I85PREP
⌘ K
NISP Level 1 - Security Operations study materials
NISP Level 1 - Security Operations study resources

NISP Level 1 - Security Operations practice questions

One question at a time. Build your NISP Level 1 - Security Operations understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Fundamentals and Security Models

In the CIA triad, which property is primarily concerned with ensuring that data has not been altered by an unauthorized party?

  1. Confidentiality
  2. Availability
  3. Integrity Correct answer.
  4. Non-repudiation

Explanation

Integrity addresses the accuracy and completeness of data and protects against unauthorized modification, whether accidental or malicious. Confidentiality concerns preventing unauthorized disclosure, while availability concerns timely and reliable access. Non-repudiation is a separate assurance property, not one of the three CIA components.

Question 2Information Security Fundamentals and Security Models

A hospital encrypts patient records at rest and enforces role-based access so only treating clinicians can view them. Which security goal does this control set most directly serve?

  1. Accountability
  2. Availability
  3. Integrity
  4. Confidentiality Correct answer.

Explanation

Encryption at rest and role-based viewing restrictions both limit who can read the data, which is the definition of confidentiality. Integrity would focus on preventing or detecting modification, and availability on ensuring access when needed. Accountability would require audit trails tying actions to identities.

Question 3Information Security Fundamentals and Security Models

What does the principle of least privilege require of an access control design?

  1. Each object is encrypted with a key unique to its owner
  2. Each subject is granted only the permissions needed for its assigned tasks Correct answer.
  3. Each subject is granted full access but monitored by an auditor
  4. Each user is authenticated with at least two factors

Explanation

Least privilege limits rights so that a user, process, or program receives only the access necessary to perform its function, reducing the blast radius of misuse or compromise. It is about minimizing permissions, not about auditing, key management, or authentication strength. Those are separate controls that can complement but do not define the principle.

Question 4Information Security Fundamentals and Security Models

In the Bell-LaPadula model, which rule prevents a subject from reading data classified above its own clearance level?

  1. The simple security property Correct answer.
  2. The star property
  3. The strong star property
  4. The tranquility principle

Explanation

The simple security property, often summarized as no read up, forbids a subject from reading objects at a higher classification than its clearance. The star property instead restricts writes (no write down). Tranquility concerns the stability of security labels, and strong star limits a subject to a single security level.

Question 5Information Security Fundamentals and Security Models

Which access control model bases authorization decisions on attributes such as department, time of day, and device posture?

  1. Role-based access control
  2. Mandatory access control
  3. Attribute-based access control Correct answer.
  4. Discretionary access control

Explanation

Attribute-based access control evaluates policies against attributes of the subject, the resource, the action, and the environment, enabling fine-grained context-aware decisions. Discretionary access control lets owners set permissions, mandatory access control relies on system-assigned labels, and role-based access control keys decisions to job roles.

Question 6Information Security Fundamentals and Security Models

An organization separates the duties of initiating a payment, approving it, and reconciling the ledger among three different employees. Which control concept does this illustrate?

  1. Least privilege
  2. Fail-safe defaults
  3. Separation of duties Correct answer.
  4. Defense in depth

Explanation

Separation of duties splits a sensitive process among multiple people so that no single individual can complete a fraudulent or erroneous transaction alone. Defense in depth layers multiple controls, least privilege limits permissions, and fail-safe defaults choose secure states on failure; none of these describe splitting a workflow among people.

Question 7Information Security Fundamentals and Security Models

What distinguishes a threat from a vulnerability in risk analysis?

  1. A threat is a control gap, while a vulnerability is a regulatory penalty
  2. A threat is a weakness in code, while a vulnerability is an attacker's motivation
  3. A threat is a realized incident, while a vulnerability is an unpatched system
  4. A threat is a potential cause of harm, while a vulnerability is a weakness that the threat can exploit Correct answer.

Explanation

A threat is any potential source of harm, such as an attacker or natural event, whereas a vulnerability is a weakness in a system or control that could be exploited. Risk arises when a threat can act on a vulnerability. Realized incidents and regulatory penalties are consequences, not definitions of these terms.

