I85PREP
⌘ K
NISP Level 1 - Security Awareness study materials
NISP Level 1 - Security Awareness study resources

NISP Level 1 - Security Awareness practice questions

One question at a time. Build your NISP Level 1 - Security Awareness understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Fundamentals and Security Awareness

Under the CIA triad, which security property is directly violated when an unauthorized employee reads a confidential payroll spreadsheet stored on a shared drive?

  1. Availability
  2. Integrity
  3. Non-repudiation
  4. Confidentiality Correct answer.

Explanation

Confidentiality ensures information is only disclosed to authorized parties, so unauthorized reading of payroll data is a confidentiality breach. Integrity concerns unauthorized modification, availability concerns timely access, and non-repudiation concerns proof of an action.

Question 2Information Security Fundamentals and Security Awareness

Which term describes deliberately deceiving users into revealing credentials by impersonating a trusted entity through email or messages?

  1. Phishing Correct answer.
  2. Spoofing
  3. Spamming
  4. Sniffing

Explanation

Phishing is a social-engineering attack in which an attacker impersonates a trusted party to trick the recipient into disclosing credentials or clicking malicious links. Spamming is unsolicited bulk messaging, spoofing is falsifying an identity, and sniffing is capturing network traffic.

Question 3Information Security Fundamentals and Security Awareness

An attacker gains access by calling the help desk, claiming to be a senior manager who forgot a password. Which attack category best describes this?

  1. Brute force
  2. SQL injection
  3. Social engineering Correct answer.
  4. Denial of service

Explanation

Social engineering manipulates people into breaking normal security procedures, such as resetting a password for an unverified caller. Brute force, SQL injection, and denial of service are technical attacks that do not rely on convincing a person.

Question 4Information Security Fundamentals and Security Awareness

Which practice best supports the principle of least privilege for a user account?

  1. Sharing a single privileged account among the team
  2. Reviewing permissions only when the user leaves the organization
  3. Granting only the permissions required for the user's current duties Correct answer.
  4. Granting administrator rights so the user never needs to request help

Explanation

Least privilege means each account holds only the access necessary to perform its assigned tasks. Broad admin rights, shared privileged accounts, and infrequent reviews all expand exposure beyond what the job requires.

Question 5Information Security Fundamentals and Security Awareness

Why should a user lock their workstation before stepping away from the desk?

  1. To prevent unauthorized persons from using the active session Correct answer.
  2. To allow automatic software updates to install faster
  3. To free memory for other applications
  4. To reduce electricity consumption of the monitor

Explanation

Locking the screen requires authentication before the session can be reused, blocking passers-by from acting under the user's identity. Power saving, update speed, and memory use are unrelated to the security purpose of locking.

Question 6Information Security Fundamentals and Security Awareness

A password manager generates a unique, long random password for every site. Which risk is most directly reduced?

  1. Denial-of-service attacks on the login page
  2. Hardware failure of the user's disk
  3. Credential stuffing succeeding across multiple services Correct answer.
  4. Phishing emails being delivered to the inbox

Explanation

Unique passwords per site mean a breach at one service cannot be replayed against other accounts, which defeats credential stuffing. Disk failure, mail delivery, and service availability are unrelated to password uniqueness.

Question 7Information Security Fundamentals and Security Awareness

What is the primary purpose of enabling multi-factor authentication on an account?

  1. To encrypt data stored on the account's server
  2. To automatically log out idle sessions
  3. To require a second independent proof of identity beyond a password Correct answer.
  4. To replace the password with a longer passphrase

Explanation

Multi-factor authentication combines factors from different categories, such as something you know and something you possess, so a stolen password alone is insufficient. It does not replace the password, encrypt server data, or manage idle timeouts.

Question 8Information Security Fundamentals and Security Awareness

An employee receives an unexpected email with an invoice attachment from an unknown sender. What is the safest first action?

  1. Open the attachment to check whether the invoice looks genuine
  2. Reply to the sender asking for confirmation of the invoice
  3. Verify the request through a separate known channel before opening the attachment Correct answer.
  4. Forward the email to colleagues to ask if it concerns them

Explanation

Out-of-band verification through an independently known contact prevents an attacker from confirming their own deception. Opening the attachment risks malware, forwarding spreads it, and replying validates the attacker's approach.

Question 9Information Security Fundamentals and Security Awareness

Which statement correctly distinguishes a virus from a worm?

