I85PREP
⌘ K
DSST Cybersecurity study materials
DSST Cybersecurity study resources

DSST Cybersecurity practice questions

One question at a time. Build your DSST Cybersecurity understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application and systems security

A company wants to ensure that a stolen password alone cannot grant access to a critical server. Which control most directly enforces this requirement?

  1. Enforcing a minimum password length of 12 characters
  2. Requiring multi-factor authentication for server logons Correct answer.
  3. Storing password hashes with a random salt
  4. Locking accounts after five failed attempts

Explanation

Multi-factor authentication requires a second, independent factor beyond the password, so possession of the password by itself is insufficient to authenticate. Length rules, lockouts, and salting strengthen passwords or their storage but still allow a single knowledge factor to grant access.

Question 2Application and systems security

Which access control model decides permissions based on the logged-in user's job function rather than on the owner's discretion?

  1. Discretionary access control
  2. Rule-based access control
  3. Mandatory access control
  4. Role-based access control Correct answer.

Explanation

Role-based access control assigns permissions to roles and then places users into roles according to their duties, so access follows job function. Discretionary control leaves decisions to resource owners, and mandatory control relies on system-assigned labels and clearances.

Question 3Application and systems security

An administrator needs to store user passwords so that a leaked database does not reveal the original values. Which approach is appropriate?

  1. Store the passwords in a compressed archive on the server
  2. Store a salted hash produced by a slow key-derivation function Correct answer.
  3. Store the passwords encrypted with a key kept in the same database
  4. Store a fast unsalted hash such as a single SHA-256 digest

Explanation

Passwords should be stored as salted hashes generated by a deliberately slow algorithm such as bcrypt, scrypt, Argon2, or PBKDF2, which resists both precomputation and high-speed cracking. Salting also prevents identical passwords from producing identical stored values.

Question 4Application and systems security

What is the primary security purpose of input validation on a web application server?

  1. Balancing traffic across multiple application servers
  2. Logging every request for later forensic review
  3. Encrypting form submissions between the browser and the server
  4. Rejecting malformed or malicious data before it reaches sensitive processing Correct answer.

Explanation

Server-side input validation checks data against expected type, length, format, and range so that hostile or malformed values do not reach interpreters, queries, or file operations. It is a core defense against injection and related tampering attacks.

Question 5Application and systems security

Which practice best mitigates SQL injection in a new application?

  1. Hiding database error messages from users
  2. Renaming database tables to unpredictable names
  3. Escaping single quotes in the client-side JavaScript
  4. Using parameterized queries with bound parameters Correct answer.

Explanation

Parameterized queries separate SQL code from data so that user-supplied values are treated as literals and cannot alter statement structure. This is more reliable than filtering or obscuring because it removes the injection channel entirely.

Question 6Application and systems security

A developer needs to protect a session cookie so that script running in the page cannot read it. Which cookie attribute accomplishes this?

  1. SameSite=Strict
  2. Domain
  3. HttpOnly Correct answer.
  4. Secure

Explanation

The HttpOnly attribute prevents client-side scripts from accessing the cookie through the document object model, which limits session theft via cross-site scripting. Secure and SameSite govern transport and cross-site sending, not script access.

Question 7Application and systems security

Which mechanism provides the strongest protection against an attacker who has stolen a full disk from a powered-off laptop?

  1. Full-disk encryption with keys protected by a TPM and pre-boot authentication Correct answer.
  2. Antivirus software with real-time scanning enabled
  3. A screen saver that locks after two minutes
  4. A BIOS password that blocks changes to boot settings

Explanation

Full-disk encryption renders the stored data unreadable without the key, and combining TPM-bound keys with pre-boot authentication resists offline extraction. The other controls act only on a running system or on configuration changes.

Question 8Application and systems security

What does the principle of least privilege require for a service account used by a backup application?

