS Correct answer.
  4. In the Jenkinsfile's agent block as a JVM argument

Explanation

JVM options are passed on the java command line, and packaged services expose them through JAVA_OPTS or JENKINS_JAVA_OPTS in the unit environment or sysconfig. Jenkins configuration files do not set JVM flags.

Question 21Jenkins Installation, Configuration, and Administration

Which action is the most effective way to reduce the attack surface of a controller exposed to a corporate network?

  1. Disable CSRF protection to speed up form submissions
  2. Install every available plugin to cover all use cases
  3. Run the controller with the built-in node set to zero executors and restrict admin permissions Correct answer.
  4. Enable anonymous read access for convenience

Explanation

Keeping builds off the controller and limiting administrative permissions reduces the code executed in the controller's JVM and the number of privileged users. Anonymous access and disabling CSRF protection widen exposure.

Question 22Jenkins Installation, Configuration, and Administration

A team needs a build to run only on agents labeled 'linux' and never on the controller. Which configuration enforces this?

  1. Set the job to run on any available node
  2. Assign the job to the built-in node explicitly
  3. Disable all agents and use the controller only
  4. Set the job's label expression to 'linux' and leave the built-in node with zero executors Correct answer.

Explanation

A label expression restricts scheduling to matching nodes, and zero executors on the built-in node removes it as a candidate. Together they guarantee the job runs on labeled agents.

Question 23Jenkins Installation, Configuration, and Administration

Which statement describes the purpose of the Jenkins CLI over SSH?

  1. It lets administrators run commands such as creating jobs or reloading configuration from a shell Correct answer.
  2. It stores plugin binaries for distribution
  3. It replaces the web UI for all interactive administration
  4. It provides the transport used by inbound agents

Explanation

The CLI exposes administrative commands over an SSH endpoint, useful for scripting tasks like reloading configuration or triggering jobs. It complements rather than replaces the UI.

Question 24Jenkins Installation, Configuration, and Administration

An administrator restores a JENKINS_HOME backup onto a new host but jobs reference credentials that no longer decrypt. Which cause is most likely?

  1. The jobs were configured with the wrong label
  2. The update center URL changed
  3. The JVM heap was reduced
  4. The secrets directory was not restored with the same content Correct answer.

Explanation

Credential values are encrypted with keys stored in the secrets directory, so restoring credentials.xml without the matching keys makes them unreadable. The backup must include both.

Question 25Jenkins Installation, Configuration, and Administration

Which setting controls how many builds a single agent can execute concurrently?

  1. The build discarder threshold
  2. The number of executors configured on that node Correct answer.
  3. The SCM polling interval
  4. The global quiet period

Explanation

Each node's executor count determines how many builds it can run at once. The quiet period delays starts, discarders prune history, and polling controls change detection.

Question 26Jenkins Installation, Configuration, and Administration

An administrator wants Jenkins to keep a rolling window of build logs for the controller's own diagnostic purposes, independent of the per-job log rotation settings. Which configuration area controls the system log recorder that captures Jenkins core log messages?

  1. Manage Jenkins > Configure System, where the system message and executor count are defined
  2. The jenkins.xml or init script JVM options, which set java.util.logging handlers
  3. Manage Jenkins > System Log, where named log recorders can be created with custom log levels and targets Correct answer.
  4. The job's own Discard old builds setting, which governs log retention per project

Explanation

Jenkins exposes a built-in System Log page under Manage Jenkins where administrators create named log recorders, choose the logger and level, and optionally mirror output to a file. These recorders are independent of per-job build log rotation, which only affects archived console logs. JVM logging configuration can influence output but the supported administrative interface is the System Log recorder page.

Question 27Jenkins Installation, Configuration, and Administration

An administrator must ensure that every newly created Pipeline job automatically gets a build retention policy of 30 builds without editing each Jenkinsfile. Which mechanism accomplishes this?

  1. Configure the job's SCM polling interval to 30 minutes
  2. Add a post block with cleanWs() to each Jenkinsfile
  3. Set the executor count to 30 so only 30 builds can exist
  4. Enable the global build discarder under Manage Jenkins > Configure System and set the count Correct answer.