Question 8Information Security Fundamentals and Security Models

Which statement correctly describes the relationship between residual risk and inherent risk?

  1. Residual risk is the risk before any controls, while inherent risk remains after treatment
  2. Residual risk is the risk remaining after controls are applied to inherent risk Correct answer.
  3. Residual risk applies only to financial systems, while inherent risk applies to technical systems
  4. Residual risk and inherent risk are always equal once a control is documented

Explanation

Inherent risk is the level of risk that exists before controls are considered, and residual risk is what remains after controls are implemented and evaluated. Effective controls lower residual risk relative to inherent risk. The two are not automatically equal, and neither term is limited to a particular system type.

Question 9Information Security Fundamentals and Security Models

What is the primary purpose of a business impact analysis in continuity planning?

  1. To enumerate technical vulnerabilities on internet-facing servers
  2. To identify critical processes and quantify the consequences of their disruption Correct answer.
  3. To assign user access rights according to job roles
  4. To define the encryption algorithms used for backup media

Explanation

A business impact analysis identifies critical business functions and estimates the operational and financial effects of their disruption, which drives recovery objectives. Vulnerability scanning, cryptographic standards, and role provisioning are separate activities that do not determine recovery priorities. The BIA output feeds recovery time and recovery point objectives.

Question 10Information Security Fundamentals and Security Models

Which pair correctly matches a recovery objective with its meaning?

  1. RTO defines the maximum tolerable downtime, while RPO defines the maximum tolerable data loss Correct answer.
  2. RTO defines the restore speed, while RPO defines the encryption strength
  3. RTO defines the backup frequency, while RPO defines the restore speed
  4. RTO defines the maximum data loss, while RPO defines the maximum downtime

Explanation

Recovery time objective specifies how long a process may remain unavailable, and recovery point objective specifies how much data loss, measured in time, is acceptable. Backup frequency is often derived from the RPO but is not the same concept. Neither objective describes encryption strength.

Question 11Information Security Fundamentals and Security Models

Which security model is specifically designed to address conflicts of interest by partitioning data into compartments that subjects cannot access simultaneously?

  1. Biba integrity model
  2. Brewer-Nash model Correct answer.
  3. Clark-Wilson model
  4. Harrison-Ruzzo-Ullman model

Explanation

The Brewer-Nash model, often called the Chinese Wall, dynamically restricts access so that once a subject accesses one company's data in a conflict-of-interest class, it cannot access competitors' data. Biba and Clark-Wilson address integrity, and Harrison-Ruzzo-Ullman formalizes how access rights can change. Only Brewer-Nash targets conflict-of-interest separation.

Question 12Information Security Fundamentals and Security Models

In the Biba integrity model, which rule states that a subject may not read data at a lower integrity level than its own?

  1. No write up
  2. No write down
  3. No read down Correct answer.
  4. No read up

Explanation

Biba is the integrity mirror of Bell-LaPadula: it prevents contamination by forbidding reading lower-integrity data (no read down) and forbidding writing to higher-integrity data (no write up). No read up and no write down are Bell-LaPadula confidentiality rules. Confusing the two models is a common error.

Question 13Information Security Fundamentals and Security Models

Which statement best captures the difference between authentication and authorization?

  1. Authentication and authorization are synonyms in access control design
  2. Authentication verifies identity, while authorization determines what an identity may do Correct answer.
  3. Authentication determines permissions, while authorization verifies credentials
  4. Authentication applies only to humans, while authorization applies only to services

Explanation

Authentication establishes who a subject is, and authorization decides which resources or actions that subject is permitted to use. They are sequential but distinct functions, and both apply to human and machine identities. Treating them as synonyms blurs a fundamental access control distinction.

Question 14Information Security Fundamentals and Security Models

A system grants access only when the user presents a password and a hardware token code. Which authentication concept does this implement?

  1. Federated identity
  2. Passwordless authentication
  3. Multi-factor authentication Correct answer.
  4. Single sign-on

Explanation

Multi-factor authentication requires two or more independent factor types, such as something you know (password) and something you have (hardware token). Single sign-on, federation, and passwordless approaches describe how credentials are shared or presented, not the combination of independent factors. Combining a password with a token code satisfies the multi-factor definition.