  1. Grant the same rights as the interactive domain administrator
  2. Grant only the read and restore permissions the backup job needs Correct answer.
  3. Grant no permissions and rely on manual restores
  4. Grant full administrative rights so any restore scenario succeeds

Explanation

Least privilege means giving an identity only the access necessary for its defined function, which for a backup service is the specific read and restore rights it uses. Broader rights increase the impact if the account is compromised.

Question 9Application and systems security

A web application reflects user-supplied text into HTML without encoding it. Which vulnerability is most directly introduced?

  1. Buffer overflow
  2. Directory traversal
  3. Cross-site request forgery
  4. Cross-site scripting Correct answer.

Explanation

When untrusted input is written into an HTML response without context-appropriate output encoding, the browser interprets it as markup or script, enabling cross-site scripting. Encoding output for the correct context prevents data from becoming executable code.

Question 10Application and systems security

Which control most effectively defends a web application against cross-site request forgery on state-changing requests?

  1. Requiring a per-session anti-CSRF token validated on the server Correct answer.
  2. Compressing responses with gzip before sending them
  3. Setting the session cookie with the HttpOnly attribute
  4. Enforcing a strong password policy for all users

Explanation

A per-session token that the server verifies on each state-changing request proves the request originated from the application's own pages rather than a forged cross-site submission. HttpOnly and password policy address different threats.

Question 11Application and systems security

An attacker submits a filename of ../../etc/passwd to a download endpoint. Which flaw is being exploited?

  1. Insecure deserialization
  2. Path traversal Correct answer.
  3. Cross-site scripting
  4. SQL injection

Explanation

The ../ sequences attempt to climb out of the intended directory so the endpoint reads an arbitrary file, which is path or directory traversal. Defense requires canonicalizing the path and confirming it stays within the allowed base directory.

Question 12Application and systems security

Which measure best mitigates a buffer overflow in a C program that processes untrusted network input?

  1. Bounds-checking the input length before copying it into a fixed buffer Correct answer.
  2. Running the program with elevated privileges to avoid errors
  3. Storing the input in a global variable instead of a local one
  4. Compiling with optimization flags that increase execution speed

Explanation

Verifying the destination capacity and copying no more than that limit prevents the write from exceeding the buffer. Safer library functions and compiler hardening add defense in depth, but the root fix is enforcing bounds.

Question 13Application and systems security

A team wants to reduce the risk that a compromised development dependency introduces malicious code into production builds. Which control addresses this most directly?

  1. Running builds as the local administrator account
  2. Pinning dependencies to reviewed versions and verifying package integrity Correct answer.
  3. Increasing the build server's CPU and memory allocation
  4. Disabling build logs to prevent leakage of build details

Explanation

Pinning to vetted versions and checking signatures or hashes ensures the build consumes exactly the reviewed artifact and detects tampering. Running builds with high privilege or hiding logs increases risk rather than reducing supply-chain exposure.

Question 14Application and systems security

Which configuration most reduces the impact of a successful exploit against a public-facing web server?

  1. Granting the service account write access to system directories
  2. Running the web service under a dedicated low-privilege account Correct answer.
  3. Enabling verbose error pages that show stack traces
  4. Installing a second web server on the same host

Explanation

A dedicated low-privilege account limits what code executed through the web service can do, containing the damage after exploitation. Verbose errors and broad write access instead aid the attacker.

Question 15Application and systems security

An organization must ensure that only approved, signed executables run on employee workstations. Which technology enforces this?

  1. Host-based intrusion detection with alerting
  2. Application allowlisting based on code signatures Correct answer.
  3. Signature-based antivirus scanning of downloads
  4. Full-disk encryption of workstation drives

Explanation

Allowlisting permits execution only of binaries that match an approved list, and signature checks confirm publisher identity and integrity. Antivirus and intrusion detection can detect known bad code but do not restrict execution to approved software.

Question 16Application and systems security

Which change best protects an application against attacks that exploit unpatched third-party libraries?

  1. Maintaining an inventory of components and applying security updates promptly Correct answer.
  2. Removing the application's error handling code
  3. Hosting the application on a newer physical server
  4. Increasing the length of user session identifiers

Explanation

Knowing which libraries and versions are in use allows the team to track disclosed vulnerabilities and patch or replace affected components quickly. The other options do not address vulnerable dependency code.