  1. A virus spreads without any user action, while a worm always requires a host file
  2. A worm self-propagates across networks without user action, while a virus typically needs a host file and user action Correct answer.
  3. A virus encrypts data for ransom, while a worm only displays advertisements
  4. A worm only affects mobile devices, while a virus only affects servers

Explanation

Worms spread autonomously by exploiting network services, whereas viruses usually attach to files and require a user to execute or open them. The other options invert the definitions or describe unrelated malware behaviors.

Question 10Information Security Fundamentals and Security Awareness

What does ransomware typically do to victim data?

  1. Deletes it permanently without any message
  2. Alters it to display unwanted advertisements
  3. Encrypts it and demands payment for the decryption key Correct answer.
  4. Silently copies it to a public website

Explanation

Ransomware encrypts files or systems and demands payment in exchange for restoring access. Data theft for extortion may accompany it, but public copying, silent permanent deletion, and ad injection describe other malware behaviors.

Question 11Information Security Fundamentals and Security Awareness

Which control is an example of a detective security control?

  1. Reviewing authentication logs for failed login bursts Correct answer.
  2. Requiring badge access to a server room
  3. Installing a firewall to block unauthorized ports
  4. Encrypting backups stored offsite

Explanation

Detective controls identify and record events after or during occurrence, and log review reveals suspicious activity. Firewalls and badge access are preventive, and encryption protects data rather than detecting events.

Question 12Information Security Fundamentals and Security Awareness

What is the main security benefit of applying software updates promptly?

  1. The software license is automatically renewed
  2. The device's storage capacity increases
  3. Known vulnerabilities in the older version are closed Correct answer.
  4. Network bandwidth usage is reduced

Explanation

Updates usually patch publicly known vulnerabilities that attackers actively exploit, so timely installation shrinks the attack surface. Licensing, storage, and bandwidth are unrelated to the security purpose of patching.

Question 13Information Security Fundamentals and Security Awareness

A colleague asks to borrow your smart card to enter a restricted room while you are away. What is the correct response?

  1. Lend it only if the colleague has the same job title
  2. Lend it after writing the colleague's name in a notebook
  3. Refuse, because credentials must never be shared or lent Correct answer.
  4. Lend it if the colleague promises to return it within the hour

Explanation

Access credentials are issued to a specific individual so that access can be attributed and controlled; lending them breaks accountability and least privilege. Promises, informal notes, or similar job titles do not make sharing acceptable.

Question 14Information Security Fundamentals and Security Awareness

Which action best protects data on a laptop that may be lost or stolen?

  1. Storing a copy of the password under the keyboard
  2. Encrypting the storage drive and enabling a screen lock Correct answer.
  3. Disabling automatic operating system updates
  4. Renaming the device to a non-obvious hostname

Explanation

Full-disk encryption makes the data unreadable without the key, and a screen lock blocks casual access to a running device. Renaming, disabling updates, and hiding passwords do not protect the data itself.

Question 15Information Security Fundamentals and Security Awareness

What is the primary security concern with using unsecured public Wi-Fi for work?

  1. The device battery drains faster on wireless
  2. The connection is always slower than a wired network
  3. Traffic may be intercepted or altered by others on the network Correct answer.
  4. The network may install printer drivers automatically

Explanation

On an open network, an attacker nearby can capture or manipulate unencrypted traffic. Speed, driver installation, and battery life are performance or convenience issues rather than the security concern.

Question 16Information Security Fundamentals and Security Awareness

Which practice reduces the risk of a malicious USB device found in a parking lot?

  1. Never plug in unknown removable media and hand it to security staff Correct answer.
  2. Plug it in briefly to see the device name
  3. Share it with coworkers to identify the owner
  4. Plug it into a personal home computer to inspect the contents

Explanation

Unknown media can carry malware that executes on connection, so it should not be connected to any organizational or personal system. Inspecting, testing briefly, or circulating it exposes systems to compromise.

Question 17Information Security Fundamentals and Security Awareness

In data classification, why is labeling a document as confidential important?

  1. It guarantees the document cannot be copied
  2. It signals the handling and sharing rules that apply to the information Correct answer.
  3. It removes the need for access controls
  4. It automatically encrypts the file on every device

Explanation

Labels communicate the classification so users apply the matching handling, storage, and sharing rules. A label does not itself enforce copying restrictions, encrypt files, or replace access controls.

Question 18Information Security Fundamentals and Security Awareness

What is the main risk of reusing the same password across many accounts?