Explanation

Jenkins provides a global build discarder in the system configuration that applies default retention to jobs that do not define their own. It is applied as a job property, so new Pipeline jobs inherit the policy without Jenkinsfile changes. Per-job or Jenkinsfile options override the global default when present.

Question 28Jenkins Installation, Configuration, and Administration

An administrator wants Jenkins to notify an external endpoint whenever a build result changes, without installing any plugin. Which built-in capability is most appropriate?

  1. Enable the global build discarder with a webhook target
  2. Rely on the default mailer to send messages to the endpoint's email address
  3. Use the built-in Jenkins CLI from a cron job to poll build status
  4. Configure a post-build task in the job that runs a command-line HTTP client Correct answer.

Explanation

Core Jenkins has no native outbound webhook sender; notification to arbitrary HTTP endpoints requires either a plugin or a build step that invokes an HTTP client. A post-build step running curl or an equivalent tool is the plugin-free route and can be conditioned on build result. Polling via CLI is possible but is not a notification mechanism and adds latency.

Question 29Jenkins Installation, Configuration, and Administration

A controller uses the 'Matrix Authorization Strategy' and a developer reports that they can see a folder but none of the jobs inside it. Which explanation best fits how folder permissions are evaluated?

  1. Matrix authorization ignores folders entirely and evaluates only global permissions
  2. The developer needs the Overall/Administer permission to view jobs inside any folder
  3. Permissions granted on a folder are inherited by its children unless a child item defines its own authorization Correct answer.
  4. Folder permissions apply only to the folder object and never propagate to contained jobs

Explanation

With matrix authorization, ACLs on a folder are inherited by items beneath it, so granting access at the folder level normally exposes its contents. A child job or nested folder that defines its own explicit ACL can break that inheritance and hide items from the user. Diagnosing this means comparing the folder ACL with the ACL on the specific child item.

Question 30Jenkins Installation, Configuration, and Administration

An administrator needs to move the controller's build queue and executor state to a new host while keeping the same JENKINS_HOME, and must avoid starting two controllers against the same home. Which sequence is safest?

  1. Copy JENKINS_HOME while both controllers run, then start the new instance and let it reconcile state
  2. Stop the old controller, copy JENKINS_HOME with permissions preserved, then start the new instance before the old one is reachable Correct answer.
  3. Delete the queue.xml and config.xml files on the old host before copying to force a clean start
  4. Start the new controller first, then shut down the old one after confirming both are healthy

Explanation

JENKINS_HOME contains mutable state such as build records, the queue, and configuration that must not be written by two controllers at once. The safe sequence is to stop the original instance, copy the directory preserving file ownership and permissions, then start the replacement. Copying while running or running both simultaneously risks corruption and split-brain behavior.

Question 31User Management, Security, and Access Control

A security administrator needs a permission model where each object carries an access control list naming individual users and their allowed operations. Which access control model is being described?

  1. Mandatory access control (MAC)
  2. Role-based access control (RBAC)
  3. Discretionary access control (DAC) Correct answer.
  4. Attribute-based access control (ABAC)

Explanation

Discretionary access control lets object owners assign permissions to specific subjects through ACLs, so access decisions are at the owner's discretion. MAC instead enforces system-wide labels, RBAC grants through roles, and ABAC evaluates attributes in policy.

Question 32User Management, Security, and Access Control

Which principle states that a user should be granted only the access necessary to perform their job and nothing more?

  1. Defense in depth
  2. Least privilege Correct answer.
  3. Implicit deny
  4. Separation of duties

Explanation

Least privilege limits each account to the minimum rights required for its tasks, shrinking the blast radius of misuse or compromise. Separation of duties instead splits conflicting tasks among people, and defense in depth layers controls.

Question 33User Management, Security, and Access Control

An organization wants authentication based on something the user has rather than something the user knows. Which factor satisfies that requirement?

  1. A fingerprint scan
  2. A hardware security token Correct answer.
  3. A security question answer
  4. A memorized passphrase

Explanation

Authentication factors fall into knowledge, possession, and inherence categories. A hardware token is a possession factor because the user must physically hold the device, whereas passphrases and security answers are knowledge.

Question 34User Management, Security, and Access Control

Which activity best describes authorization as distinct from authentication?