Question 17Application and systems security

A database administrator wants to limit damage if an application account is compromised. Which grant follows least privilege for an account that only reads reporting data?

  1. db_owner membership on the database
  2. SELECT on the specific reporting views Correct answer.
  3. ALTER on every table in the database
  4. CONTROL SERVER at the instance level

Explanation

Granting SELECT only on the reporting views gives exactly the read access the reporting function needs and nothing more. Ownership roles, server-level control, and schema alteration rights permit changes far beyond reading reports.

Question 18Application and systems security

Which property of a cryptographic hash function makes it suitable for detecting unauthorized file modification?

  1. Key reuse, so the same digest can be recomputed with a shared secret
  2. Reversibility, so the original file can be recovered from the digest
  3. Variable output length, so digests can be shortened for storage
  4. Collision resistance, so altered content is unlikely to produce the same digest Correct answer.

Explanation

Collision resistance means an attacker cannot feasibly craft different content that yields the same digest, so a changed digest signals tampering. Hashes are one-way and need not be reversible or keyed for integrity checking.

Question 19Application and systems security

A mobile application stores an API secret inside its distributed binary. Why is this considered a design weakness?

  1. Anyone who obtains the binary can extract the embedded secret Correct answer.
  2. The binary will fail to compile without a secret
  3. Secrets embedded in binaries expire automatically
  4. Mobile operating systems encrypt all application memory

Explanation

Anything shipped to a client device can be reverse engineered, so embedded secrets should be treated as public. Sensitive operations should instead rely on short-lived tokens or server-side secrets the client never holds.

Question 20Application and systems security

A web application sets session identifiers that are predictable sequential integers. What is the most serious consequence?

  1. The application cannot encrypt traffic over TLS
  2. An attacker can guess a valid session identifier and hijack another user's session Correct answer.
  3. User passwords will be stored in plaintext
  4. The server will reject all login attempts

Explanation

Predictable session identifiers let an attacker enumerate or guess values and impersonate other users, which is session hijacking. Session identifiers must be generated with a cryptographically secure random source and sufficient length.

Question 21Application and systems security

Which defense most directly limits the impact of a cross-site scripting flaw that already exists in one page of an application?

  1. Deploying a strict Content-Security-Policy that blocks inline script Correct answer.
  2. Requiring longer user passwords
  3. Setting the session cookie's Secure attribute
  4. Enabling HTTP compression on responses

Explanation

A strict Content-Security-Policy restricts which script sources the browser will execute, which can neutralize injected inline script even when output encoding fails. It is a defense-in-depth layer, not a substitute for fixing the encoding flaw.

Question 22Application and systems security

An application builds an OS command by concatenating a user-supplied hostname into a shell string. Which remediation removes the injection risk most completely?

  1. Run the application with a lower-privileged operating system account
  2. Avoid the shell and pass the hostname as an argument to an API that does not interpret metacharacters Correct answer.
  3. Strip semicolons and ampersands from the hostname before concatenation
  4. Log every constructed command for later review

Explanation

Calling an execution API that takes arguments directly, without a shell, prevents metacharacters from being interpreted as command separators. Blocklist filtering is bypassable and privilege reduction only limits damage after injection succeeds.

Question 23Application and systems security

A team must protect sensitive fields in a database so that database administrators cannot read them, while the application still needs to use the values. Which approach fits best?

  1. Application-level encryption with keys held outside the database tier Correct answer.
  2. Network segmentation between the application and database hosts
  3. Column-level access grants restricted to the application account
  4. Transparent data encryption enabled on the database files

Explanation

Encrypting in the application with keys managed outside the database means stored ciphertext is useless to anyone who can read the database, including administrators. Transparent encryption and grants protect against other threats but leave administrators able to view plaintext.

Question 24Application and systems security

An application deserializes untrusted data into native objects before validating it. Why is validating after deserialization often insufficient?