Question 15Information Security Fundamentals and Security Models

What is the key distinction between symmetric and asymmetric cryptography?

  1. Symmetric uses one shared key, while asymmetric uses a public and private key pair Correct answer.
  2. Symmetric requires a certificate authority, while asymmetric does not
  3. Symmetric uses a key pair, while asymmetric uses one shared secret
  4. Symmetric provides confidentiality, while asymmetric provides only integrity

Explanation

Symmetric algorithms use a single shared secret for encryption and decryption, while asymmetric algorithms use mathematically related public and private keys. Both families can support confidentiality and integrity mechanisms depending on how they are used. Certificate authorities support public key distribution but are not a defining property of either family.

Question 16Information Security Fundamentals and Security Models

Which property of a cryptographic hash function makes it infeasible to find two different inputs producing the same output?

  1. Collision resistance Correct answer.
  2. Key escrow
  3. Perfect forward secrecy
  4. Salting

Explanation

Collision resistance means it is computationally infeasible to find two distinct inputs with the same hash value, which underpins integrity checks and digital signatures. Key escrow concerns recovery of keys by a third party, forward secrecy protects past session keys, and salting perturbs password hashing inputs. None of those describe the collision property.

Question 17Information Security Fundamentals and Security Models

A security team wants a control that detects unauthorized changes to a set of critical configuration files. Which mechanism is best suited to this goal?

  1. Full-disk encryption of the affected hosts
  2. Password complexity enforcement for administrators
  3. Network segmentation of the server subnet
  4. File integrity monitoring using cryptographic hashes Correct answer.

Explanation

File integrity monitoring computes and compares cryptographic hashes of files, so any unauthorized modification produces a detectable mismatch. Encryption protects confidentiality at rest, segmentation limits network reach, and password policy hardens authentication; none of these detect file changes. Integrity monitoring directly addresses the stated detection goal.

Question 18Information Security Fundamentals and Security Models

Which statement best describes the role of a digital signature?

  1. It provides integrity and origin authentication for a message using the signer's private key Correct answer.
  2. It encrypts the message body so only the recipient can read it
  3. It guarantees that the message will be delivered to the recipient
  4. It hides the sender's identity from intermediaries

Explanation

A digital signature is generated with the signer's private key over a hash of the message, so verification with the public key confirms both origin and that the content was not altered. It does not encrypt the message body, guarantee delivery, or conceal the signer's identity. Confidentiality and non-repudiation rely on separate mechanisms or properties.

Question 19Information Security Fundamentals and Security Models

In public key infrastructure, what is the primary function of a certificate authority?

  1. To issue and sign certificates that bind a public key to an identity Correct answer.
  2. To assign IP addresses to certificate holders
  3. To encrypt all traffic between subscribers
  4. To store the private keys of all subscribers for recovery

Explanation

A certificate authority validates identity information and signs certificates that bind a subject's public key to that identity, allowing relying parties to trust the binding. It does not normally hold subscribers' private keys, encrypt traffic, or manage network addressing. Those tasks belong to other components or services.

Question 20Information Security Fundamentals and Security Models

What does the concept of defense in depth recommend for securing an environment?

  1. Layering multiple independent controls so that failure of one does not defeat protection Correct answer.
  2. Granting broad access so monitoring can detect misuse
  3. Removing redundant controls to reduce operational cost
  4. Relying on a single strong perimeter firewall for all protection

Explanation

Defense in depth places overlapping controls at multiple layers, so a gap or failure in one layer is compensated by others. A single perimeter device creates a single point of failure, removing redundancy weakens resilience, and broad access increases exposure rather than improving detection. The strategy assumes controls can fail and plans accordingly.

Question 21Information Security Fundamentals and Security Models

Which statement accurately describes the difference between a policy and a procedure in a security program?