  1. Servers reject accounts that reuse passwords
  2. The password becomes harder for the user to remember
  3. Encryption keys are generated twice
  4. A breach at one service exposes credentials usable on other services Correct answer.

Explanation

Reuse lets an attacker who obtains one breached password try it against other services, a technique known as credential stuffing. Memorability, server rejection, and key generation are not the security risk of reuse.

Question 19Information Security Fundamentals and Security Awareness

An email appears to come from the CEO's address and urgently requests gift cards. Which characteristic most strongly indicates a business email compromise attempt?

  1. The message was sent during business hours
  2. Urgency and an unusual payment request that bypasses normal procedures Correct answer.
  3. The message includes the company logo
  4. The message is addressed to a single employee

Explanation

Business email compromise relies on authority and urgency to push victims past normal verification and payment controls. Business-hours timing, a logo, and a single recipient are common in legitimate mail and prove nothing.

Question 20Information Security Fundamentals and Security Awareness

Why is an out-of-band verification step recommended before acting on a high-value payment request received by email?

  1. Independent channels are always faster than email
  2. Email cannot carry large attachments
  3. Payment requests are never legitimate when sent by email
  4. Email sender addresses can be forged, so an independent channel confirms the request is genuine Correct answer.

Explanation

Display names and sender addresses can be spoofed, so confirming through a known phone number or in person defeats impersonation. Attachment limits, speed, and blanket rejection of email requests are not the reason for verification.

Question 21Information Security Fundamentals and Security Awareness

A user receives a text message claiming a parcel is held and asking them to log in via a short link. Which attack does this most closely represent?

  1. Smishing Correct answer.
  2. Vishing
  3. Shoulder surfing
  4. Tailgating

Explanation

Smishing is phishing delivered by SMS or messaging apps, using a lure and a link to harvest credentials. Vishing uses voice calls, tailgating is physical unauthorized entry, and shoulder surfing is observing a screen.

Question 22Information Security Fundamentals and Security Awareness

What is the security purpose of a clean desk policy?

  1. To keep sensitive documents and media out of sight and secured when unattended Correct answer.
  2. To encourage paperless communication across the company
  3. To reduce the cost of office cleaning services
  4. To ensure employees tidy their personal belongings before leaving

Explanation

A clean desk policy limits the opportunity for unauthorized people to read or remove sensitive information left in the open. Tidiness, cleaning costs, and paperless goals are side effects or unrelated objectives.

Question 23Information Security Fundamentals and Security Awareness

Which physical security practice best prevents tailgating into a controlled area?

  1. Disabling the door alarm during busy hours
  2. Requiring each person to badge in individually and challenging unknown followers Correct answer.
  3. Holding the door open for anyone carrying equipment
  4. Propping the door open to speed up entry

Explanation

Tailgating is defeated when every person authenticates individually and unfamiliar followers are politely challenged. Holding doors, propping them open, and disabling alarms all allow unverified entry.

Question 24Information Security Fundamentals and Security Awareness

An organization discovers that an employee emailed a customer database to a personal account. Which security objective is most directly compromised?

  1. Integrity of the backup schedule
  2. Confidentiality of customer data Correct answer.
  3. Performance of the internal network
  4. Availability of the email server

Explanation

Sending protected customer data to an unauthorized destination is a disclosure that breaches confidentiality. Server availability, backup scheduling, and network performance are not affected by the disclosure itself.

Question 25Information Security Fundamentals and Security Awareness

Why should security awareness training include how to report a suspected incident?

  1. Fast reporting lets responders contain the incident before it spreads further Correct answer.
  2. Reporting replaces the need for technical monitoring tools
  3. Reporting transfers legal liability to the employee
  4. Reporting guarantees the incident will not affect the organization

Explanation

Early reporting shortens attacker dwell time and enables containment, reducing overall impact. It does not replace monitoring, guarantee no impact, or shift liability to the reporter.

Question 26Information Security Fundamentals and Security Awareness

Under the principle of least privilege, how should access rights be assigned to an employee who occasionally covers for a colleague in the finance system?

  1. Share the regular finance officer's account credentials with the employee
  2. Grant the finance role only for the coverage period and remove it afterwards Correct answer.
  3. Grant the full finance role permanently so coverage is never blocked
  4. Grant the finance role permanently but ask the employee to use it sparingly

Explanation

Least privilege means each user holds only the access needed for the task at hand, for only as long as it is needed. Temporary coverage therefore calls for a time-bound grant that is removed when the need ends. Permanent extra rights or shared accounts both widen access beyond what the job requires.