  1. Object construction during deserialization can already trigger harmful behavior before validation runs Correct answer.
  2. Serialized data is always encrypted and cannot be inspected
  3. Validation libraries cannot process deserialized objects
  4. Deserialization always strips type information needed for validation

Explanation

In insecure deserialization, the act of reconstructing objects can invoke constructors or magic methods that execute attacker-influenced logic before any post-hoc check occurs. The safer pattern is to accept a simple data format and validate before building objects.

Question 25Application and systems security

A security review finds that an application checks authorization only in the browser interface while the API trusts any authenticated request. What is the correct characterization?

  1. A denial-of-service risk from excessive API calls
  2. A cryptographic weakness caused by weak session keys
  3. A broken access control flaw, because enforcement must occur on the server for every request Correct answer.
  4. An acceptable design, because authenticated users are trusted

Explanation

Client-side checks can be bypassed, so authorization decisions must be enforced server-side on each request. Trusting any authenticated request lets a user reach functions or records outside their permitted scope, which is broken access control.

Question 26Application and systems security

A web application stores user-uploaded files on disk and serves them back through a script that sets the Content-Type header from the file extension supplied at upload time. An attacker uploads a file named report.html containing JavaScript. Which control most directly prevents that file from executing script in a victim's browser session?

  1. Compress uploaded files into an archive so the browser cannot render them inline
  2. Serve uploads from a separate domain and send Content-Disposition: attachment with a fixed Content-Type Correct answer.
  3. Require authentication before the download script will return any stored file
  4. Store the uploads in a directory outside the web root and rename each file with a random identifier

Explanation

Stored cross-site scripting through uploaded files is defeated by ensuring the browser never interprets the content as active markup in the application's origin. Serving from a separate domain removes same-origin access to application cookies, and forcing an attachment disposition with a fixed content type stops inline rendering. Renaming or relocating files does not change how the browser parses the returned bytes.

Question 27Application and systems security

An application server runs each tenant's request-handling code inside a container that shares the host kernel but has its own filesystem and process namespace. Which statement best describes the security boundary this provides?

  1. Container images are immutable, so runtime compromise of one tenant is impossible
  2. The kernel is shared, so a kernel privilege-escalation flaw can break isolation between containers Correct answer.
  3. Namespace isolation removes the need for seccomp filtering of system calls
  4. Each container runs its own kernel, so exploits cannot cross tenant boundaries

Explanation

OS-level containers partition namespaces and cgroups over a single shared kernel, so the kernel is a common attack surface for every tenant. A kernel vulnerability or a misconfigured privileged container can allow escape to the host and other tenants. Stronger isolation typically requires separate virtual machines or hardened sandboxes.

Question 28Application and systems security

Which practice most effectively reduces the risk that a SQL injection flaw in one query allows an attacker to read unrelated tables in the same database?

  1. Enabling verbose error messages so developers can diagnose malformed queries
  2. Storing the database on an encrypted volume
  3. Using parameterized queries for every statement that includes user input
  4. Granting the application account only the privileges it needs on the objects it uses Correct answer.

Explanation

Least-privilege database accounts limit blast radius: if the application account cannot select from unrelated tables, an injection cannot read them. Parameterization prevents injection in the first place, but the question asks about limiting the impact of a flaw that exists. Encryption at rest and detailed errors do not restrict what a successful injection can query.

Question 29Application and systems security

An application uses a symmetric cipher in a mode that requires a unique initialization vector per message but reuses a constant IV for every record. What is the primary cryptographic consequence?

  1. The message authentication tag can no longer be verified by the receiver
  2. The ciphertext becomes longer than the plaintext by the size of the key
  3. Identical plaintext prefixes produce identical ciphertext prefixes, leaking patterns and weakening confidentiality Correct answer.
  4. The key schedule degrades so that the effective key length is halved

Explanation

Modes such as CBC and CTR rely on a fresh, unpredictable IV or nonce so that equal plaintexts encrypt differently. Reusing a constant IV causes deterministic encryption, exposing equality of plaintext blocks and, in stream-like modes, enabling recovery of plaintext through keystream reuse. It does not alter key length or tag verification by itself.