  1. A policy is optional guidance, while a procedure is legally binding
  2. A policy gives step-by-step instructions, while a procedure states high-level requirements
  3. A policy states mandatory high-level requirements, while a procedure gives step-by-step instructions Correct answer.
  4. A policy applies to technology, while a procedure applies to people

Explanation

Policies express management's mandatory intent and high-level rules, whereas procedures describe the specific steps used to carry them out. Standards and guidelines sit between them in the hierarchy. Policies are not optional, and both policies and procedures can address people and technology.

Question 22Information Security Fundamentals and Security Models

Which control type is a security awareness training program for staff?

  1. Technical control
  2. Compensating control
  3. Administrative control Correct answer.
  4. Physical control

Explanation

Administrative controls are management and personnel measures such as policies, training, and awareness programs. Technical controls are implemented in systems, and physical controls protect facilities and hardware. A compensating control is defined by its role of substituting for another control, not by being training.

Question 23Information Security Fundamentals and Security Models

In the Clark-Wilson integrity model, what role do well-formed transactions play?

  1. They define which users may read classified documents
  2. They encrypt all database records before storage
  3. They replace the need for authentication entirely
  4. They constrain users to a defined sequence of operations that preserves data integrity Correct answer.

Explanation

Clark-Wilson separates users from data and requires that changes occur only through certified well-formed transactions that maintain integrity invariants. It does not primarily address encryption, classification-based reading rules, or the removal of authentication. Those concerns belong to other controls or models.

Question 24Information Security Fundamentals and Security Models

A company allows employees to install any approved software from a curated internal catalog while blocking unlisted installers. Which combination of access control concepts does this best illustrate?

  1. Mandatory access control based on classification labels
  2. Allow-listing enforced by a discretionary policy over endpoint software Correct answer.
  3. Attribute-based access control applied to database rows
  4. Role-based access control applied to network segments

Explanation

An allow-list permits only cataloged software, and the catalog itself is a discretionary policy set by the organization for endpoints. It is not label-driven mandatory access control, role-based network segmentation, or row-level database authorization. The scenario concerns endpoint software selection, so allow-listing is the fitting concept.

Question 25Security Laws, Regulations, Standards and Compliance

Under China's Cybersecurity Law, which principle governs how network operators may collect and use personal information?

  1. Collection only permitted after approval by a national standards body
  2. Unlimited collection for any business purpose that improves service quality
  3. Collection allowed freely provided the data is stored outside China
  4. Lawful,正当 and necessary collection with consent and limited use Correct answer.

Explanation

The Cybersecurity Law requires network operators to collect and use personal information on the principles of lawfulness,正当ness and necessity, to disclose the purpose, method and scope, and to obtain consent. Use is limited to the stated purpose, and unrelated collection is prohibited.

Question 26Security Laws, Regulations, Standards and Compliance

Classified protection (等级保护) under Chinese regulation requires an information system to be graded and then protected according to which basis?

  1. The number of employees who use the system
  2. Its assessed security level, with obligations rising as the level rises Correct answer.
  3. The physical size of the data center hosting it
  4. The vendor's product warranty terms

Explanation

Classified protection requires operators to determine a system's security level based on the harm a breach would cause to national security, public order and lawful rights, then apply the corresponding protective measures. Higher levels carry stricter requirements such as filing and periodic assessment.

Question 27Security Laws, Regulations, Standards and Compliance

A security analyst in China discovers that a company system has suffered an intrusion. Under the Cybersecurity Law, what is the operator's immediate obligation regarding reporting?

  1. Report only if the attacker is identified with certainty
  2. Report to the relevant authority immediately and take remedial measures Correct answer.
  3. Wait until the next quarterly compliance review to disclose
  4. Notify only the affected customers without informing authorities

Explanation

Operators must take immediate remedial action when a security incident occurs and report to the competent authority as required. Delaying disclosure or limiting notification to customers does not satisfy the statutory reporting duty.

Question 28Security Laws, Regulations, Standards and Compliance

Which statement best describes the role of a national cybersecurity standard such as those in the GB/T series?