Question 27Information Security Fundamentals and Security Awareness

Which statement best describes the role of confidentiality, integrity and availability as security objectives?

  1. They are the three levels of a typical data classification scheme
  2. They are the three properties an information security program aims to protect Correct answer.
  3. They describe the three phases of an incident response lifecycle
  4. They are the three factors used to authenticate a user

Explanation

Confidentiality, integrity and availability are the core properties, often called the CIA triad, that security controls exist to protect. Confidentiality limits disclosure, integrity keeps data accurate and unaltered, and availability keeps systems usable when needed. The other options describe different concepts that are sometimes confused with these objectives.

Question 28Information Security Fundamentals and Security Awareness

An employee finds a document marked internal on a printer shared with visitors. What action best reflects correct handling of classified information?

  1. Leave it in the tray so the owner can collect it later
  2. Read it fully to judge whether it is sensitive, then leave it
  3. Remove it from the shared area and return it to its owner or the designated secure point Correct answer.
  4. Photograph it and send the image to the owner as a notification

Explanation

Handling rules for labeled information require that it be kept out of uncontrolled areas and returned to a responsible party. Taking it to the owner or a designated secure collection point restores control without spreading the content further. Reading or copying the document would widen exposure beyond those with a need to know.

Question 29Information Security Fundamentals and Security Awareness

An organization wants to reduce the chance that a departing contractor still holds working credentials after the contract ends. Which measure addresses this risk most directly?

  1. Running a vulnerability scan on the contractor's workstation
  2. Adding the contractor to the security awareness mailing list
  3. Tying account and badge expiry to the contract end date through a formal offboarding process Correct answer.
  4. Requiring the contractor to sign an acceptable use policy on the first day

Explanation

Residual access after someone leaves is a provisioning and deprovisioning problem, so the control must revoke access at a defined point. Linking account and physical access expiry to the contract end date, backed by a documented offboarding step, removes the dependency on someone remembering to act. The other measures improve awareness or hygiene but do not terminate access.

Question 30Information Security Fundamentals and Security Awareness

A team proposes storing backup tapes in an unlocked office cabinet because the room is only used by staff. Which reasoning best evaluates this proposal against defense in depth?

  1. It is weak because backups should never be stored on removable media
  2. It is weak because a single control, room access, is the only barrier protecting the media Correct answer.
  3. It is acceptable because physical access to the room is already limited to employees
  4. It is acceptable provided the tapes are encrypted with a strong key

Explanation

Defense in depth assumes that any single control can fail, so layered independent controls should protect an asset. Relying only on the room being staff-only leaves the tapes exposed if that access control is bypassed or the room is left open. Adding a locked container creates a second barrier that does not depend on the same assumption.

Question 31Password and Account Security

Under NISP Level 1 security awareness guidance, which password management practice best supports account security across multiple systems?

  1. Reusing a single strong password across all systems so it is easier to remember
  2. Using a unique password for each system, ideally generated and stored in a password manager Correct answer.
  3. Sharing one team password so colleagues can cover for each other
  4. Writing passwords in a shared spreadsheet stored on the network drive

Explanation

Password reuse means a breach on one service exposes every other account using the same credential, a pattern attackers exploit through credential stuffing. A password manager lets each account hold a distinct, high-entropy secret without relying on memory, so one leak stays contained.

Question 32Password and Account Security

An employee receives an email claiming to be from IT and asking them to confirm their current password by reply. What is the correct response under security awareness principles?

  1. Forward the message to colleagues to warn them and reply to IT separately
  2. Do not reply, report the message, and keep the password confidential Correct answer.
  3. Reply with the password but change it immediately afterwards
  4. Reply only if the sender address looks like the internal IT domain

Explanation

Legitimate IT staff never need a user's current password, because administrative actions use separate privileged accounts or reset workflows. Any request to disclose a password is a social engineering attempt and should be reported through the organisation's phishing channel.

Question 33Password and Account Security

What is the primary security purpose of multi-factor authentication on a corporate account?

  1. It ensures the account remains protected even if the password is disclosed Correct answer.
  2. It removes the need for a password entirely on all systems
  3. It encrypts all files stored in the user's home directory
  4. It automatically rotates the password every thirty days

Explanation

Multi-factor authentication requires a second, independent proof of identity such as a device prompt or hardware token. If an attacker obtains the password through phishing or a breach, the missing second factor still blocks sign-in.

Question 34Password and Account Security

Why are push-notification MFA prompts vulnerable to 'MFA fatigue' attacks?