Question 30Application and systems security

In the context of application security, what does input validation performed on the client side alone fail to provide?

  1. Protection against accidental typing mistakes by legitimate users
  2. Improved responsiveness compared with server-side validation
  3. Compatibility with modern browsers
  4. A trustworthy enforcement point, because an attacker can bypass the browser and submit arbitrary requests Correct answer.

Explanation

Client-side checks improve usability but run in an environment the attacker controls, so they can be skipped entirely by crafting requests directly. Security decisions must be enforced on the server, which is the only component the attacker cannot modify. Client validation remains useful as a convenience, not as a control.

Question 31Application and systems security

A development team wants to prevent a compromised build server from pushing an unsigned artifact into production. Which control addresses this requirement most directly?

  1. Require production deployment to verify a cryptographic signature produced by a key the build server does not hold Correct answer.
  2. Store build logs in an append-only repository for auditing
  3. Scan build artifacts with a static analysis tool before release
  4. Restrict the build server's outbound network access to package registries

Explanation

If the signing key is held outside the build environment, a compromised builder cannot produce artifacts that production will accept. Verification at deploy time ties trust to the key rather than to the machine that assembled the code. Scanning, logging, and egress filtering reduce risk but do not stop a compromised builder from shipping tampered code.

Question 32Application and systems security

Which statement best explains why a memory-safe language reduces the attack surface of a network service compared with C?

  1. It guarantees that third-party libraries contain no vulnerabilities
  2. It encrypts all network traffic automatically
  3. Bounds and lifetime checks prevent out-of-bounds writes and use-after-free conditions that attackers exploit Correct answer.
  4. It eliminates the need for authentication logic in the service

Explanation

Memory-safe languages enforce bounds and object lifetime at runtime or compile time, removing whole classes of defects such as buffer overflows and use-after-free. Those defects are the foundation of many remote code execution exploits in native services. Memory safety does not address authentication design or flaws inside dependencies.

Question 33Application and systems security

An API accepts JSON containing a field that is later used to build an LDAP filter. Which remediation most directly removes the injection risk?

  1. Escape the value with an LDAP-aware encoder and validate it against an allowlist before use Correct answer.
  2. Reject requests whose Content-Type header is not application/json
  3. Log the raw field value for later forensic review
  4. Rate-limit requests per client to slow automated abuse

Explanation

LDAP filters have their own metacharacter rules, so values must be escaped with a filter-aware encoder and constrained to expected characters. Content-type checks and rate limits do not stop a well-formed request carrying a crafted value. Logging is detective only and does not prevent exploitation.

Question 34Application and systems security

An application issues access tokens with a 30-day lifetime and no revocation mechanism. A user reports a stolen laptop. Which design change most directly limits the window of misuse?

  1. Increase the token signing key length from 2048 to 4096 bits
  2. Add a random nonce to each token at issuance
  3. Issue short-lived access tokens paired with refresh tokens that can be revoked server-side Correct answer.
  4. Switch the token encoding from opaque strings to base64url JSON

Explanation

Short access-token lifetimes bound how long a stolen token remains useful, and server-side refresh-token revocation lets the relying party cut off renewal. Key length and encoding changes do not address the inability to revoke. A nonce alone does not create a revocation path.

Question 35Application and systems security

Which statement describes the purpose of a Content Security Policy in a web application?

  1. It stores session state on the server instead of in cookies
  2. It authenticates users before they can reach protected pages
  3. It restricts which sources the browser will load scripts and other resources from, limiting script injection impact Correct answer.
  4. It encrypts the response body between the server and the browser

Explanation

A Content Security Policy is a response header that tells the browser which origins may supply scripts, styles, and similar resources, and can forbid inline script. When an injection occurs, the policy can stop the injected payload from executing or exfiltrating data. It is not an encryption, authentication, or session-storage mechanism.

Question 36Application and systems security

A mobile banking app performs certificate pinning against its API. What does pinning accomplish that the platform's default trust store does not?