  1. It applies only to foreign companies operating in the country
  2. It provides recommended practices that may become mandatory when cited by law or contract Correct answer.
  3. It is a marketing label with no technical content
  4. It automatically overrides any law passed by the legislature

Explanation

National standards in the GB/T series are generally recommended, but they gain binding force when a law, regulation or contract incorporates them by reference. They never override legislation, since statutes rank above standards.

Question 29Security Laws, Regulations, Standards and Compliance

In the context of personal information protection, what does the principle of purpose limitation require?

  1. Personal information is used only for the purpose disclosed and agreed at collection Correct answer.
  2. Personal information must be deleted the same day it is collected
  3. Personal information may be freely reused for any new purpose without notice
  4. Personal information may be sold if the buyer is a domestic company

Explanation

Purpose limitation means data collected for one stated purpose should not be repurposed without a new lawful basis or fresh consent. Any new use requires updated disclosure and, where applicable, renewed consent.

Question 30Security Laws, Regulations, Standards and Compliance

Which of the following is the primary purpose of a security compliance audit?

  1. To assign blame to individual employees for past incidents
  2. To verify that controls and practices meet applicable legal and standards requirements Correct answer.
  3. To increase the marketing value of a company's product
  4. To replace the need for any technical security controls

Explanation

A compliance audit provides independent evidence that an organization's controls satisfy applicable laws, regulations and standards, and identifies gaps for remediation. It supplements rather than replaces technical controls and is not a blame exercise.

Question 31Security Laws, Regulations, Standards and Compliance

An organization processes large volumes of personal data and must decide whether a data protection impact assessment is needed before launching a new profiling feature. Which approach best reflects compliance expectations?

  1. Conduct the assessment before processing begins and document risks and mitigations Correct answer.
  2. Launch first and conduct the assessment only if a complaint is received
  3. Skip the assessment because profiling uses only internal data
  4. Delegate the decision entirely to the software vendor

Explanation

When processing is likely to pose high risk to individuals, a data protection impact assessment should be completed before processing starts, with risks and mitigations documented. Retrospective assessment after complaints defeats the preventive purpose.

Question 32Security Laws, Regulations, Standards and Compliance

A company wants to transfer personal information collected in China to an overseas subsidiary. Which measure is consistent with cross-border transfer requirements?

  1. Encrypting the data so no transfer rules apply
  2. Transferring first and documenting the arrangement afterwards
  3. Completing a security assessment or using an approved standard contract before transfer Correct answer.
  4. Relying on the overseas subsidiary's own privacy policy alone

Explanation

Cross-border transfer of personal information requires satisfying a prescribed mechanism, such as a security assessment, certification or an approved standard contract, before the data leaves. Internal policies or encryption alone do not remove the obligation.

Question 33Security Laws, Regulations, Standards and Compliance

During a compliance review, an auditor finds that an administrator account with elevated privileges is shared among three staff members. Which finding is most appropriate?

  1. The finding is irrelevant to compliance frameworks
  2. The practice is acceptable if all three staff are trustworthy
  3. Accountability is weakened because actions cannot be attributed to an individual Correct answer.
  4. The practice is acceptable provided the password is long

Explanation

Most security frameworks require unique identification and accountability, so shared privileged accounts break the ability to attribute actions and audit them. Trustworthiness or password length does not restore individual accountability.

Question 34Security Laws, Regulations, Standards and Compliance

Which activity best demonstrates due diligence in supply chain security compliance?

  1. Relying on verbal assurances from the sales representative
  2. Assessing a vendor's security posture and documenting contractual security obligations Correct answer.
  3. Assuming a well-known brand needs no assessment
  4. Selecting the cheapest vendor without any review

Explanation

Due diligence in the supply chain means evaluating the vendor's security controls and recording security requirements in the contract so obligations are enforceable. Brand reputation or verbal assurances are not substitutes for documented assessment.

Question 35Security Laws, Regulations, Standards and Compliance

A security team must retain system audit logs to support investigations and regulatory checks. Which retention approach is most defensible?

  1. Delete logs daily to save storage
  2. Define a retention period based on legal and operational needs and protect logs from alteration Correct answer.
  3. Keep logs only on the endpoint where they were generated
  4. Allow administrators to edit logs freely to correct errors

Explanation

Log retention should follow a documented period driven by legal requirements and investigative needs, and logs must be protected against tampering to remain trustworthy evidence. Deleting quickly or permitting edits undermines both compliance and investigations.