  1. The push token is stored in plaintext in the browser cache
  2. Attackers repeatedly trigger prompts hoping the user will approve one out of annoyance or confusion Correct answer.
  3. Push prompts bypass the password step and grant access directly
  4. The notification channel is unencrypted and can be read on the network

Explanation

Once an attacker has a valid password, they can trigger repeated push prompts, and a tired or distracted user may eventually approve one. Defences include number matching, showing request context, and rate limiting or blocking repeated prompts.

Question 35Password and Account Security

A user needs to store many complex passwords. Which approach aligns with good account security practice?

  1. Use a reputable password manager protected by a strong master passphrase and MFA Correct answer.
  2. Save passwords in the browser's autofill without any master password protection
  3. Keep an encrypted archive on the desktop with the passphrase written on a sticky note
  4. Use a simple pattern that varies only by the site name

Explanation

A password manager generates and stores unique high-entropy secrets, and the vault is protected by a strong master passphrase plus MFA where available. This keeps passwords unique per site while remaining practical to use.

Question 36Password and Account Security

Which characteristic most increases a password's resistance to offline brute-force cracking?

  1. Being long and generated randomly from a large character space Correct answer.
  2. Including the user's birth year and initials
  3. Containing a dictionary word with a digit appended
  4. Being exactly eight characters with one uppercase letter

Explanation

Cracking cost grows with length and with the size of the character space, so long randomly generated strings resist guessing far better than short or patterned ones. Human-memorable transformations add little entropy once the pattern is known.

Question 37Password and Account Security

What is credential stuffing?

  1. Resetting an account password by answering security questions
  2. Guessing a single account's password by trying every possible character combination
  3. Intercepting network traffic to capture a session cookie
  4. Using username and password pairs leaked from one service to attempt sign-in on many other services Correct answer.

Explanation

Credential stuffing replays breached username and password pairs against other sites, betting on password reuse. It is why unique credentials per service and breach monitoring materially reduce risk.

Question 38Password and Account Security

A colleague asks you to lend your account credentials so they can finish a task while their access request is pending. What is the appropriate action?

  1. Create a shared note with the password visible only to your team
  2. Decline, keep credentials personal, and direct them to the formal access request process Correct answer.
  3. Share the password temporarily and change it once the task is done
  4. Share only the username and let them guess the password

Explanation

Accounts are issued to individuals so that actions remain attributable and privileges stay controlled. Sharing credentials breaks accountability and can expose data beyond the colleague's approved scope; the correct route is a formal access request.

Question 39Password and Account Security

Why should default vendor credentials on a newly deployed device or application be changed before it goes into production?

  1. Default credentials are published and widely known, so they offer no protection Correct answer.
  2. Vendors charge a licence fee for each default login
  3. Default accounts cannot be logged or audited
  4. Changing them improves the device's network throughput

Explanation

Default administrative logins are documented in manuals and shared across every unit of a product, so attackers try them first. Replacing them with unique credentials before exposure closes an easy entry point.

Question 40Password and Account Security

What is the main risk of using the same password for a personal social media account and a corporate email account?

  1. Single sign-on will stop working for both accounts
  2. The password will expire faster on the corporate system
  3. A breach of the social media site could allow an attacker to access corporate email Correct answer.
  4. The corporate mail server will reject the login automatically

Explanation

Reuse links the security of unrelated services: compromise of the weaker site hands attackers a working credential for the corporate account. Separation of personal and work credentials limits that blast radius.

Question 41Password and Account Security

An organisation is choosing between SMS codes and authenticator apps for MFA. Which statement best reflects the security trade-off?

  1. Both methods are equally resistant to interception
  2. SMS codes are stronger because they do not require an app installation
  3. Authenticator apps remove the need for a password
  4. Authenticator apps are generally stronger because codes are generated locally and not exposed to SIM-swap attacks Correct answer.

Explanation

SMS codes travel over the mobile network and can be diverted through SIM swapping or number porting. App-based codes are derived locally from a shared secret, so they are not exposed by telecom compromise, though phishing-resistant hardware keys remain stronger still.

Question 42Password and Account Security

Which practice best protects an account's security questions from being abused during account recovery?

  1. Answering with the name of a well-known public figure
  2. Choosing answers that are truthful and easy for friends to confirm
  3. Choosing answers that are not publicly discoverable, or using a password manager to store random answers Correct answer.
  4. Using the same answers for every website

Explanation

Security questions often ask for facts that are visible on social media, so truthful answers can be guessed or researched. Using non-obvious answers, stored in a password manager, keeps recovery from becoming a bypass of the password itself.