  1. It removes the need for the server to present a valid certificate chain
  2. It encrypts the connection with a stronger cipher suite than the platform would negotiate
  3. It prevents the device from installing user-added root certificates at all
  4. It rejects certificates that chain to a trusted CA but do not match the pinned key or certificate for that service Correct answer.

Explanation

Pinning narrows trust from any CA in the store to a specific key or certificate, so a misissued certificate from a compromised or coerced CA is refused. It does not change cipher negotiation or stop a user from installing a root certificate, though pinning may cause such interception to fail. The server must still present a valid chain.

Question 37Application and systems security

Which approach best protects secrets such as database passwords that an application needs at runtime?

  1. Embed them in the container image so they are available without network calls
  2. Store them in environment variables defined in a world-readable systemd unit file
  3. Commit them to the repository in an encrypted configuration file whose key is also in the repository
  4. Retrieve them at startup from a dedicated secrets manager that authenticates the workload and audits access Correct answer.

Explanation

A secrets manager centralizes storage, restricts access to authenticated workloads, supports rotation, and records who retrieved each secret. Keeping the decryption key alongside the ciphertext, baking secrets into images, or exposing them in readable unit files all leave them recoverable by anyone with access to the artifact or host.

Question 38Application and systems security

An application uses a random number generator seeded with the current time in seconds to create password reset tokens. Why is this a security weakness?

  1. The generator requires a hardware entropy source that servers typically lack
  2. The generator produces values that are too long for the reset endpoint to accept
  3. The seed space is small and guessable, so an attacker can enumerate plausible tokens for a target Correct answer.
  4. The tokens will collide with each other more often than the database can store

Explanation

Seeding with a coarse timestamp collapses the possible output space to a small number of candidate values that an attacker can brute-force within the validity window. Reset tokens must come from a cryptographically secure generator seeded by the operating system's entropy source. Token length and collision rates are secondary concerns.

Question 39Application and systems security

What is the primary security benefit of running an application process under a dedicated, unprivileged operating system account?

  1. The process executes faster because it avoids privilege checks
  2. Audit logs are automatically written for every file the process opens
  3. An exploit in the process gains only the limited rights of that account rather than administrative control of the host Correct answer.
  4. The account's password can be shared among administrators for convenience

Explanation

Dropping privileges constrains what code can do after compromise, so the attacker inherits the account's limited permissions instead of root or administrator rights. This is a direct application of least privilege at the OS layer. Performance, credential sharing, and automatic auditing are not consequences of using an unprivileged account.

Question 40Application and systems security

A security team must decide how to handle a third-party component that is no longer maintained and has a known remote code execution flaw. Which response best reflects sound risk treatment?

  1. Continue using the component because the flaw requires authentication and the application has a login page
  2. Replace or isolate the component, and in the interim apply compensating controls such as network segmentation and virtual patching Correct answer.
  3. Disable logging for the component so attackers cannot learn from error output
  4. Increase the frequency of vulnerability scans while leaving the deployment unchanged

Explanation

An unmaintained component with a known remote code execution flaw will not receive a vendor fix, so the organization must remove it, isolate it, or add compensating controls until replacement is possible. Merely scanning more often detects the problem without reducing exposure. Relying on authentication assumes the flaw cannot be reached by an authenticated or unauthenticated path.

Question 41Implementing authentication and authorization technologies

Which authentication factor category is represented when a user supplies a fingerprint to unlock a workstation?

  1. Something you know
  2. Something you have
  3. Something you do
  4. Something you are Correct answer.

Explanation

Authentication factors are grouped by the type of evidence they rely on. A fingerprint is a physiological biometric trait, so it belongs to the inherence category commonly described as something you are. Knowledge factors such as passwords and possession factors such as tokens are separate categories.

Question 42Implementing authentication and authorization technologies

An organization wants to combine a password with a one-time code generated by a hardware token. Which term best describes the resulting login process?