  1. Determining which resources an authenticated user may access Correct answer.
  2. Issuing a session cookie after a successful login
  3. Enrolling a user's device in a multifactor flow
  4. Verifying a user's password against a stored hash

Explanation

Authentication establishes identity, while authorization decides what that identified subject is permitted to do. Checking a password or issuing a session proves identity; deciding resource access is the authorization step.

Question 35User Management, Security, and Access Control

A company must retain user activity records for a regulatory period and guarantee they cannot be altered afterward. Which control characteristic is required?

  1. Integrity Correct answer.
  2. Availability
  3. Non-repudiation
  4. Confidentiality

Explanation

Integrity ensures data remains accurate and unaltered, so tamper-evident retention of activity records depends on it. Non-repudiation prevents denial of an action, and confidentiality or availability address different properties.

Question 36User Management, Security, and Access Control

Which statement correctly distinguishes identification from authentication in an access control process?

  1. Identification proves a claimed identity, and authentication assigns permissions.
  2. Identification and authentication are synonyms in access control.
  3. Identification presents a claimed identity, and authentication verifies it. Correct answer.
  4. Identification occurs only after authorization succeeds.

Explanation

Identification is the act of presenting an identity such as a username, while authentication validates that the claim is genuine. Authorization then follows to determine permitted actions.

Question 37User Management, Security, and Access Control

A user is added to a group that grants read access to a shared folder, but the user's account also carries an explicit deny for that folder. In a system where explicit deny overrides allow, what is the effective access?

  1. Read access, because the group grant is inherited
  2. No access, because the explicit deny overrides the allow Correct answer.
  3. No access, because group grants never apply to folders
  4. Read access, because group permissions take precedence

Explanation

When explicit deny entries override allow entries, the deny on the account wins over the inherited group allow. The result is that the user cannot read the folder despite group membership.

Question 38User Management, Security, and Access Control

A security team wants to enforce that no single employee can both create a vendor and approve payment for that vendor. Which control should they implement?

  1. Job rotation
  2. Mandatory vacation
  3. Separation of duties Correct answer.
  4. Least privilege

Explanation

Separation of duties splits a sensitive process so that no one person controls all critical steps, preventing fraud by requiring different people to create and approve. Least privilege limits rights but does not split the workflow.

Question 39User Management, Security, and Access Control

An administrator must give a contractor temporary access to a single application for 30 days with automatic removal. Which approach best meets the requirement?

  1. Grant the contractor domain administrator rights
  2. Share a current employee's credentials with the contractor
  3. Add the contractor to a permanent application group
  4. Create a time-bound account with an expiration date Correct answer.

Explanation

A time-bound account with a defined expiration enforces automatic removal and limits the access window. Permanent group membership, credential sharing, and excessive rights all violate least privilege and accountability.

Question 40User Management, Security, and Access Control

A policy requires that privileged accounts be used only for administrative tasks while separate standard accounts are used for email and browsing. What risk does this primarily reduce?

  1. Credential theft leading to widespread compromise Correct answer.
  2. Failure of backup rotation schedules
  3. Phishing of standard user accounts
  4. Loss of availability of the email server

Explanation

Separating administrative and standard accounts limits exposure of privileged credentials to routine activities such as email and web browsing, where theft is common. If a standard account is phished, the attacker does not obtain administrative rights.

Question 41User Management, Security, and Access Control

An organization implements single sign-on across internal applications. Which security consideration is most important to address?

  1. Disabling multifactor authentication to simplify the flow
  2. Allowing anonymous access to the identity provider
  3. Ensuring each application stores its own separate password
  4. Treating the identity provider as a high-value asset with strong protection Correct answer.

Explanation

With SSO, the identity provider becomes a central point whose compromise grants access to many applications, so it must be strongly protected with controls such as MFA. Per-application passwords and anonymous access are contrary to SSO goals.

Question 42User Management, Security, and Access Control

A system uses role-based access control. A user needs a task performed that requires permissions from two roles, but policy forbids assigning both roles to one person. What is the appropriate response?