Question 36Security Laws, Regulations, Standards and Compliance

What distinguishes a regulation from a recommended standard in a security compliance program?

  1. A recommended standard is always enforceable in court
  2. A regulation is optional guidance published by industry groups
  3. A regulation is legally binding, while a recommended standard is voluntary unless incorporated Correct answer.
  4. Both have identical legal force in all circumstances

Explanation

Regulations carry legal force and non-compliance can attract penalties, whereas recommended standards are voluntary guidance unless a law or contract makes them binding. Treating them as identical misstates their legal effect.

Question 37Security Laws, Regulations, Standards and Compliance

An employee accidentally emails a spreadsheet of customer records to the wrong external address. Which response best reflects sound incident handling under privacy obligations?

  1. Ignore it because the recipient is unlikely to open the file
  2. Contain and assess the exposure, notify per policy and legal thresholds, and record lessons learned Correct answer.
  3. Wait a year to see whether any harm materializes
  4. Delete the sent email from the outbox to erase the evidence

Explanation

A personal data breach requires prompt containment, risk assessment and notification where legal thresholds are met, plus documentation to prevent recurrence. Ignoring, deleting evidence or indefinite delay conflicts with these duties.

Question 38Security Laws, Regulations, Standards and Compliance

Why do compliance frameworks require separation of duties in privileged operations?

  1. To reduce the number of staff needed for operations
  2. To guarantee that no incident can ever occur
  3. To avoid the need for logging privileged activity
  4. To prevent one person from both performing and approving a sensitive action Correct answer.

Explanation

Separation of duties reduces the risk of error or fraud by ensuring that no single individual can execute and approve a sensitive action alone. It complements logging rather than replacing it and cannot guarantee zero incidents.

Question 39Security Laws, Regulations, Standards and Compliance

An organization claims compliance with a security standard but has no evidence of control operation. What is the most accurate assessment?

  1. The claim is unsupported because compliance requires demonstrable evidence of effectiveness Correct answer.
  2. The claim is valid if management believes it is true
  3. The claim is valid only for marketing purposes
  4. The claim is valid because policies exist on paper

Explanation

Compliance is demonstrated through evidence that controls are implemented and operating effectively, not merely by documented intent or management belief. Without evidence the assertion cannot be substantiated during audit or regulatory review.

Question 40Security Laws, Regulations, Standards and Compliance

Which set of elements is most characteristic of a data protection impact assessment report?

  1. A list of employee names and salaries
  2. Marketing plan, budget forecast and sales targets
  3. Processing description, necessity assessment, risk analysis and mitigation measures Correct answer.
  4. Network diagram only, with no risk discussion

Explanation

A data protection impact assessment documents the processing activities, why they are necessary and proportionate, the risks to individuals, and the safeguards planned. Commercial plans or unrelated personal data do not belong in it.

Question 41Security Laws, Regulations, Standards and Compliance

A multinational firm must reconcile a local data localization requirement with a group-wide cloud architecture. Which approach best balances compliance and operations?

  1. Store regulated data locally but allow unrestricted remote access from any country
  2. Segment data so locally regulated records stay in-country while other processing follows group design Correct answer.
  3. Move all data offshore and rely on the group's global policy
  4. Abandon the cloud entirely without assessing alternatives

Explanation

Data localization obligations can be met by architecting the environment so regulated records remain within the required jurisdiction while other data follows the group design. Ignoring the requirement or allowing unrestricted cross-border access reintroduces the compliance risk.

Question 42Security Laws, Regulations, Standards and Compliance

An auditor notes that a control designed to enforce password complexity was tested once at deployment and never since. How should this be characterized?

  1. The control should be removed to reduce audit effort
  2. A design may exist but operating effectiveness is unproven and requires periodic testing Correct answer.
  3. The control is irrelevant to compliance
  4. The control is fully effective because it was tested once

Explanation

Compliance assurance distinguishes control design from operating effectiveness; a single test at deployment does not show the control continues to work as configurations and staff change. Periodic retesting is needed to substantiate ongoing compliance.