  1. Multi-factor authentication Correct answer.
  2. Single sign-on
  3. Role-based access control
  4. Federated identity

Explanation

Multi-factor authentication requires evidence from two or more distinct factor categories, here knowledge (the password) and possession (the token). Single sign-on and federation concern how credentials are shared across systems, not how many factor types are checked. Role-based access control governs authorization after authentication completes.

Question 43Implementing authentication and authorization technologies

Which access control model grants permissions based on the responsibilities an employee holds rather than on the identity of the individual?

  1. Mandatory access control
  2. Rule-based access control
  3. Role-based access control Correct answer.
  4. Discretionary access control

Explanation

Role-based access control assigns permissions to roles and then assigns users to those roles, so access follows job responsibilities. Discretionary and mandatory models key decisions to owner discretion or to system-wide labels respectively. Rule-based control evaluates conditions such as time or network location rather than job function.

Question 44Implementing authentication and authorization technologies

In a discretionary access control system, who ultimately decides which users may read a file?

  1. The operating system vendor
  2. The system security administrator
  3. The network firewall
  4. The file's owner Correct answer.

Explanation

Discretionary access control places access decisions with the resource owner, who can grant or revoke permissions at their discretion. Administrators set policy and firewalls filter traffic, but neither normally makes per-file discretionary grants. The vendor supplies the mechanism rather than the decision.

Question 45Implementing authentication and authorization technologies

Which protocol is specifically designed to carry authorization information about a user to a relying party without sharing the user's password?

  1. SAML Correct answer.
  2. RADIUS
  3. Kerberos
  4. LDAP

Explanation

Security Assertion Markup Language (SAML) exchanges XML assertions containing authentication and authorization statements between an identity provider and a service provider. RADIUS and Kerberos authenticate users to network or realm services, and LDAP is a directory access protocol rather than a web federation assertion format.

Question 46Implementing authentication and authorization technologies

Which concept describes granting users only the permissions they need to perform their current job and nothing more?

  1. Defense in depth
  2. Implicit deny
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits each account to the minimum access required for its duties, reducing the impact of misuse or compromise. Separation of duties splits sensitive tasks among people, defense in depth layers controls, and implicit deny is a default-deny rule behavior.

Question 47Implementing authentication and authorization technologies

A user signs in once and then accesses email, the payroll portal, and the ticketing system without re-entering credentials. What is this capability called?

  1. Just-in-time provisioning
  2. Password vaulting
  3. Credential stuffing
  4. Single sign-on Correct answer.

Explanation

Single sign-on authenticates a user once and then issues sessions or tokens trusted by multiple applications. Password vaulting stores credentials, credential stuffing is an attack using reused passwords, and just-in-time provisioning creates accounts on demand.

Question 48Implementing authentication and authorization technologies

Which Kerberos component issues the ticket-granting ticket that a client uses to request service tickets?

  1. Service server
  2. Authentication service
  3. Key distribution center client
  4. Ticket-granting service Correct answer.

Explanation

In Kerberos the authentication service validates the initial login, and the ticket-granting service then issues the ticket-granting ticket used to obtain service tickets. The service server hosts the protected resource, and there is no component called a key distribution center client.

Question 49Implementing authentication and authorization technologies

An administrator wants to enforce a rule that any request not explicitly permitted by policy is refused. Which authorization principle is being applied?

  1. Implicit deny Correct answer.
  2. Privilege creep
  3. Separation of duties
  4. Least privilege

Explanation

Implicit deny means the default outcome for any request lacking an explicit allow is refusal. Least privilege limits permission breadth, separation of duties divides tasks, and privilege creep describes permissions accumulating over time.

Question 50Implementing authentication and authorization technologies

A company issues smart cards that store a private key used to sign a login challenge. Which authentication factor does the card provide?

  1. Somewhere you are
  2. Something you have Correct answer.
  3. Something you know
  4. Something you are

Explanation

A smart card is a physical object the user possesses, so it is a possession factor. The private key inside the card enables cryptographic proof of possession without revealing the key itself. Knowledge, inherence, and location factors rely on memory, biology, or network position.