Question 43Password and Account Security

After a data breach notification says your email address and password were exposed, what is the most appropriate immediate action?

  1. Post a warning on social media and continue using the same password
  2. Change the password on the affected service and on any other account where it was reused Correct answer.
  3. Delete the affected account without changing anything else
  4. Wait to see whether anything suspicious happens before acting

Explanation

Breached credentials are typically tested quickly against other services, so the priority is to rotate the exposed password and any reused copies. Enabling MFA on those accounts further limits the value of the leaked secret.

Question 44Password and Account Security

What does the principle of least privilege require when granting account access?

  1. Granting broad access first and removing it only after an incident
  2. Giving every user administrator rights so they never need to request changes
  3. Granting only the permissions needed for the current role and reviewing them periodically Correct answer.
  4. Sharing a single privileged account among the operations team

Explanation

Least privilege limits each account to what its role actually requires, which shrinks the impact of a compromised credential. Periodic reviews remove permissions that accumulate as people change roles.

Question 45Password and Account Security

Why do many standards now advise against forcing routine periodic password changes for every user?

  1. Audit logs cannot record password changes
  2. Periodic changes prevent the use of multi-factor authentication
  3. Frequent changes encourage weak, predictable variations and do not address compromise effectively Correct answer.
  4. Password changes corrupt stored password hashes

Explanation

Forced rotation tends to produce incremental, guessable changes such as appending a number, while adding little real protection. Current guidance favours long unique passwords, MFA, and prompt reset only on evidence of compromise.

Question 46Password and Account Security

Which control most directly reduces the risk of an attacker using a stolen session token to access an account without knowing the password?

  1. Setting short session timeouts and binding sessions to additional context such as device or IP Correct answer.
  2. Requiring users to answer a security question at each login
  3. Increasing the minimum password length to sixteen characters
  4. Storing the token in a long-lived browser cookie

Explanation

A stolen session token bypasses the password entirely, so defences must act on the session itself: short lifetimes, re-authentication for sensitive actions, and context binding make a captured token harder to reuse. Password length does nothing once a valid session exists.

Question 47Password and Account Security

What is the security benefit of number matching in push-based MFA?

  1. It replaces the password with a numeric PIN
  2. It requires the user to enter a number shown on the sign-in screen, so a blind approval no longer works Correct answer.
  3. It encrypts the push notification payload end to end
  4. It stores the user's phone number for account recovery

Explanation

Number matching forces the person approving to read a value from the actual sign-in attempt, which an attacker triggering prompts remotely cannot supply. This defeats prompt-spamming, where users approve out of fatigue.

Question 48Password and Account Security

A user wants to verify that a password manager vault is protected even if the vendor's cloud storage is breached. Which property should they confirm?

  1. The vendor stores the master passphrase in escrow for support purposes
  2. The vault is synced to a public file-sharing link for backup
  3. The vault is encrypted locally with a key derived from the master passphrase before syncing Correct answer.
  4. The master passphrase is the same as the user's email password

Explanation

Zero-knowledge designs encrypt and decrypt the vault on the device, so cloud storage holds only ciphertext and the vendor cannot read it. If the vendor can recover or escrow the master passphrase, a storage breach becomes a credential breach.

Question 49Password and Account Security

Why is storing passwords in a plain text file on a shared drive considered poor account security?

  1. Anyone with read access to the share can obtain every stored credential Correct answer.
  2. Shared drives automatically expire file contents
  3. Plain text files cannot be backed up reliably
  4. Text files are incompatible with multi-factor authentication

Explanation

Unencrypted storage gives every account with share access a complete list of credentials, and file permissions are often broader than intended. Encryption plus a managed vault keeps secrets readable only to the intended user.

Question 50Password and Account Security

An attacker calls the service desk posing as an employee and asks for a password reset to a new mailbox. Which combination of controls best mitigates this attack?

  1. Identity verification using independent, pre-registered factors and reset notifications to the original contact channels Correct answer.
  2. Resetting immediately to avoid delaying the employee and logging the call afterwards
  3. Requiring the caller to state the old password before any reset
  4. Sending the new password to the mailbox the caller requests

Explanation

Help-desk impersonation succeeds when the caller controls the verification step, so verification must use pre-registered factors the caller cannot supply. Sending confirmation to the original contact channels lets the real user detect and stop a fraudulent reset.