Question 43Security Laws, Regulations, Standards and Compliance

Two jurisdictions impose conflicting breach-notification deadlines on the same incident. What is the most defensible compliance strategy?

  1. Apply only the deadline from the headquarters country
  2. Notify no one until the conflict is resolved by regulators
  3. Choose the longest deadline to reduce workload
  4. Map each obligation, meet the earliest applicable deadline, and document the reconciliation rationale Correct answer.

Explanation

When obligations conflict, the organization should identify every applicable requirement, satisfy the strictest timing where feasible, and record why the chosen approach meets each regime. Ignoring one jurisdiction or delaying all notification creates avoidable violations.

Question 44Security Laws, Regulations, Standards and Compliance

A security manager must justify why an organization should treat a voluntary framework as mandatory internally. Which rationale is strongest?

  1. Voluntary frameworks are legally binding without any internal adoption
  2. It guarantees certification by an external body
  3. Adopting it as internal policy creates enforceable expectations and a measurable baseline Correct answer.
  4. It removes the need to comply with actual regulations

Explanation

Adopting a voluntary framework as internal policy converts it into an enforceable internal expectation and provides a measurable baseline for audits. It does not override statutory obligations, and adoption alone does not confer certification.

Question 45Identity and Access Management

Which access control model assigns permissions based on a user's job function rather than on individual identity?

  1. Discretionary access control (DAC)
  2. Role-based access control (RBAC) Correct answer.
  3. Rule-based access control (RuBAC)
  4. Mandatory access control (MAC)

Explanation

RBAC grants access through roles that bundle permissions, and users are assigned to roles according to their job responsibilities. This centralizes administration because permissions change when role membership changes rather than when each user account is edited.

Question 46Identity and Access Management

In the principle of least privilege, what should an account's permissions be limited to?

  1. The rights required to perform its current assigned tasks Correct answer.
  2. The rights granted by default when the account was created
  3. The rights of the most privileged user in the same department
  4. The maximum rights the account could ever need over its lifetime

Explanation

Least privilege means granting only the access necessary to complete current duties, and no more. Rights should be reviewed and reduced as duties change, which limits the blast radius if the account is compromised or misused.

Question 47Identity and Access Management

Which authentication factor category does a hardware token that generates a one-time code represent?

  1. Something you know
  2. Something you have Correct answer.
  3. Something you are
  4. Somewhere you are

Explanation

A hardware token is a physical object the user possesses, so it falls under the "something you have" factor category. Location and biometrics belong to different categories and cannot substitute for possession.

Question 48Identity and Access Management

What is the primary purpose of single sign-on (SSO) in an enterprise environment?

  1. To eliminate the need for any authentication after first login
  2. To authenticate once and gain access to multiple trusted applications Correct answer.
  3. To store all user passwords in a shared administrator vault
  4. To require a separate strong password for every application

Explanation

SSO lets a user authenticate once to a central identity provider and then access multiple federated applications without re-entering credentials. It improves usability and centralizes authentication policy, but it does not remove authentication itself.

Question 49Identity and Access Management

Which practice best supports accountability for actions taken on a system?

  1. Assigning unique user accounts and logging their activity Correct answer.
  2. Using a generic guest account for routine administration
  3. Disabling audit logging to improve system performance
  4. Sharing a single administrator account among the operations team

Explanation

Accountability requires that each action be attributable to a specific individual, which depends on unique accounts tied to real identities. Logging those accounts then provides the evidence trail needed for investigation and audit.

Question 50Identity and Access Management

What does the identity lifecycle stage of "provisioning" typically involve?

  1. Periodically rotating the user's password without notice
  2. Permanently deleting all records of a departed user
  3. Reviewing logs generated by the user's activity
  4. Creating the account and granting the access the user needs for the role Correct answer.

Explanation

Provisioning is the creation and initial entitlement phase, where an account is created and access is granted based on the approved role. It is the first operational stage of the joiner-mover-leaver lifecycle.