  1. Assign both roles temporarily and remove them later
  2. Have a user who already holds the second role perform the task Correct answer.
  3. Merge the two roles into one broader role
  4. Grant the user direct permissions bypassing roles

Explanation

When role assignment is restricted, the conflicting task should be completed by another authorized person, preserving the control. Temporarily stacking roles, bypassing roles, or merging them all defeat the separation intent.

Question 43User Management, Security, and Access Control

An access review finds several accounts belonging to former employees that remain enabled. Which control failure does this most directly represent?

  1. Inadequate account deprovisioning Correct answer.
  2. Improper data classification
  3. Weak password complexity policy
  4. Insufficient network segmentation

Explanation

Accounts for departed employees should be disabled or removed promptly as part of the joiner-mover-leaver lifecycle. Lingering enabled accounts indicate deprovisioning failed, creating unauthorized access risk.

Question 44User Management, Security, and Access Control

A federated identity setup allows users from a partner organization to access resources without creating local accounts. Which standard is most commonly used to exchange authentication assertions in this scenario?

  1. LDAP
  2. NTP
  3. SAML Correct answer.
  4. SNMP

Explanation

SAML is an XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider across organizational boundaries. LDAP is a directory protocol, and SNMP and NTP are network management and time protocols.

Question 45User Management, Security, and Access Control

An administrator wants to limit the damage if a service account credential is stolen. Which measure best supports that goal?

  1. Granting the service account interactive logon rights
  2. Restricting the service account to the minimum required resources Correct answer.
  3. Sharing the service account among many applications
  4. Storing the credential in a plaintext configuration file

Explanation

Scoping a service account to only the resources it needs limits the impact of credential theft, consistent with least privilege. Interactive logon, sharing, and plaintext storage all increase exposure.

Question 46User Management, Security, and Access Control

A policy states that access decisions must consider the user's department, the data classification, and the time of day in a single evaluation. Which model best fits?

  1. Attribute-based access control Correct answer.
  2. Rule-based access control limited to source IP
  3. Role-based access control
  4. Discretionary access control

Explanation

Attribute-based access control evaluates multiple attributes such as department, classification, and time in policy decisions, which matches the requirement. RBAC relies on roles, and DAC relies on owner discretion.

Question 47User Management, Security, and Access Control

A security architect needs a centralized directory to store user accounts and group memberships that many applications can query for authentication. Which technology is designed for this purpose?

  1. DHCP server
  2. Syslog server
  3. LDAP directory service Correct answer.
  4. Load balancer

Explanation

LDAP provides a hierarchical directory that stores identities and group information and is widely queried by applications for authentication and authorization. Syslog, DHCP, and load balancers serve logging, addressing, and traffic distribution respectively.

Question 48User Management, Security, and Access Control

An attacker who has compromised a standard user workstation attempts to move to a server using cached administrative credentials left on the machine. Which mitigation most directly reduces this risk?

  1. Increasing the password minimum length for all users
  2. Enabling more verbose application logging
  3. Adding additional standard user accounts
  4. Restricting where privileged credentials can be used and logged on Correct answer.

Explanation

Limiting privileged credential exposure to designated administrative systems prevents cached admin secrets from residing on ordinary workstations. Longer passwords, verbose logs, and extra standard accounts do not remove cached admin credentials.

Question 49User Management, Security, and Access Control

A team is designing access control for a system where objects receive sensitivity labels and users receive clearances, and the operating system enforces the comparison. Which model and key property apply?

  1. MAC, because labels and clearances are enforced by the system Correct answer.
  2. DAC, because owners set permissions
  3. RBAC, because roles map to labels
  4. ABAC, because time is evaluated

Explanation

Mandatory access control assigns sensitivity labels to objects and clearances to subjects, and the system enforces the comparison regardless of owner intent. DAC, RBAC, and ABAC do not rely on this label-clearance enforcement.

Question 50User Management, Security, and Access Control

An organization adopts just-in-time privileged access where administrative rights are granted only after approval and expire automatically. Which two security goals does this approach most directly advance?

  1. Confidentiality and availability
  2. Availability and redundancy
  3. Least privilege and accountability Correct answer.
  4. Data classification and retention

Explanation

Just-in-time elevation grants rights only when needed, supporting least privilege, and the approval and expiration trail supports accountability. The other pairs concern different properties such as uptime or data handling.